When you think about online security, you probably think about anti-virus software, password security, and being careful not to open suspicious emails to name but a few things. Securing the fax machine? Let's be honest, that probably didn't cross your mind at all.
It's common to have a printer that is also a copier and a fax machine, and for it to be on a network shared with PCs. So it stands to reason that if a third party can gain control via the fax machine then they could potentially get access to anything on the network. The fact that no-one really considers fax machines when protecting themselves or their business against cyber attacks means that they are frighteningly vulnerable, as demonstrated recently by Check Point Research.
The research was done using HP Officejet all-in-one printers, and Check Point have been working with HP to ensure that the vulnerability was patched before it was announced at DEFCON 2018 yesterday. However, they have said that they "strongly believe that similar vulnerabilities apply to other fax vendors too as this research concerns the fax communication protocols in general." In addition, the vulnerability is not restricted to all-in-one machines, fax-to-mail services and standalone fax machines could also be targeted.
So is this a big deal?
Yes. Most people don't use faxes regularly nowadays, everyone tends to prefer email for it's speed and ease. However many businesses still have fax machines, and use them regularly. As useful as email is, some institutions still require official documents to be sent to them by either post or fax - partly because email is not recognised as visual evidence in court.
In a recent news article, it was revealed the in the UK the NHS still relies on fax machines, and has over 9,000 machines in active use.
How does it work?
All the hacker needs is a phone line and a fax number to send the malicious fax, and this allows them to gain access to other devices on the network. Check Point Research have not revealed details of how to implement the hack itself, but they have provided a lengthy technical analysis that gives more detail about how they were able to identify an exploit the vulnerability.
So whilst fax machines may be thought of as a relic of the past, the fact that use of them is still so widespread means this threat needs to be taken seriously.
It's common to have a printer that is also a copier and a fax machine, and for it to be on a network shared with PCs. So it stands to reason that if a third party can gain control via the fax machine then they could potentially get access to anything on the network. The fact that no-one really considers fax machines when protecting themselves or their business against cyber attacks means that they are frighteningly vulnerable, as demonstrated recently by Check Point Research.
The research was done using HP Officejet all-in-one printers, and Check Point have been working with HP to ensure that the vulnerability was patched before it was announced at DEFCON 2018 yesterday. However, they have said that they "strongly believe that similar vulnerabilities apply to other fax vendors too as this research concerns the fax communication protocols in general." In addition, the vulnerability is not restricted to all-in-one machines, fax-to-mail services and standalone fax machines could also be targeted.
So is this a big deal?
Yes. Most people don't use faxes regularly nowadays, everyone tends to prefer email for it's speed and ease. However many businesses still have fax machines, and use them regularly. As useful as email is, some institutions still require official documents to be sent to them by either post or fax - partly because email is not recognised as visual evidence in court.
In a recent news article, it was revealed the in the UK the NHS still relies on fax machines, and has over 9,000 machines in active use.
How does it work?
All the hacker needs is a phone line and a fax number to send the malicious fax, and this allows them to gain access to other devices on the network. Check Point Research have not revealed details of how to implement the hack itself, but they have provided a lengthy technical analysis that gives more detail about how they were able to identify an exploit the vulnerability.
So whilst fax machines may be thought of as a relic of the past, the fact that use of them is still so widespread means this threat needs to be taken seriously.
