The fax as a means of communication has disappeared in much of the world, but there are still regions that consider it a very valuable resource, and the universe of bureaucracy refuses to let it go. The problem is that the fax exists as one more function of AIO printers... full of holes and vulnerabilities. That led the people at Check Point Research to develop Faxploit, an attack technique through which an entire network can be hacked by sending a fax loaded with malicious code to the printer.
It's hard to believe, but it is estimated that there are 300 million fax numbers in use. It's been about fifteen years since I sent my last fax. In that time I've seen more than one unit in the trash, keeping pace with the retirement of traditional telephone lines. However, there are procedures and legal processes that will force you to send one no matter how much you don't want to. Changes in personal information at banking institutions, requests to cancel certain services... if it's not a sheet of paper with a valid form and your signature, it doesn't count. The general role of the fax has been absorbed by all-in-one printers, which are usually connected simultaneously to a phone line and to the local network. That said, what are the chances of hacking the fax to get into that network?
The Faxploit Attack
According to Check Point Research, at least one. The description of their Faxploit technique dates back to August 2018, but that doesn't make it any less interesting. The first step is to obtain as much technical information as possible about the AIO printer (including a unit that serves as a 'sacrifice'), and apply a bit of reverse engineering to its firmware.
A notable discovery is that in some printers, the T.30 (session) and T.4 (compression) fax protocols allow the processing of the T.81 format, which we know much better as color JPEG images. The printer receives and stores the JPEG file without modifications, but there's something more: The manufacturer implemented its own JPEG processing system with several vulnerabilities, instead of adopting an alternative like libjpeg.
https://old.neoteo.com/impresora-parte-una-botnet-la-seguridad-las-impresoras-al-descubierto/For the rest of the attack they use the classic EternalBlue-DoublePulsar combo. In total, the payload performs three functions: Take control of the printer's LCD screen, check if the printer's network cable is connected, and if possible, activate EternalBlue-DoublePulsar to attack computers on the network and 'hijack' them.
I suppose this is where you want to know the printer model. Without too many surprises, it's an HP Officejet Pro 6830. Given its poor security practices and questionable software quality, the most likely thing is that there's something worse in the background. Yes, Faxploit is difficult to implement, but in the security world, one vulnerability is enough.
Official site: Click here
