Printers - The Weakest Node

I had seen companies which invested heavily on security. They had some of the best firewalls, hardened all their servers and conducted regular security assessments on their internal and external applications. It is often rare enough to find some of these companies actually patches the firmware of their routers, switches and network devices. However I had almost never come across one that patches their printers as part of their security practice. Most of these companies does not even set any passwords on their printers or even know that they can do so.

Printer hacking is not something new and has been introduced years ago. With modern multifunction printers, it is often common to find embedded operating systems with full networking support and removable storages devices hidden inside. Most of these printers have build in applications serving web portal, ftp and telnet services to enhance productivity. This opens up new opportunities for creative attacks against the printers.

Dumpster driving (retrieval of information from paper waste) is no longer necessary when hackers can simply pull information out from the removable storage. While companies have enforced policies on storage media disposal, the printer is often overlooked. Often printers are sent in for repair or even sold or donated as it is. Some of the mini hard disks were found to contain fax history and some even fax images. Classified information may have been stored and if it falls into the wrong hands, it can may a lot of damages to the companies.

Some of the services of these printers may also pose security risk to the company. Unsecured communication through telnet or ftp which are unencrypted may reveal control passwords and printer configurations. Print jobs can also be easily sniffed out by anyone on the network when they are sent through unencrypted channels. Unauthorized users can easily abused the printers by sending job through direct printing ports or via the web interface which usually requires no authentication. These services can assist authorized users from bypassing printing quotas and often allows these users to avoid leaving audit trails in the system.

However, the printer posed the most risk when it has been taken over. Clever hackers may be able to launch scans or attacks into the company network or other networks. The printer storage may be used to store hacking tools for deployment on other servers. Through the configurations, some printers may even allow duplicate copies of all documents to be fax or email out to other locations. Printers can also be taken down by putting in a bad firmware or locking the printing ports. The list goes on. It is all up to hackers to get creative on how much the printers can do for them once they have control of them.

Printers should no longer be treated as dumb devices on the network. Security practice should extend to cover printers because they are as capable as workstations today. While not many printer manufacturers are providing security support to these devices, consumers should take proactive actions to pressure them. Start protecting your printers and not let them become the weakest nodes in your network.