Printers join fray in network vulnerability landscape

Printers are not the typical paths cybercriminals take into corporate networks. Nevertheless, the devices have become a concern among experts who see them as an ignored weakness in network defenses.

Andrew Howard, a U.K. mobile app developer, recently raised the issue of printer security by showing that a “quick, well-crafted Google search” could return 86,800 results for publicly accessible Hewlett-Packard printers.

“There are security concerns here, as many printer models have known exploits, which can be used as an entry point to a private network,” Howard said in a blog post. 

Earlier this month, Sebastian Guerrero, a researcher at viaForensics, found vulnerabilities in JetDirect that could be used to exploit HP printers. JetDirect technology is used to attach a printer to a local area network, so many people can access the device.

Guerrero said the vulnerabilities could enable someone to retrieve previously printed documents and to crash vulnerable printers.

HP advises customers to place printers behind a firewall and to provide network credentials only to trusted parties. “By following the HP recommended security features, printers should not be accessible to the public via the Internet,” the company said in a statement.

[See also: HP bolsters security portfolio with proactive solutions]

Security flaws in printers have been reported before and experts have warned over the years that the devices pose a serious risk, because they are often overlooked.

Printers are not primary targets for hackers today, because of the success cybercriminals have had with attacking vulnerabilities in Web browsers, Microsoft Office or other software. In addition, the criminal underground online provides lots of tools for exploiting vulnerabilities in the PC.

“Criminals are just like water. They take the path of least resistance,” said Andrew Hoog, chief investigative officer at viaForensics.

However, as corporations build better defenses to lock down these traditional pathways, printers could gain more attention, Hoog said. Because printer security is often ignored, the devices could by targeted more in stealth attacks conducted by people engaged in cyberespionage.

Steps corporations could take immediately to greatly boost printer security includes making sure the devices are not accessible through the Internet. In addition, companies need to check for firmware updates on a regular basis.

“These are two simple steps you can take that will mitigate most of your issues,” Hoog said.