Bridge Exploit of Network Multi-function Print/Fax Devices

Question

I performed a recent security audit and was wondering if anyone has heard or run across any known exploits against any commercial multi-function print/scan device whereby you can bridge the incoming fax line and network? These were all commercial grade equipment and I did some extensive google'ing on the topic, but I did not find anything. I had some vague notion in the back of my head that a printer tech one time told me that they used those fax lines for remote maintenance, and if so, I could imagine being able to exploit them and bridge the two...

Any thoughts?

Answer 1

Multi-function printers have reasonable computing power, and many are in fact linux devices, so it is theoretically possible that someone could use it to bridge into a network. It would make little sense to try it though:

1. Slow access: most faxing happens at 9600 baud, that's really slow. Even if you could negotiate faster the best you could realistically hope for is 64k, which is still very slow
2. Easily traceable: the internet allows for a huge amount of anonymity in attacks - an American hacker can attack a French company using a hacked Chinese computer and everyone will think it is state-sponsored espionage. However, dialing a phone line leaves a traceable record. Why would you take the risk?
3. Attacks cost money: it's unlikely someone is going to dial locally to attack a company, so long-distance or international phone charges will add up. If the attacker is a phreaker as well then he/she won't be paying, but someone will, and they may investigate
4. A printer suddenly accessing drive shares or scanning systems would stand out much more than a user laptop doing the same, it would be more likely to be noticed
5. Low re-usability of attack: if I come up with an attack that works on say one line of HP MFPs then it will only work against those machines, not against Xerox, Canon, or any other printer model. In fact, the attack may only work on one line of HP, or even one model range. That's a great deal of effort for something that would only work on one subset of machines
6. Easy to defeat: If I was worried about this all I'd need to do is put my printers in a network behind a firewall and prevent them from accessing anything. I'd also look at the phone records regularly
7. There are much more effective and easier ways to attack someone: targeted phishing attacks against companies using 0 day or only recently patched vulnerabilities is far less challenging and much simpler to do than trying to subvert a printer over a phone line

The only time I could see concern for this being worthwhile would be in an environment which has no internet access however they did have MFPs plugged into phone lines. Even then an attacker is more likely to use removable media as an infection vector.

Answer 2

I haven't run across any exploits for such interfaces, no.
When you write "incoming FAX lines", are these IP connected or classic E1s?

There has been some cases of people exploiting FAX software/machines before, but I don't believe those exploits have been made public (besides those windows software solutions..) In any case you'd need to figure out what protocol stacks are running on both sides.

http://grouper.ieee.org/groups/2600/email/msg00020.html
http://unixwiz.net/techtips/fax-server-security.html
http://1337day.com/exploit/16375 (Black Ice Fax Voice SDK v12.6 Remote Code Execution)