Back in 2006, PC Pitstop in partnership with D2 Worldwide – helped to expose the troubling levels of LiIon battery volatility and the risks of exploding laptops.
[youtube pizFsY0yjss?rel=0″ 368 227]
That was then…Now – A New Problem
Researchers at the Columbia University School of Engineering and Applied Science have uncovered a vunerability that leaves tens of millions of common office printers open to devasting malware infections – including attacks that could cause the printers to catch on fire.
The story was first revealed in an article posted on msnbc.com.
Printers can be remotely controlled by computer criminals over the Internet, with the potential to steal personal information, attack otherwise secure networks and even cause physical damage, the researchers argue in a vulnerability warning first reported by msnbc.com. They say there’s no easy fix for the flaw they’ve identified in some Hewlett-Packard LaserJet printer lines – and perhaps on other firms’ printers, too – and there’s no way to tell if hackers have already exploited it.–MSNBC
Printer security flaws have long been theorized, but the Columbia researchers say they’ve discovered the first-ever doorway into millions of printers worldwide. In one demonstration of an attack based on the flaw, Stolfo and fellow researcher Ang Cui showed how a hijacked computer could be given instructions that would continuously heat up the printer’s fuser – which is designed to dry the ink once it’s applied to paper – eventually causing the paper to turn brown and smoke.
In that demonstration, a thermal switch shut the printer down – basically, causing it to self-destruct – before a fire started, but the researchers believe other printers might be used as fire starters, giving computer hackers a dangerous new tool that could allow simple computer code to wreak real-world havoc.–MSNBC
Columbia professor Salvatore Stolfo was later quoted by thestar as saying;
“Some of the media outlets incorrectly (and inappropriately) reported about ‘burning printers.’ We were not able to burn any printer. In fact, our test showed that the thermal switch in the HP 2055DC printer design cuts power to the printer we tested if the fuser heats too much. That is good news for HP that their cutoff switch worked.
“Unfortunately, too many media outlets ignored our finding and reported the opposite.”
Although the testing at Columbia was limited to particular HP LaserJet printers, the researchers (in a quick online search) were able to identify 40,000 devices ( including DVD players, telephone conference tools, even home appliances) and others commonly connected to the internet that could face similar mechanical or physical attacks. It is not known – how many of these devices include a temperature safe guard that could prevent a fire – like the HP printers in this test.
HP’s response (11/29/2011):
Today there has been sensational and inaccurate reporting regarding a potential security vulnerability with some HP LaserJet printers. No customer has reported unauthorized access. Speculation regarding potential for devices to catch fire due to a firmware change is false.
HP LaserJet printers have a hardware element called a “thermal breaker” that is designed to prevent the fuser from overheating or causing a fire. It cannot be overcome by a firmware change or this proposed vulnerability.
HP has sold 100 million LaserJet printers since 1984.
What Should You Do?
Look for HP to release firmware updates in the near future for the affected printers. Also be aware that the same situation can exist for routers, if you do not change the default password.
PC World: 7 Ways to Protect Your Printers
Updates:
Wired.com: HP Hit With Lawsuit Over Flaming-Printer Hack
Security Week: HP Printer Firmware Vulnerabilities: FUD or Fire?
“The focus of HP is on the fire issue, but they don’t say anything to address the real issue, which is the fairly indefensible position of not cryptographically authenticating their printer software updates,” Security expert Kurt Stammberger, VP of Market Development at device security firm Mocana told SecurityWeek. “Fires notwithstanding, printers are still a great place to launch and attack against a network, because they are so broadly connected.”
