HP printers can be remotely controlled and set on fire, researchers claim

[DainBramaged]

Security researchers at Columbia University have accused HP of selling printers with a flaw that could let hackers gain remote control over the devices. Once compromised, the access can be used to steal personal information, attack networks, and even set printers on fire by feeding them a continuous stream of instructions designed to heat them up.

The researchers, funded by government and industry grants, reported the flaw to federal officials and HP this month, and gave a demonstration to MSNBC, which has an extensive article on the subject today. HP told MSNBC that it is reviewing the details, but denied that the problem is as extensive as claimed by Columbia PhD student Ang Cui and Professor Salvatore Stolfo.

Cui and Stolfo say they can remotely install malicious software onto HP LaserJet printers because the printers accept software updates without examining digital signatures, and check for updates each time they accept a print job. "In one demonstration of an attack based on the flaw, Stolfo and fellow researcher Ang Cui showed how a hijacked computer could be given instructions that would continuously heat up the printer’s fuser—which is designed to dry the ink once it’s applied to paper—eventually causing the paper to turn brown and smoke," according to MSNBC. "In that demonstration, a thermal switch shut the printer down—basically, causing it to self-destruct—before a fire started, but the researchers believe other printers might be used as fire starters, giving computer hackers a dangerous new tool that could allow simple computer code to wreak real-world havoc."

The researchers also showed how a hacked printer can be forced to send tax forms and other sensitive documents to criminals, and said the flaw could also be used to disable printers by the thousands. Printers hooked up to computers could also be used to launch attacks and join botnets, they say.

http://arstechnica.com/business/news/2011/11/hp-printers-can-be-remotely-controlled-and-set-on-fire-researchers-claim.ars


Teh stupid, it burns..............what's next, tinfoil hats?

[Enrique]

1. a "flaw"?

i think it's awesome. :thumbsup:

[FarCenter]

2. Hacking laser printers is well known; possibly starting fires is new

[gkhouston]

15. Soon to be named the Cornholio Maneuver. n/t

[snagglepuss]

3. Are you saying the research is tinfoil?

[IDemo]

4. Posted here as well->

http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=102x5073846

[lpbk2713]

7. Thanks for the clarification.

I was beginning to think there was an echo in here. :eyes:

[immoderate]

5. Well, it's not exactly the ELECTROMAGNETIC PULSE.

Sounds like a simple fix for HP. Update the firmware. And a fuse for the fuser.

--imm

[saras]

8. They're going to take apart all the printers they've sold and replace the firmware and add a fuse?

...sure thing. Right after Microsoft fixes all their security flaws.

You can't, in many cases, update the firmware without physically opening up the printer. It's not designed to be updated. And you CERTAINLY can't add a fuse to an electrical circuit remotely.

And it's not difficult hacking. Making your printer accessible to an external wireless network is a FEATURE.

[DCKit]

9. "can't...update the firmware without physically opening up the printer."

You can "flash" a firmware update to the bios of any equipment so equipped.

Case in point, LG blu-ray players.

Just sayin'.

[immoderate]

12. Consider I'm not claiming expertise, but to my knowledge...

Laser printers that fuse toner, all already have a thermal fuse, as does the one in the demo. Your toaster has one. This can't be defeated remotely. But apparently you can get it to blow the fuse.

Not sure how hard it is to get to a chip and swap it on any given machine. Most modern printers fall into two categories: modular, and disposable. If it's designed to be repaired, something can be swapped.

I think the real threat here is what might be done with stolen data. That's pretty scary. But it's a software fix.

--imm

[IDemo]

13. Nowadays, flash parts aren't usually easily swapped out

Long gone are the days of through-hole components, and chips with leads (legs) are on the way out as well. The trend is BGA parts (Ball Grid Array) that require a lab-grade hot air tool to place.

[immoderate]

16. It lives on a board. You swap out the board.

Boards are then factory refurbished. Recycled.

I assume we're talking about large expensive units that are constructed from modules in the first place. Chips can fail for other reasons than terrorism. What do they do then? :shrug: The chip is stuck to something; take that out, or whatever that is stuck to, if you have to.

BTW, among my acquaintances are a couple of lab-grade hot air tools. :)

--imm

[IDemo]

18. The board it "lives on" is essentially an entire motherboard

Just for the disclaimer, I worked in the HP LaserJet lab here in Boise for several years. The circuit board where the controller, flash, DRAM and other components are situated is known as the formatter board, and it would be prohibitively expensive to swap out just for the sake of changing out the flash memory parts.

[FirstLight]

6. i'm bad

this first thing i thought of was using the flaw against govt offices as a revolutionary tactic...i guess i am in a mood today

bad girl! :spank:

[TheWraith]

10. Why on Earth would you think of that?

It's suddenly good, or funny, to contemplate destroying public property? Who are you going to use it on, the people who inspect our food for safety? Or the ones who investigate federal crimes? Or the people who allocate money for those first two?

[FirstLight]

11. no...

just pissed off this morning at the govt... after watching Scott Olsen's interview, i want to burn shit down.
sorry... i know it's not cool...that's why i spanked myself!

[Safetykitten]

14. So, the thing where they run out of ink all the time...that can't be fiddled with either I suppose?

[NightWatcher]

17. That sux. I can't even print a label or envelope, much less something cool.