HP: Printer hack, fire stories are overblown

HP: Printer hack, fire stories are overblown

Summary: HP called reports about printer hacks that could lead to fires "sensational and inaccurate."

SHARE:

Hewlett-Packard moved to clarify reports of a potential printer hack that could lead to a fire.

Earlier Tuesday, reports surfaced about how Web-enabled LaserJet printers could be hacked and set up so they could catch on fire. MSNBC reported on research from Columbia University professor Salvatore Stolfo.

According to MSNBC:

Printers can be remotely controlled by computer criminals over the Internet, with the potential to steal personal information, attack otherwise secure networks and even cause physical damage, the researchers argue in a vulnerability warning first reported by msnbc.com. They say there's no easy fix for the flaw they’ve identified in some Hewlett-Packard LaserJet printer lines – and perhaps on other firms’ printers, too – and there's no way to tell if hackers have already exploited it.

The researchers, who have working quietly for months in an electronics lab under a series of government and industry grants, described the flaw in a private briefing for federal agencies two weeks ago. They told Hewlett-Packard about it last week.

Naturally, this story took off.

HP said in a statement:

Today there has been sensational and inaccurate reporting regarding a potential security vulnerability with some HP LaserJet printers. No customer has reported unauthorized access. Speculation regarding potential for devices to catch fire due to a firmware change is false.

HP LaserJet printers have a hardware element called a “thermal breaker” that is designed to prevent the fuser from overheating or causing a fire. It cannot be overcome by a firmware change or this proposed vulnerability.

While HP has identified a potential security vulnerability with some HP LaserJet printers, no customer has reported unauthorized access. The specific vulnerability exists for some HP LaserJet devices if placed on a public internet without a firewall. In a private network, some printers may be vulnerable if a malicious effort is made to modify the firmware of the device by a trusted party on the network. In some Linux or Mac environments, it may be possible for a specially formatted corrupt print job to trigger a firmware upgrade.

HP said it will deliver a firmware upgrade to plug the flaw. In the meantime, put your printer behind a firewall and disable remote firmware uploads on printers.

Topics: Software, Hardware, Hewlett-Packard, Printers

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

3 comments
Log in or register to join the discussion
  • Ready, Aim, FIRE!

    [i]"In some Linux or Mac environments, it may be possible for a specially formatted corrupt print job to trigger a firmware upgrade."[/i] Everyone knows this is wrong, because it is Windows that is a problem, not Linux or Mac . . . OK, just kidding, but I can't remember the last time that Windows wasn't on the top of the list for having a vulnerability. And it is mind-boggling to see how the regular media has been going hysterical over this.
    LadyGray
    • RE: HP: Printer hack, fire stories are overblown

      @LadyGray : I see where your allegiance lies. Windows may be a bit buggier but it makes apps like iTunes and Chrome browser make it buggier. Isn't it Apple that releases a 600MB+ update every 2 months - filled with fixes? Most web interfaces are Linux based. So if a printer is vulnerable, it's a Linux OS issue.
      Gisabun
  • Jeez

    If you are dumb enough to enable a printer on the Internet, maybe you should let the printer get hacked. I can think of very, very few reasons why you would want a printer visible on the Internet.
    Gisabun