Story image

Why your printer could be the doormat to your network

14 Mar 2017

For years, networked printers have left gaping holes in business defences.

Flaws within printers can permit print docs to be captured, allow buffer overflow exploits, disclose passwords or cause printer damage.

We recently reported the news of a kid hacker breaking his way with ease into more than 160,000 printers worldwide.

Chief of security strategy at SentinelOne, Jeremiah Grossman says printers can expose users to many different kinds of attacks.

According to Grossman, these include:

  • Hackers can use vulnerabilities to capture old printing logs and steal sensitive information. They may also exploit these flaws to break into a networked device and move laterally through a business to gain more information.
  • Attackers can gain control of networked printers to use one company’s bandwidth to attack other businesses and individuals around the globe via DDoS

Obviously, one of the main drivers of the issue is a lack of awareness.

"Most of the time, printers are not going to be terribly different from any IoT device," Grossman says.

"Normally, the purchasers of network-connected printers aren't concerned. "'Why should I be concerned about a printer?' they ask. "But it's not just a printer; it's a computer inside a printer and should be treated as such."

Another issue is ownership, as printers are shared devices in an office it can often be unclear just what department they belong to, leading to ambiguity over who should be maintaining the security.

One of the longstanding issues, according to Grossman, is vendors not supporting patches on older devices. Businesses have the information they need to protect themselves, but they won’t be secure due to lack of incentive in the system.

What is concerning, is that printers will become more popular targets over time. Grossman asserts that currently the most popular (and easiest) methods of entry for hackers include web hacking and email attacks, but gradually this will change to IoT as we become more connected and computers and operating systems more secure.

Here are some simple methods to better secure your printer and network:

  • Regularly check manufacturer websites to see if patches are available
  • Isolate printers on local networks separate from PCs
  • Periodically update passwords
  • Use intrusion detection

It’s also vital to buy your printer hardware from a trusted manufacturer, like Fuji Xerox, and to ensure your equipment remains modern.

At the end of the day, printers are low-hanging fruit for hackers, and it’s up to businesses to ensure they remain out of reach.

NZ investment funds throw weight against social media giants
A consortium of NZ funds managing assets worth more than $90m are appealing against Facebook, Twitter, and Google following the Christchurch terror attacks.
Poly appoints new A/NZ managing director, Andy Hurt
“We’re excited to be bringing together two established pioneers in audio and video technology to be moving forward and one business – Poly."
Unity and NVIDIA announce real-time ray tracing across industries
For situations that demand maximum photorealism and the highest visual fidelity, ray tracing provides reflections and accurate dynamic computations for global lighting.
NVIDIA announces Jetson Nano: A US$99 tiny, yet mighty AI computer 
“Jetson Nano makes AI more accessible to everyone, and is supported by the same underlying architecture and software that powers the world's supercomputers.”
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.
NVIDIA introduces a new breed of high-performance workstations
“Data science is one of the fastest growing fields of computer science and impacts every industry."
Apple says its new iMacs are "pretty freaking powerful"
The company has chosen the tagline “Pretty. Freaking powerful” as the tagline – and it’s not too hard to see why.
NZ ISPs issue open letter to social media giants to discuss censorship
Content sharing platforms have a duty of care to proactively monitor for harmful content, act expeditiously to remove content which is flagged to them as illegal.