Booby-trapped image data sent by fax can let malicious hackers sneak into corporate networks, security researchers have found. Since many companies use fax machines that are also printers and photocopiers, they often have a connection to the internal network. The malicious images exploit protocols established in the 1980s that define the format of fax messages. The research was presented at the Def Con hacker conference in Las Vegas.
The two researchers said millions of companies could be at risk because they currently did little to secure fax lines. “Fax has no security measures built in – absolutely nothing,” security researcher Yaniv Balmas, from Check Point software, said. He added that there were historical and legal reasons why the ageing technology was still so prevalent.
HP has now issued a patch for its printers, which will close the loopholes found by the pair. But, said Mr Balmas, because fax numbers were very widely shared, they could be an easy-to-find attack route for malicious hackers who targeted different machines. So far, there is no evidence that malicious hackers are using the booby-trapped images to penetrate otherwise well-defended networks.