We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,258 News Articles

Printers join fray in network vulnerability landscape

Printers are not the typical paths cybercriminals take into corporate networks. Nevertheless, the devices have become a concern among experts who see them as an ignored weakness in network defenses.

Andrew Howard, a U.K. mobile app developer, recently raised the issue of printer security by showing that a "quick, well-crafted Google search" could return 86,800 results for publicly accessible Hewlett-Packard printers.

"There are security concerns here, as many printer models have known exploits, which can be used as an entry point to a private network," Howard said in a blog post.Ã'Â

Earlier this month, Sebastian Guerrero, a researcher at viaForensics, found vulnerabilities in JetDirect that could be used to exploit HP printers. JetDirect technology is used to attach a printer to a local area network, so many people can access the device.

Guerrero said the vulnerabilities could enable someone to retrieve previously printed documents and to crash vulnerable printers.

HP advises customers to place printers behind a firewall and to provide network credentials only to trusted parties. "By following the HP recommended security features, printers should not be accessible to the public via the Internet," the company said in a statement.

[See also: HP bolsters security portfolio with proactive solutions]

Security flaws in printers have been reported before and experts have warned over the years that the devices pose a serious risk, because they are often overlooked.

Printers are not primary targets for hackers today, because of the success cybercriminals have had with attacking vulnerabilities in Web browsers, Microsoft Office or other software. In addition, the criminal underground online provides lots of tools for exploiting vulnerabilities in the PC.

"Criminals are just like water. They take the path of least resistance," said Andrew Hoog, chief investigative officer at viaForensics.

However, as corporations build better defenses to lock down these traditional pathways, printers could gain more attention, Hoog said. Because printer security is often ignored, the devices could by targeted more in stealth attacks conducted by people engaged in cyberespionage.

Steps corporations could take immediately to greatly boost printer security includes making sure the devices are not accessible through the Internet. In addition, companies need to check for firmware updates on a regular basis.

"These are two simple steps you can take that will mitigate most of your issues," Hoog said.

Read more about network security in CSOonline's Network Security section.

IDG UK Sites

OnePlus One release date, price, specs UK: No invite needed any longer

IDG UK Sites

15 analogue facts that today's kids won't understand: winding tapes, Ceefax and more

IDG UK Sites

da Vinci Junior 3D printer review

IDG UK Sites

WWDC 2015: What Apple will launch at WWDC 2015: Apple TV, Macs, more & how to get WWDC tickets