By Researchers from Columbia have found a security hole that affects millions of HP LaserJet printers as it gives hackers the possibility of installing dangerous firmware on the products. One way the researchers tested this possibility was by hacking a printer’ fuser, turning the paper brown and making smoke. It seems that the vulnerability is in plain sight and it implies the printer checking for updates whenever it accepts a printing job, but not checking the source of the update.
Because HP does not sign its updates digitally, the printers do not actually look for the company’s signature. This means that every time the printer accepts a printing job, a hacker can include a rogue update that will harm the device. Another interesting experiment conducted by researchers from Columbia included detecting when a tax paper was being printed, getting the Social Security number and send it to a Tweet feed. This just shows how critical this security vulnerability actually is. The possibilities of hacking HP LaserJet printers are limitless, with a hacker even building its own botnet out of printers.
However, this vulnerability should not surprise anyone. Every single product connected to the internet can be detected and searched for security holes that can be later hacked. The big problem is that usually, manufacturers try to skip different steps in order to get their product on the market as quickly as possible. Unfortunately, this means that they almost always miss some issues that can compromise their products and their reputation. It is not that getting the devices secure is a hard job, it’s just that no one bothers too until a researcher proves the product needs it.
HP has not commented on the situation. Interesting fact: HP has sold up to 100 million HP LaserJet printers until now and all of them have an Internet connection.