We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Flaw puts Xerox printers at risk

But researcher will not be sued

Xerox is scrambling to update a security patch following the disclosure of a major security flaw in its WorkCenter multifunction printers.

By taking advantage of a configuration error in the printers' web interface, security researcher Brendan O'Connor was able to run unauthorised software on the printers, compromise network traffic and access sensitive information being printed on the machines.

O'Connor shared details of how to compromise the printers during a presentation at the Black Hat USA conference in Las Vegas yesterday.

"Think of all the sensitive data that's going through these," he said. "Everybody prints and there's an inherent trust in these types of devices."

O'Connor said he was not trying to "pick on Xerox", but rather using his hack as a case study to draw attention to the security threat posed by increasingly powerful embedded devices.

"I don't think they're getting the level of scrutiny that they require," said O'Connor, who identified himself only as a security engineer with a US financial services company.

"This is a Linux server wrapped in a copier box. These things are all over the enterprise."

Xerox issued a patch for the vulnerability in February. It affects WorkCenter and WorkCenter Pro series 200 devices sold between October 2005 and June of this year, said Armon Rahgozar, a manager with Xerox's solutions and partnership technology office.

However, that Xerox patch does not fully address the vulnerabilities, O'Connor said. "My company is still vulnerable to these things," he said.

Rahgozar said Xerox was working to address the situation and would issue an updated patch.

Customers can either download the patch from the Xerox website or wait for service technicians to apply the patches at their next scheduled servicing.

Xerox is also developing an automatic update system for its products, similar to Microsoft's, Rahgozar said. "We probably want to follow the model that Microsoft has learned the hard way," he said. "You provide the push mechanism, but it's controlled by administrators at the site."

When Rahgozar showed up for O'Connor's Black Hat talk, the researcher said that he was worried that Xerox might be considering legal action against him in the same way that Cisco sued security researcher Michael Lynn at last year's conference. "When the guy said, 'I'm from Xerox,' I thought Mike Lynn," O'Connor said in an interview after his presentation.

Those concerns were unfounded, however. After the talk, Rahgozar thanked the researcher, saying he was doing the industry a service.

"So how much do you hate me?" O'Connor asked Rahgozar.

"Not at all," the Xerox manager replied.

IDG UK Sites

How to get a free EE Power Bar: Mobile and broadband customers eligible for free smartphone charger

IDG UK Sites

Why Netflix won't terminate your account for using a VPN, probably

IDG UK Sites

Forever 21 denies pirating Adobe, Autodesk and Corel software, accuses companies of 'bullying'

IDG UK Sites

New Apple TV 2015 release date rumours: Apple's WWDC invite shows Apple TV