Vulnerabilities / Threats
12/5/2011
12:42 PM
Connect Directly
RSS
E-Mail
50%
50%

HP Denies Exploit Could Trigger Printer Fire

Security researchers warned that zero-day printer vulnerability could be exploited to overheat printers, or worse.

HP last week denied reports that a bug in its printer firmware could be remotely exploited by an attacker to cause the device to burst into flames.

"There has been sensational and inaccurate reporting regarding a potential security vulnerability with some HP LaserJet printers," according to a statement released by HP. "Speculation regarding potential for devices to catch fire due to a firmware change is false."

HP's statement came in response to an MSNBC report about a demonstration by Columbia University researchers, who exploited a vulnerability they discovered in HP LaserJet firmware to load custom firmware, which was set to cause the printer's fuser--which heats up toner to cause it to bond to paper--to overheat.

"These devices are completely open and available to be exploited," Salvatore Stolfo, a professor who directs research in Columbia University's computer science department, told MSNBC. He estimated that millions of printers might be affected.

[ From Apple To CarrierIQ, it seems companies don't wait long to punish researchers who disclose vulnerabilities. See Vendors Quick To Hit Back At Security Researchers. ]

Thankfully, however, while the HP printers may be vulnerable to hacking, getting them to catch fire doesn't appear to be easy, if it's even possible. That's because HP printers have a thermal breaker that's set to trip and shut down the device if it overheats for any reason. In fact, this is precisely what happened to the HP printer during the Columbia researchers' demonstration. Furthermore, HP said that its thermal breakers "cannot be overcome by a firmware change or this proposed vulnerability."

While using online attacks to cause device meltdowns might be difficult, actually exploiting devices to steal information would appear to be a much easier task. Notably, the Columbia researchers discovered that HP LaserJet firmware--which they reverse-engineered--doesn't validate software updates to confirm that they're legitimate. Furthermore, many of the printers are Internet-connected. As a result, they said, attackers could remotely load custom firmware, not just to damage the device, but also, for example, to send copies of everything that a device printed or scanned to an external server.

HP said it's working on a firmware upgrade for that vulnerability--which hasn't been exploited in the wild--and recommended that all Internet-enabled printers be placed behind firewalls, and that "where possible" existing users disable remote firmware updates. Interestingly, HP said that the vulnerability could sometimes also be exploited in Linux or Mac environments, using "a specially formatted corrupt print job to trigger a firmware upgrade."

Of course, attackers might not even have to bother writing custom firmware. According to research presented by Michael Sutton, VP of security research for Web security firm Zscaler Labs, at the Black Hat security conference earlier this year, many printers, photocopiers, and voice-over-IP systems are Internet-connected, and use well-known default passwords or firmware with known vulnerabilities. Either could be exploited by attackers to gain remote access to the devices, and in some cases, simply update their settings to copy all documents scanned or phone calls facilitated, using built-in management software.

If hacking into a device and attempting to make it catch on fire sounds familiar, that's because Charlie Miller of Accuvant, earlier this year, demonstrated at the Black Hat conference in Las Vegas how Apple laptop batteries' firmware could be hacked. Such hacks could be used to turn batteries into bricks, introduce malware onto laptops, or even overcharge the battery, which Miller warned might cause it to catch fire. But industry watchers said that high-quality laptop batteries typically sport numerous safety features that can't be disabled via firmware, including circuit interrupters that prevent overcharging or undercharging.

Companies that have implemented or are evaluating managed print services look to the model for its ability to reduce costs and increase end user productivity. However, IT teams need to be aware of security and scalability when selecting a partner. Here's how two large companies in diverse industries got a handle on printing. Read our report now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-4988
Published: 2014-07-09
Heap-based buffer overflow in the xjpegls.dll (aka JLS, JPEG-LS, or JPEG lossless) format plugin in XnView 1.99 and 1.99.1 allows remote attackers to execute arbitrary code via a crafted JLS image file.

CVE-2014-0207
Published: 2014-07-09
The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.

CVE-2014-0537
Published: 2014-07-09
Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 allow attackers to bypass intended access restrictions via uns...

CVE-2014-0539
Published: 2014-07-09
Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 allow attackers to bypass intended access restrictions via uns...

CVE-2014-3309
Published: 2014-07-09
The NTP implementation in Cisco IOS and IOS XE does not properly support use of the access-group command for a "deny all" configuration, which allows remote attackers to bypass intended restrictions on time synchronization via a standard query, aka Bug ID CSCuj66318.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.