Paper jams used to the biggest problem with printers. But now, high-tech home and office printers have become alluring targets for cybercriminals.
Researchers at this weekend’s ShmooCon 2011 convention in Washington, D.C., will demonstrate how Internet-connected printers that aren’t properly secured can be hijacked and used to gain unauthorized access to corporate networks they’re running on, according to an article in MIT’s Technology Review.
The hacking program is called “Praeda” (Latin for “plunder”) and works by exploiting common security flaws, such as default passwords left unchanged. Once inside the network, Praeda can be deployed to steal passwords and files, or take control of other devices connected to the same network.
Praeda was developed by Deral Heiland, an independent researcher who attempts to hack into computer networks to determine their weaknesses.
Heiland said that printers are ideal targets for cyberattacks because they are not typically secured as stringently as computers. Often, manufacturers don’t require owners to set a new password for their printers.
Once a printer is compromised, the rest of the network that feeds into it is on thin ice.
“These devices have gone from being standard, simple printers that got on the network to the point where they are totally integrated in the business environment. And that heavy integration is what makes them a premium target,” Heiland said.
In another demonstration of printer vulnerability, independent researcher Ben Smith will demonstrate Print File System — dubbed PrintFS — that uses the Internet to find vulnerable printers, and then coordinates them into one storage network, which can be used by hackers to store malware.
Security experts advise owners of Web-connected printers and any other devices containing Internet Protocol addresses to realize they are as vulnerable as computers, and to take action to secure them, including downloading security updates.