From SentinelLabs, a critical vulnerability in HP printer drivers:
Researchers have released technical details on a high-severity privilege-escalation flaw in HP printer drivers (also used by Samsung and Xerox), which impacts hundreds of millions of Windows machines.
If exploited, cyberattackers could bypass security products; install programs; view, change, encrypt or delete data; or create new accounts with more extensive user rights.
The bug (CVE-2021-3438) has lurked in systems for 16 years, researchers at SentinelOne said, but was only uncovered this year. It carries an 8.8 out of 10 rating on the CVSS scale, making it high-severity.
Look for your printer here, and download the patch if there is one.
EDITED TO ADD (8/13): Here’s a better list of affected HP and Samsung printers.
Posted on July 22, 2021 at 10:41 AM •
It’s a lot more chemistry than I understand:
Invisible inks based on “smart” fluorescent materials have been shining brightly (if only you could see them) in the data-encryption/decryption arena lately…. But some of the materials are costly or difficult to prepare, and many of these inks remain somewhat visible when illuminated with ambient or ultraviolet light. Liang Li and coworkers at Shanghai Jiao Tong University may have come up with a way to get around those problems. The team prepared a colorless solution of an inexpensive lead-based metal-organic framework (MOF) compound and used it in an ink-jet printer to create completely invisible patterns on paper. Then they exposed the paper to a methylammonium bromide decryption solution…revealing the pattern…. They rendered the pattern invisible again by briefly treating the paper with a polar solvent….
Posted on November 10, 2017 at 6:06 AM •
“We used silver and carbon ink to print an image consisting of small rods that are about a millimeter long and a couple of hundred microns wide,” said Ajay Nahata from the University of Utah, leader of the research team. “We found that changing the fraction of silver and carbon in each rod changes the conductivity in each rod just slightly, but visually, you can’t see this modification. Passing terahertz radiation at the correct frequency and polarization through the array allows extraction of information encoded into the conductivity.”
Posted on December 13, 2016 at 6:21 AM •
Julian Oliver has designed and built a cellular eavesdropping device that’s disguised as an old HP printer.
Masquerading as a regular cellular service provider, Stealth Cell Tower surreptitiously catches phones and sends them SMSs written to appear they are from someone that knows the recipient. It does this without needing to know any phone numbers.
With each response to these messages, a transcript is printed revealing the captured message sent, alongside the victim’s unique IMSI number and other identifying information. Every now and again the printer also randomly calls phones in the environment and on answering, Stevie Wonder’s 1984 classic hit I Just Called To Say I Love You is heard.
Okay, so it’s more of a conceptual art piece than an actual piece of eavesdropping equipment, but it still makes the point.
News article. BoingBoing post.
Posted on November 14, 2016 at 1:12 PM •
Interesting paper: Maya Embar, Louis M. McHough IV, and William R. Wesselman, “Printer watermark obfuscation,” Proceeding
RIIT ’14: Proceedings of the 3rd annual conference on Research in information technology:
Abstract: Most color laser printers manufactured and sold today add “invisible” information to make it easier to determine when a particular document was printed and exactly which printer was used. Some manufacturers have acknowledged the existence of the tracking information in their documentation while others have not. None of them have explained exactly how it works or the scope of the information that is conveyed. There are no laws or regulations that require printer companies to track printer users this way, and none that prevent them from ceasing this practice or providing customers a means to opt out of being tracked. The tracking information is coded by patterns of yellow dots that the printers add to every page they print. The details of the patterns vary by manufacturer and printer model.
EDITED TO ADD (11/14): List of printers and whether or not they display tracking dots (may not be up to date).
Posted on October 24, 2014 at 8:36 AM •
Last week, Adi Shamir gave a presentation at Black Hat Europe on using all-in-one printers to control computers on the other side of air gaps. There’s no paper yet, but two publications reported on the talk:
Theoretically, if a malicious program is installed on an air-gapped computer by an unsuspecting user via, say, a USB thumb drive, attackers should have a hard time controlling the malicious program or stealing data through it because there is no Internet connection.
But the researchers found that if a multifunction printer is attached to such a computer, attackers could issue commands to a malicious program running on it by flashing visible or infrared light at the scanner lid when open.
The researchers observed that if a source of light is pointed repeatedly at the white coating on the inside of the scanner’s lid during a scanning operation, the resulting image will have a series of white lines on darker background. Those lines correspond to the pulses of light hitting the lid and their thickness depends on the duration of the pulses, Shamir explained.
Using this observation the researchers developed Morse code that can be used to send pulses of light at different intervals and interpret the resulting lines as binary data1s and 0s. Malware running on an air-gapped system could be programmed to initiate a scanning operation at a certain time — for example, during the night — and then interpret the commands sent by attackers using the technique from far away.
Shamir estimated that several hundred bits of data can be sent during a single scan. That’s enough to send small commands that can activate various functionality built into the malware.
This technique can be used to send commands into an air-gapped computer network, and to exfiltrate data from that network.
Posted on October 22, 2014 at 2:17 PM •
It’s a serious vulnerability. Note that this is the research that was mistakenly reported as allowing hackers to set your printer on fire.
Here’s a list of all the printers affected.
Posted on January 6, 2012 at 1:50 PM •
It’s the kind of research result that screams hype, but online attacks that have physical-world consequences are fundamentally a different sort of threat. I suspect we’ll learn more about what’s actually possible in the coming weeks.
HP has issued a rebuttal.
Posted on December 2, 2011 at 1:17 PM •
This is cool technology from HP:
Each printer with the ePrint capability will be assigned its own e-mail address. If someone wants to print a document from an iPhone, the document will go to HP’s data center, where it is rendered into the correct format, and then sent to the person’s printer. The process takes about 25 seconds.
Maybe this feature was designed with robust security, but I’m not betting on it. The first people to hack the system will certainly be spammers. (For years I’ve gotten more spam on my fax machine than legitimate faxes.) And why would HP fix the spam problem when it will just enable them to sell overpriced ink cartridges faster?
Any other illegitimate uses for this technology?
EDITED TO ADD (7/13): Location-sensitive advertising to your printer.
Posted on June 18, 2010 at 1:37 PM •
I’ve already written about secret forensic codes embedded in color laser printers. Seems like these codes may breach European privacy laws.
Posted on February 25, 2008 at 5:50 AM •
Sidebar photo of Bruce Schneier by Joe MacInnis.