Security News Faxploit – Critical flaws potentially exposes millions of HP OfficeJet Printers to hack

[silversurfer]

Content source

https://securityaffairs.co/wordpress/75323/hacking/officejet-inkjet-printer.html

A critical vulnerability potentially exposes millions of HP OfficeJet printers to hack, according to the experts at Check Point the attackers only need to send a fax to the vulnerable printers.

The researchers discovered two critical vulnerabilities in HP’s implementation of a widely used fax protocol implemented in all its OfficeJet all-in-one inkjet printers.

The vulnerabilities affect the HP all-in-one printers that support Group 3 (G3) fax protocols that are part of the ITU T.30 standard for sending and receiving color faxes.

OfficeJet HP flawCheckpoint experts reported the flaws to HP and shared details for the two vulnerabilities at the DEF CON conference.

The researchers devised an attack technique dubbed Faxploit, they demonstrated that once the attackers have compromised a fax machine they could leverage the NSA exploit EternalBlue for lateral movements.

“The below diagram shows the Faxploit attack flow, following which a threat actor could then move laterally across your network to access your organization’s most confidential information.” reads the blog post published by CheckPoint Security.

 

[In2an3_PpG]

From Check Points Blog: Faxploit: Breaking the Unthinkable | Check Point Blog

This alarming research was carried out on HP fax machines, however the same fax communication protocols are used by other fax machine vendors and our team of analysts has every reason to believe the same exploit can be applied to fax machines of other vendors. Our research team worked closely with HP to collaborate on providing a patch, which has already been rolled out as an automatic update to the majority of their customers. Other fax and all-in-one printer-fax manufacturers, however, may still be exposed.

While this research focused on all-in-one printer fax machines, the same communication protocols apply to all fax machines from all vendors, and the same vulnerabilities likely lie in these devices too. In addition, as popular online fax services, such as fax2email, are using the same protocol the same vulnerability may well also apply there too.

 

[soccer97]

Here is a link to the official security bulletin from HP: HPSBHF03589 rev. 4 - HP Ink Printers Remote Code Execution | HP® Customer Support .

There is a link in the article on how to update your printer's firmware. You can also sign up for alerts when there is a software update available for your product.