Aaaah Turing complete printers, always lovely! I cannot find the link, but there was the story of a hacker that sent raytracing programs made in postscript to printers, just to see them struggle to print, and then print some pretty but useless picture.
>>"HP LaserJet printers have a hardware element called a 'thermal breaker' that is designed to prevent the fuser from overheating or causing a fire. It cannot be overcome by a firmware change or this proposed vulnerability."
I wouldn't be so sure about that last part, but I do doubt that the things can be made to cause adjacent objects to catch fire (unless maybe someone stores their gasoline in open containers near the printer).
A thermal breaker is a purely mechanical device, it opens the electrical circuit if temperature rises beyond its designed limit. It is not controlled by software. It is designed to be a failsafe against another hardware or software problem which is causing an overheating condition. I think HPs claim on at least that issue is credible.
Yes, I know what a thermal breaker is, and that the switch itself cannot be affected by firmware, so he is correct in that statement, but that is so obvious that doesn't really need mentioning. What I mean is that the protection that is intended by the thermal switch might be cleverly defeated. The thermal switch is usually mounted on the (metal frame) chassis, not always close to the parts that would catch fire. What I am suggesting is that one might find a way to cause a paper jam, and then get the paper to ignite before the chassis were heated enough to cause the thermal switch to open. It might even be dependent upon a specific model(s). I doubt it is possible to prevent without very careful placement of thermal switch(es). The kind of placement that would defy efficient manufacturing ideals, and possibly even user-safety-inspired design practices. TBH, I don't think it is likely to be a reliable ignition method. Besides, Randall Hyde has shown us the most satisfying way to get rid of printers (buckshot).
The talk clearly mentions that if you can put malware into a printer wouldn't you use it to pawn a network instead of just setting it on fire - also it isn't possible to set it on fire - they just made that up.
Well, if someone wants to use it for criminal activities, then arson may be much more profitable than a pawned network; it would be undetectable since any evidence of hacking would be destroyed in the fire, so it might be used in both harming competitors and also for insurance fraud.
When I was 14(in 2000) I took intro to computer science. The first program I built outside of class was a program that took over the users printer and printed out all sorts of stuff as well as shot out error codes etc. I just thought it was amazing that with just a little bit of visual basic I could own your printer.
I have a networked HP printer (or perhaps I shouldn't admit that). Does anybody have a dummies guide on how to protect myself while maintaining connection to the internet? Thanks!
Don't expose it directly to the Internet, such as by assigning it a publicly routable IP address or forwarding the ports it uses (typically 515 and 9000-9003/TCP) from hosts on the Internet.
For the most part, if it's on your "internal" network and isn't accessible from hosts on the Internet, you're safe (except from "insiders").
If you need it exposed to the internet you can at least attempt to change your port forwarding settings on your router to use a different port on the public side of the connection, for example, routing port 10000 to 192.168.1.x:500 or whatever the case is. Not sure why you'd want to print to your home/office printer while you're not there though.
25 comments
[ 1.9 ms ] story [ 69.7 ms ] threadSearch for on Google for the following (without quotes)
"inurl:hp/device/this.LCDispatcher?nav=hp.Print"
http://www.shodanhq.com/search?q=hp+laserjet
http://www.bebox.nu/bebooks/BeBookR5/The%20Kernel%20Kit/Syst...
Also on the subject of printers this talk from 28c3 is quite interesting: http://media.ccc.de/browse/congress/2011/28c3-4871-en-hackin...
http://kovaya.com/perl/show.cgi?program=hpsetdisp.pl
From the article:
>>"HP LaserJet printers have a hardware element called a 'thermal breaker' that is designed to prevent the fuser from overheating or causing a fire. It cannot be overcome by a firmware change or this proposed vulnerability."
I wouldn't be so sure about that last part, but I do doubt that the things can be made to cause adjacent objects to catch fire (unless maybe someone stores their gasoline in open containers near the printer).
(Although I would also do a lot of other things differently, so that may not be a strong point.)
The talk clearly mentions that if you can put malware into a printer wouldn't you use it to pawn a network instead of just setting it on fire - also it isn't possible to set it on fire - they just made that up.
For the most part, if it's on your "internal" network and isn't accessible from hosts on the Internet, you're safe (except from "insiders").