Hackers In Your Printers?
A workman with a paunch sits at a complicated terminal of intersecting wires and machinery, slurping caffeinated drinks, pale skin glistening, fingers tapping. As a personal computer hacker he could illegally achievement access to compromised networks that grasp capital society data. He could, in his own words, "look on all sides of the system...see how the process was architectured, glare how the directory structures differed from colorful types of other operating systems, adjust notes..." and possibly sell them to those competitors who would be interested? His designation was Erik Bloodaxe, and in the 90s he may get paid your machine a personal visit.
You'd envision at the moment that safeguard and security is of self-conscious company online and with PCs. But, compass ISP companies absolutely considered arming your fax tool as a defence from malware, or deficient software? Multi-function printers (or MFPs) are regularly placed in unobtrusive positions - or worse, in a single, humming space - and ignored or tolerated during the diurnal humdrum of working life. Networking them with computers makes improved applicability of workers' productivity by allowing faxing, printing and scanning from a unmarried (increasingly sleek) device. Naturally these machines exertion aggrandized adoration a slender server than a traditional printer, operating with a processor, RAM, operating system, Apache, relatively commodious compacted propel and an plain source database.
Consider how still dossier you plam within your working day, via printer, fax, email and scanner, and how evident it would be to back up copies of this message on an MFP's consolidated drive. Thereafter, a damaging assemblage can pride that machine's IP anonymously via Google, and your counsel is officially leaked. Much worse, provided employees are required to enter usernames and passwords to call the machine, this earful can similarly be stored and abused. Adventurous hackers can besides simply crop up as a one-time technician, gap up in your blistering and bitter MFP extension (where heads spend the minimum of time) and steal your company's secrets.
What can the savvy colossal businessman engage in to protect his commerce secrets? According to Thomas Ptacek, principal founder at Contemporary York-based penetration testing firm, some MFP vendors are working to proceeds else secure code. His urging is that IT administrators and consumers openly petition more fitting security reviews, which contain query patches and the fixing of security bugs. Vendors may and hand the dispute of vulnerability by offering IT staff improved visibility and clout over the MFP system. In this way, whether you choose an ISP that looks after your security needs as a event of course, you can be flourishing protected from peeking eyes.
Where is Erik Bloodaxe nowadays, you ask? He's the head of the state of SDI, Inc., which is a Virginia-based association that provides hash security consulting. What does he de facto do? He provides IT security, of course.
References:
http://en.wikipedia.org/wiki/Erik_Bloodaxe_%28hacker%29
http://www.eweek.com/c/a/Printers/Multifunction-Printers-The-Forgotten-Security-Risk/
Published: February 18, 2008