F-Secure discovers vulnerabilities affecting over 150 HP printer models
Helsinki, Finland.30 November 2021 – HP Inc. has issued patches that fix security vulnerabilities cyber security provider F-Secure discovered in over 150 of their multifunction printer (MFP) products. According to research published by F-Secure, attackers can exploit the vulnerabilities to seize control of vulnerable devices, steal information, and further infiltrate networks to inflict other types of damage.
F-Secure security consultants Timo Hirvonen and Alexander Bolshev discovered exposed physical access port vulnerabilities (CVE-2021-39237) and font parsing vulnerabilities (CVE-2021-39238) in HP’s MFP M725z part of HP’s FutureSmart line of printers. Security advisories published by HP list over 150 different products affected by the vulnerabilities.
The most effective method would involve tricking a user from a targeted organisation into visiting a malicious website, exposing the organisation’s vulnerable MFP to what’s known as a cross-site printing attack. The website would, automatically, remotely print a document containing a maliciously-crafted font on the vulnerable MFP, giving the attacker code execution rights on the device.
An attacker with these code execution rights could silently steal any information ran (or cached) through the MFP. This includes not only documents that are printed, scanned, or faxed, but also information like passwords and login credentials that connect the device to the rest of the network. Attackers could also use compromised MFPs as a beachhead to penetrate further into an organisation’s network in pursuit of other objectives (such as stealing or changing other data, spreading ransomware, etc.)
While the researchers determined that exploiting the vulnerabilities is difficult enough to prevent many low-skilled attackers from using them, experienced threat actors could make use of them in more targeted operations.
Furthermore, the researchers discovered the font parsing vulnerabilities are wormable, meaning attackers could create self-propagating malware that automatically compromises affected MFPs and then spreads to other vulnerable units on the same network.
“It’s easy to forget that modern MFPs are fully-functional computers that threat actors can compromise just like other workstations and endpoints. And just like other endpoints, attackers can leverage a compromised device to damage an organisation’s infrastructure and operations. Experienced threat actors see unsecured devices as opportunities, so organisations that don’t prioritise securing their MFPs like other endpoints leave themselves exposed to attacks like the ones documented in our research,” explains Hirvonen.
Advice for securing MFPs
Considering HP’s status as a provider of MFPs with an estimated 40% of the hardware peripheral market*, many companies throughout the globe are likely using vulnerable devices.
Hirvonen and Bolshev contacted HP last spring with their findings and worked with them to help patch the vulnerabilities. HP has now published firmware updates and security advisories for the affected devices.
While the attack’s difficulty makes it impractical for some threat actors, the researchers say that it’s important for organisations targeted by advanced attacks to secure their vulnerable MFPs.
In addition to patching, measures for securing MFPs include:
- Limiting physical access to MFPs.
- Segregating MFPs in a separate, firewalled VLAN.
- Using anti-tamper stickers to signal physical tampering with devices.
- Using locks (such as Kensington locks) to control access to internal hardware.
- Following vendors’ best practices for preventing unauthorised modifications to security settings.
- Placing MFPs in CCTV-monitored areas to record any physical usage of a hacked device at the time it was compromised.
“Large enterprises, companies working in critical sectors, and other organisations facing highly-skilled, well-resourced attackers need to take this seriously. There’s no need to panic, but they should assess their exposure, so they’re prepared for these attacks. Although the attack is advanced, it can be mitigated with the basics: network segmentation, patch management, and security hardening,” says, Hirvonen.
A detailed technical write-up of the research is available here.
Comment on this article below or via Twitter @IoTGN