Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 6 down vote favorite

I have an EPSON PROJECTOR (model EB-824H) And I would like to use it in our company. As I know (but not sure) this kind of projector has no WIFI,no network card and there is no HD in this PROJECTOR It also has 2 USB (one to PC) What security threats or risks can arise from connecting this kind of projector to a network PC via USB? Can someone upload malware to this projector ( maybe something that writes to the ROM, or crossing into the network...)?

share|improve this question

1 Answer

up vote 5 down vote

The only security threat with this product is someone stealing it. Without a network it has no remote attack surface. Without long term storage there is really nothing to hack.

It does have a password, but who cares? Probably one of the least useful password protected resources I have heard of. It has USB host, and so you might be able to corrupt memory with a specially crafted usb device or video files, but again this is attack is worthless because no one cares. This is not a strategic resource.

share|improve this answer
1  
Would it not be possible to distribute malware via corrupting the device's memory? Or have some form of network-crossover through the device, by connecting two computers to the USB (one in the network, and one untrusted)? – AviD♦ Mar 5 '12 at 8:14
3  
@Ramhound the concern I was referring to is not the device spreading the malware itself, of course, but rather as a no-longer-secure device that networked laptops will get connected to. In other words, let's say (for the sake of argument) that I succeeded in infecting the projector; next time someone connects their secure laptop, that too will become infected, and therefore no longer secure; however it is already inside the network, and thus become a launching point for malware distribution. – AviD♦ Mar 6 '12 at 19:27
1  
@Ramhound Malware can be spread via other mechanisms than the network. I'd say that a purely theoretical risk would be someone overwriting the embedded operating system that the device must have (it's able to read PC formatted USB keys) (likely it's embedded linux of one kind or another) and then configuring it to download malware on subsequently connected usb disks. TBH that's extremely unlikely in reality as taking the effort to carry out the hack would most likely vastly outweigh the potential gain, but I don't see immediately why it's not possible – Rory McCune Mar 8 '12 at 8:55
1  
@Ramhound That depends, I'd say. A large number of embedded devices are flashable to provide for upgrade and patches to the firmware. Any device that can be flash upgraded would theoretically be able to have malicious software placed on it (an example would be the HP printer issues from a while back). – Rory McCune Mar 8 '12 at 13:34
2  
@Rook absolutely the threat profile for someone to go to that kind of effort is completely different than a casual attacker. I could only see it being a realistic threat in a very high security environment where there were very limited ways to attack the target. – Rory McCune Mar 8 '12 at 14:41
show 8 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.