Sometimes it's hard to resist the promises made by the all-singing, all-dancing computer printers that line the shelves of stores of computer retailers. Yet perhaps we should resist, as it looks as if there may be a dark side to the printer revolution that few people are aware of; a dark side that threatens to turn the saviours of print into the spies within. Researchers are increasingly concerned by the possibility of direct attacks on the printers themselves – and have since the game changed in November 2011. Now, research to be published by a Finnish security company in the next week suggests printers are vulnerable to attack.
The first crack came seven months ago, when what had long had been discussed as theoretically possible – and was part of hacker lore – became reality, when two academics in New York publicly hacked into a Hewlett-Packard laser jet printer.
Using freely available information and a budget of $2,000 (£1,280), professor Salvatore Stolfo and researcher Ang Cui from Columbia University's appropriately named Intrusion Detection System Laboratory used the printer's remote firmware update to install potentially crippling malware that could even be targeted to destroy the device itself.
While HP did challenge what turned out to be aspects of the way the demonstration was reported, the company took the conclusions seriously, acting quickly and with "diligence" to issue more than 56 firmware updates.
However, seven months later, Stolfo's and Cui's latest – and as yet unpublished – research into embedded system insecurity and symbiote technology suggests people still haven't got the message. Based on a wide-area scan of HP laser jet printers on the internet, only 1–2% have been updated. Of those, one in four is still using default password settings for printer updates.
Stolfo suspects other brands may be just as vulnerable. "There are always myths and hoaxes, but not in this case," he argues. "We have demonstrated not only that the firmware update function of certain printers is faulty, but that there are still a number of known vulnerabilities in the real-time operating systems [such as Linux] used in a large number of printer models."
These include more than 100 known vulnerabilities in versions of the OpenSSL encryption protocols that – for example – could be used to turn them into "reconnaissance devices that operate behind corporate firewalls, spread malware to internal systems, and even exfiltrate printed documents outside of a protected site".
Such attacks, he believes, could be successful against whole families of printers that have the same design flaws, whatever modifications there have been for their various specific purposes. The myth that the diversity of printer firmware would act as a deterrence to hackers is just that – a myth. In reality, whatever the badge on the box, many printers are actually built with similar general-purpose real-time operating systems and using the same stock components.
Firmware weaknesses are made worse by people's lack of awareness about the nature of these embedded devices so that there are "many many devices out there and not much attention being paid to them", and as a result, his scans have found firmware dating back to 1992 to be still in use.
Ari Takanen agrees with Stolfo that the vulnerability of computer printers to such hacking is "all about awareness". Takanen is founder and chief technical officer of Finland-based robustness-testing company Codenomicon. The company has used its world-leading fuzzy solutions (software testing for security problems) product Defensics to test 15 protocols found commonly in consumer and low-end enterprise printers from six unnamed manufacturers for vulnerabilities that could open doors to hackers. Of these 15 protocols, five failed by demonstrating exceptions such as crashes on more than half of the printers, and two – the data transmission protocols TCPv4 and IPV6 – failed on every printer that they were installed on.
More detailed results of the tests will be published in a white paper by the end of July.
The key flaw comes because printers now have capabilities that let them receive documents from the cloud – in effect, emails.
"The more and more we are using our printers to send and receive emails the more and more they are liable to be attacked," says Takanen. "But few people realise that a lot of devices they have in their home don't have the firewalls and anti-viral software they have come to expect from their PC and can compromise the networks they are on due to the vulnerabilities in their firmware." He says that such vulnerabilities "are made worse by out-of-date code, because people don't treat their printer like a PC and update it regularly".
His team found Linux code dating back to 2006 in their sample.
Eeva Starck, a security analyst at Codenomicon, called the flaws "surprising" and "sort of scary".
She explained: "Files that get sent to the printers get cached before printing, and sometimes emailed forward. So if someone got in between these connections then they could cause the printer to crash, leak out confidential data and even put at risk the LAN [local area network] they are a part of."
While for the home user this is less likely to be a problem, it is, she believes, more of a serious issue "for startups who don't have the money to be investing in security, and yet whose printers are handling confidential information".
Denial-of-service attacks via TCPv4 have been seen on other embedded devices that use similar protocols, such as Wi-Fi routers, but not yet,"as far as we, know on any printers".
In the long run Takanen is pessimistic about the chances of improving printer security, as these flaws are "easy for hackers to find".
He explains: "Even though some vendors are waking up and taking it seriously, others don't care because they don't need to, even though just simple testing would highlight the problems, as consumers are motivated by price and there is too little competition."
Starck concurs, adding "it takes time and money to put these things right" and some companies are manufacturing these low-end printers "on a shoestring, their revenue model being to chug out as many printers as cheaply as possible. And basically what can seem like washing their hands of them".
By contrast, Stolfo does see printer security as a "massive new market" for the industry, with the development of new products such as Mocana's Smart Device Security Platform. Yet he shares Takanen's concerns, since "the industry seems to be responding by building in cryptographic protocols to allow embedded devices to talk to each other, even though the code used is itself vulnerable, as are the devices still themselves".
Stolfo is particularly concerned by the "legacy of insecurity" created by all the devices that are going to be replaced only when they break down – potentially years in the future – while other embedded devices such as smart TVs may use similar firmware.
"Good security software design is a big help, better real-time OS's for sure, but none of these will do much about the huge existing base of devices. For that we have invented a technology we have to come call Symbiote".
This technology allows the injection of security software (and hence security properties) into legacy firmware and "protects the firmware from malicious attack".
Stolfo and Cui are hoping to commercialise this technology with their new spinoff, Red Balloon Security.
After all, he sys, "we have been contacted by quite a few people asking for details of the RFU attack, as well as our software. There is no doubt the vulnerability and the opportunity is being seriously studied by attackers."
Ultimately, Takanen believes, it is "hard to know the best solution to an industry that can seem to have poor quality requirements" although some kind of formalised "test requirements" or "certification" could be possibilities.
And, he says drily, perhaps the "the safest bet is just not to be connected to the internet in the first place."