We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,258 News Articles

Printers join fray in network vulnerability landscape

Printers are not the typical paths cybercriminals take into corporate networks. Nevertheless, the devices have become a concern among experts who see them as an ignored weakness in network defenses.

Andrew Howard, a U.K. mobile app developer, recently raised the issue of printer security by showing that a "quick, well-crafted Google search" could return 86,800 results for publicly accessible Hewlett-Packard printers.

"There are security concerns here, as many printer models have known exploits, which can be used as an entry point to a private network," Howard said in a blog post.Ã'Â

Earlier this month, Sebastian Guerrero, a researcher at viaForensics, found vulnerabilities in JetDirect that could be used to exploit HP printers. JetDirect technology is used to attach a printer to a local area network, so many people can access the device.

Guerrero said the vulnerabilities could enable someone to retrieve previously printed documents and to crash vulnerable printers.

HP advises customers to place printers behind a firewall and to provide network credentials only to trusted parties. "By following the HP recommended security features, printers should not be accessible to the public via the Internet," the company said in a statement.

[See also: HP bolsters security portfolio with proactive solutions]

Security flaws in printers have been reported before and experts have warned over the years that the devices pose a serious risk, because they are often overlooked.

Printers are not primary targets for hackers today, because of the success cybercriminals have had with attacking vulnerabilities in Web browsers, Microsoft Office or other software. In addition, the criminal underground online provides lots of tools for exploiting vulnerabilities in the PC.

"Criminals are just like water. They take the path of least resistance," said Andrew Hoog, chief investigative officer at viaForensics.

However, as corporations build better defenses to lock down these traditional pathways, printers could gain more attention, Hoog said. Because printer security is often ignored, the devices could by targeted more in stealth attacks conducted by people engaged in cyberespionage.

Steps corporations could take immediately to greatly boost printer security includes making sure the devices are not accessible through the Internet. In addition, companies need to check for firmware updates on a regular basis.

"These are two simple steps you can take that will mitigate most of your issues," Hoog said.

Read more about network security in CSOonline's Network Security section.


IDG UK Sites

Very best Black Friday 2014 tech deals UK: Latest bargains on phones, tablets, laptops and more...

IDG UK Sites

Black Friday feeding frenzy infects the UK

IDG UK Sites

VAT MOSS: Will I be affected by the EU VAT changes? Here are the facts for designers and artists

IDG UK Sites

Black Friday 2014 UK: Apple deals, Amazon deals & Black Friday tech offers