Tens of millions of HP LaserJet printers vulnerable to hacking

http://www.extremetech.com/computing/106945-tens-of-millions-of-hp-laserjet-printers-vulnerable-to-hacking

by ukdm • 15 years ago

59 20 15 years ago

nicpottier2• 15 years ago

At first this seems like ho-hum news a bit, but if their claims that you might be able to set a printer on fire using this are true, then HOLY FUCK!

How many million HP printers are there in how many million offices filled with how many vulnerable PCs?

I'm not usually one to be alarmist, but are we one clever worm away from Printergeddon?

JoeAltmaier2• 15 years ago

...and the worm can be inside a PDF. So what, we can only print plain-text now? Does my virus scanner look for firmware worms in pdf files?

planb• 15 years ago

I didn't get that from the article. How's a PDF file supposed to trigger the (vulnerable) firmware update mechanism of the printer?

mrsebastian• 15 years ago

If I was HP -- or a third-party toner provider -- I would release a worm that forces printers to use two or three times the usual amount of ink...

pbhjpbhj• 15 years ago

Even better surely is to just tell the printer to report the toner as empty after say 30% use (like manufacturers do with inkjet carts!). Then when the customer sends the toner cart in you can recycle the toner (or just top it up and reset the cart or whatever) and sell it back to the customer ... instant sales increase.

Of course after a little while the customers going to notice a problem. So then you can sell them a fix (patched firmware) or a new printer. Play it right and you get to run the same scam again then ...

8ig8• 15 years ago

I think my HP printer had that worm pre-installed.

We dusted off an old, wired, B&W low res Cannon laser printer last year. It's our utility printer for internal docs or stuff you'd prefer to review on paper. It feels like an old reliable car. I think we're still using the same toner from last year's rebirth.

I bet there are a ton of these old printers sitting in corners shadowed by some glitzy full color, wifi, Internet enabled new hotness printer. It's probably a smart move to grab one of these old workhorses off Craigslist if you just need to print plain docs.

anigbrowl• 15 years ago

Meh, sprinkler systems will rain on that parade.

GICodeWarrior• 15 years ago

The hardware thermal protections kick in before a fire is started. The possibility of stealing information or flat-out bricking the printer are more likely than fire.

HP claims all new models since 2009 enforce digital signatures. Firmware updates for older printers should be able to add this feature, but I don't see any evidence to suggest they do (or don't).

Further, most laser printers are on relatively safe networks, and even if there are infected machines on the network, there are generally a number of other ways to wreak havoc and steal information.

nicpottier2• 15 years ago

Ah, ok, much less of an issue if there's a hardware switch that prevents overheating (who's settings can't be changed via the ROM).

Agree it isn't any new from a data loss point of view, but I was imagining thousands of offices having printers catching fire in the middle of the night. (can you imagine?)

j45• 15 years ago

Wow. I worked on HP printers a long time ago and didn't hear of anything this crazy.

Personally I stopped using HP a while back, thanks for sharing..!

robododo• 15 years ago

It's not shocking at all that they allow firmware updates through the print port. That's very typical.

What's shocking is the claim that the update isn't signed. I'm at a loss as to how to describe how terrifically awful that is. It's /so/ shocking to me, I have a hard time believing it. If true, it's astoundingly negligent on their part.

d99kris• 15 years ago

It’s worth noting that other (non-HP) printers, copiers, and all-in-one thingamajigs are probably vulnerable to a similar attack, too.

Well anything produced to be mass/IT-managed probably provides an easy method for firmware upgrading. And all firmware encryptions/checksums/etc are of course (at least theoretically) crackable.

I don't see how this could come off as a surprise to anyone in the industry.

zanst• 15 years ago

this is f*cking awesome. I feel like I'm in 80s. Thanks, HP.

Tens of millions of HP LaserJet printers vulnerable to hacking

Related Stories