I just picked up a used HP Envy 5530 multifunction printer for $3 at a junk shop. The printer appears to be working and I would like to give it to my parents who need a new printer.
That said, I am concerned that the printer may pose a security risk based on articles I have read that show how badly secured and potentially compromised many IoT devices are.
I have no specific reason to believe that this printer is infected with malware, I am just concerned that it may be based on my very limited understanding of computer security and what I read in the tech news.
What I know about the printer (this is based on connecting to it directly - i.e. I turned on its wifi direct feature and connected to it via wifi from an old macbook that is running chrome OS - which I can wipe clean after this session):
- It runs a web server that is used to control its more advanced functions.
- There is no password set by default on access to this server.
Running a port scan on its IP address (192.168.223.1) gives me the following open ports:
80 (http) 443 (http over ssl) 8080 (http proxy)
It is already running the latest version of the firmware from HP
- By default it includes AirPrint, HP Wireless Direct (which I am using to connect to it at the moment), and has the Internet Printing Protocol enabled.
- It also includes the ability to install "apps" from the HP store, but this functionality does not appear to have been enabled when I bought it.
- I can look at the logs that the printer keeps and see that it was used (at least as far as these logs indicated) for a grand total of 45 pages.
Searching this forum came up with some results that are interesting, but the bit I am not clear on is the "connected directly to the internet" part.
This post: Attacking an office printer? discusses how vulnerable printers are (and, in fact this printer follows the bad practice of not having even a default password). But presumably (though I have no proof of this) this machine was always connected to the internet via a consumer grade firewall. Does that mean it is protected (to the extent that the consumer grade firewall actually works)? What about the Internet Printing Protocol? The blurb on that page seems to indicate that that means one can print from anywhere on the internet. How does this device expose itself to the internet such that that is possible (especially if it is behind a router using NAT)?
Should I risk plugging it into my local network? Would you?