There are plenty of online fax services out there, but many organizations still have all-in-one printers and other fax-connected devices on their network.
Researchers at Check Point Software recently published a report at the Def Con hacker conference in Las Vegas showing how those device could become a gateway for attackers to gain access to your entire network.
The researchers found critical vulnerabilities in several all-in-one printers. Using what they called a ‘Faxploit,’ they chose an HP device and sent an image file to the printer’s fax number disguising lines of malicious code.
Once stored in the machine’s memory, the researchers were able to use the fax machine as a jumping-off point using “lateral movement” to infiltrate an entire network and the computers connected to it.
Check Point worked directly with HP to fix the vulnerability, which release a patch before the research was published
Check Point said the unsecured phone line represents a dangerous attack vector that’s not properly secured for the hundreds of millions of fax machines and all-in-one printers still in use around the world. Industries such as the medical community are at particular risk, though there are efforts to end physical fax machine use by 2020.
The researchers said online fax services using the T.30 fax protocol could be at risk as well, and recommended that organizations segment their network and of course regularly install security patches on any fax machines or all-in-one printers connected to their network.
Since most fax machines are today integrated into all-in-one printers, connected to a WiFi network and PSTN phone line, a remote attacker can simply send a specially-crafted image file via fax to exploit the reported vulnerabilities and seize control of an enterprise or home network.
All the attacker needs to exploit these vulnerabilities is a Fax number, which can be easily found simply by browsing a corporate website or requesting it directly.
Faxploit Attack — Demonstration Video
Dubbed Faxploit, the attack involves two buffer overflow vulnerabilities—one triggers while parsing COM markers (CVE-2018-5925) and another stack-based issue occurs while parsing DHT markers (CVE-2018-5924), which leads to remote code execution.
To demonstrate the attack, Check Point Malware Research Team Lead Yaniv Balmas and security researcher Eyal Itkin used the popular HP Officejet Pro All-in-One fax printers—the HP Officejet Pro 6830 all-in-one printer and OfficeJet Pro 8720.
As shown in the above video, the researchers send an image file loaded with malicious payload through the phone line, and as soon as the fax machine receives it, the image is decoded and uploaded into the fax-printer’s memory.
In their case, the researchers used NSA-developed EternalBlue and Double Pulsar exploits, which was leaked by the Shadow Brokers group and was behind the WannaCry ransomwareglobal outcry last year, to take over the connected machine and further spread the malicious code through the network.
“Using nothing but a phone line, we were able to send a fax that could take full control over the printer, and later spread our payload inside the computer network accessible to the printer,” the researcher said in a detailed blog post published today.
“We believe that this security risk should be given special attention by the community, changing the way that modern network architectures treat network printers and fax machines.”
According to the Check Point researchers, attackers can code the image file with malware including ransomware, cryptocurrency miners, or surveillance tools, depending upon their targets of interest and motives.
Check Point researchers responsibly disclosed their findings to Hewlett Packard, which quickly fixed the flaws in its all-in-one printers and deployed firmware patches in response. A patch is available on HP’s support page.
However, the researchers believe the same vulnerabilities could also impact most fax-based all-in-one printers sold by other manufacturers and other fax implementation, such as fax-to-mail services, standalone fax machines, and more.