Wendy is not an alarmist sort of person, and she has me scared. In Printers on Fire, she tells the tale of Columbia computer science professor Sal Stolfo and PhD student Ang Cui, who have figured out how to hack routers and set printers on fire by printing a suitably doctored c.v.
There’s an employment-related joke in there somewhere, I’m sure, but I’m still stuck on this part:
“In every LAN there are enormous numbers of embedded systems in every machine that can be penetrated for various purposes,” says Cui.
…
“We turned off the motor and turned up the fuser to maximum.” Result: browned paper and…smoke.
How? By embedding a firmware update in an apparently innocuous print job. This approach is familiar: embedding programs where they’re not expected is a vector for viruses in Word and PDFs.
“We can actually modify the firmware of the printer as part of a legitimate document. It renders correctly, and at the end of the job there’s a firmware update.”
Moral of the story: print more at work?
Moral of the story: Equipment designers should stop programming their equipment to look for firmware updates in print files.
I mean, seriously, you send something to a printer to print, why should ANYTHING in it be capable of altering the printer’s firmware? What are we looking at here, a back door installed by the printer manufacturer?
More importantly, Windows users need to wake up to the fact that software manufacturers, under the guise of making Windows programs fun and easy to use for people who won’t or can’t learn anything about computers, have created and maintained gaping holes in computer security whereby the software programmers can write software which they can confidently send to Windows machines and run without ever being known or authorized by the owners of those machines. Windows users LOVE this because it makes computing fun for people who don’t know an executable from a directory, and couldn’t care less about learning the difference.
Of course this ALSO makes it infinitely simple for some two bit hack to write a program and get you to unknowingly run it on your machine doing God-knows-what. Hence, the nearly inexhaustible supply of zombie computers for those nefarious netizens who need them.
Despite claims, it’s not about market share, it’s about file and execution permissions. But since people will already point and click on absolutely anything in email from absolutely anyone with no consideration that there IS such a thing as permissions, you can’t really get them to understand the danger rationally. Windows has this problem because of Windows and Windows users, not market share.
This really isn’t a Windows problem. It’s a reflection of the fact that in all networks the printer (and router, and other devices) must be trusted by all the computers attached to it so it can do its job.
It’s also not that the printer would be looking for a firmware update. It’s that printers have interpreters to deal with things like PostScript, and that’s where the possibility of injecting malware is. AIUI.
wg