preview.tinyurl.com/brh9bbq -> arstechnica.com/business/news/2011/11/hp-printers-can-be-remotely-controlled-and-set-on-fire-researchers-claim.ars
Jon Brodkin | Published November 29, 2011 10:25 AMLast updated November 29, 2011 11:23 AM Security researchers at Columbia University have accused HP of selling printers with a flaw that could let hackers gain remote control over the devices. Once compromised, the access can be used to steal personal information, attack networks, and even set printers on fire by feeding them a continuous stream of instructions designed to heat them up.
MSNBC, which has an extensive article on the subject today. HP told MSNBC that it is reviewing the details, but denied that the problem is as extensive as claimed by Columbia PhD student Ang Cui and Professor Salvatore Stolfo. Cui and Stolfo say they can remotely install malicious software onto HP LaserJet printers because the printers accept software updates without examining digital signatures, and check for updates each time they accept a print job. "In one demonstration of an attack based on the flaw, Stolfo and fellow researcher Ang Cui showed how a hijacked computer could be given instructions that would continuously heat up the printer's fuser--which is designed to dry the ink once it's applied to paper--eventually causing the paper to turn brown and smoke," according to MSNBC. "In that demonstration, a thermal switch shut the printer down--basically, causing it to self-destruct--before a fire started, but the researchers believe other printers might be used as fire starters, giving computer hackers a dangerous new tool that could allow simple computer code to wreak real-world havoc." The researchers also showed how a hacked printer can be forced to send tax forms and other sensitive documents to criminals, and said the flaw could also be used to disable printers by the thousands. Printers hooked up to computers could also be used to launch attacks and join botnets, they say.
Once the malware is on the printer, the printer itself can become part of a botnet, or can be controlled by malware on the host PC, or can potentially be used to attack the PC, etc." However, HP Chief Technologist Keith Moore disputed many of the researchers' claims. In an interview with MSNBC, Moore said HP's printers have required digitally signed firmware upgrades since 2009; that most home users have InkJet printers that do not allow remote upgrades; and that printers behind a firewall are not vulnerable to the flaw. The researchers, however, say models with the flaw are still being sold in major office supply stores. Although the researchers' claims have caused HP to take notice, Cui and Stolfo have not yet published any research on the vulnerability.
National Vulnerability Database does turn up other flaws in HP printers that could allow remote attacks. With regard to the newly discovered vulnerability, Stolfo tells Ars in an e-mail "the formal publication is in preparation but not yet available."
|
http://csua.com/feed/