A significant security vulnerability has been found in office fax machines that enables would-be attackers to gain access to the rest of a company network.
Discovered by Check Point, the flaw allows attackers to gain access to any network connected to a fax machine with just a fax number. This means it could be used to attack both home and enterprise networks.
Go deeper with GlobalData
The research itself was carried out on HP Officejet all-in-one printer fax machines, however the flaw lies in the fax protocol itself and not the specific machine, meaning any almost fax machine from any manufacturer at risk. HP has issued a patch for its own product line.
“These vulnerabilities allow an attacker with mere access to a phone line, and a fax number to attack its victim’s all-in-one printer – allowing him full control over the all-in-one printer and possibly the entire network it is connected to,” explained Check Point of the research.
“We conducted our research on all-in-one fax printers; however similar vulnerabilities are likely to be found in other fax implementations, such as fax-to-mail services, standalone fax machines, etc.”
Office fax machines pose a threat to corporate networks
The research highlights how a generally unregarded piece of technology poses a potentially significant threat to a network.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalData“This vulnerability is an excellent example of the porousness of the perimeter, and the need to enforce the principle of least privilege to all network services,” said Jason Garbis, VP of Cyxtera, of the research.
“When you have a fax machine – which literally can be accessed by nearly every person on the planet – connected to your internal network, it’s imperative to recognise this as part of the attack surface, and as a potential launching point for lateral movement.
“As this latest security research shows, the digitisation of faxes allows attackers to take an analog signal, and pivot that into a digital attack.”
Once an attacker has got control of the machine in question, according to Check Point, “anything is possible”.
“It could be used to infiltrate an organisation’s or consumer’s internal network, steal printed documents, mine Bitcoin, or practically anything,” the company wrote.
Who still uses office fax machines?
Despite fax machines having a reputation as outdated technology, they are still in widespread use in certain industries.
Industries that are heavily regulated, such as healthcare and finance, still use fax machines to send some documents to comply with government regulations. Government departments themselves also use fax for many applications, as does the manufacturing industry
Incredibly the use of fax has actually increased in recent years, with a survey conducted in 2017 by IDC finding that use grew 9% in total between 2016 and 2017, fuelled in part by 16% growth in manufacturing.
Check Point estimates that there are several hundred million fax machines still in use throughout the world.
How can companies protect themselves from attack via fax?
For companies still using office fax machines, the advice is to treat them as insecure and keep them partitioned away from the rest of the network.
“Security teams need to treat devices such as fax machines as untrusted, and to restrict the network access. Organisations should place these devices onto isolated network segments, and only permit controlled network connections to the device,” said Garbis.
“These devices should not be granted broad network access or be permitted to initiate connections across the network. Since these devices may be used by many people as part of their job, any solution cannot impede business productivity.
“In addition to monitoring incoming faxes for unexpected content, security teams should monitor these multi-function fax machines for any anomalous behaviour. In general, they should only be receiving inbound connections and not initiating connections across the corporate network.”
