Office Printers
Is Your MFP Leaking?
By Daniel Katz-Braunschweig
Aug 15, 2008, 08:30

IS YOUR MFP LEAKING?

In recent years, the network-attached multifunction printer has become an increasingly popular choice. A separate fax, printer, copier, and scanner have an average footprint that is four times the normal MFP. Put all those features into one box, and you have a powerful primary input/output device. However, when you have all those features in one box you make it easier for someone to take the information out of the box.

If your business is like most small businesses, you have one or two IT people on staff or possibly just an outside support person. On a staff such as this, the average IT person is pri-marily concerned with keeping the network and computers running and making sure needed upgrades are done. This person doesn't have time to consider the security ramifications of installing a new printer on the network. In fact, most IT people don't realize that the printer could be leaking some information already. They don't understand that these devices are actually computers with built-in operating systems and that they can be attacked in the same way as your servers and workstations.

"So what," you say? Aside from the fact that billions of dollars are lost each year to theft of information, you may be legally required to protect your customer's data.

What is a common attack? Here's the easiest of all attacks: In most offices, the printer isn't right next to the user. Rather, it's down the hall next to the watercooler. So, we sit at our desks and hit the print button, take that long walk down the corridor, and pick up our one-page document from the printer. If the document isn't there when we arrive, we assume the network "ate" the document and we reprint it. However, what really happened was that someone waiting at the watercooler saw a very interesting document come out and decided to "borrow" it.

In the old world of the copier, the page was printed directly from a scanned page. Newer MFPs scan the entire document onto the hard drive and print the scanned document. So, when you load your document and hit the copy button, you might as well be hitting the "scan and print" button. What happens next depends on the copier. Some will do nothing, some will delete the file, and some will overwrite the file with garbage multiple times. For our purposes, "delete" means that the data is still on the hard drive, but the record that indicates where to find it has been deleted. Remember, the data can still be easily found. If your copier is doing anything other than overwriting with garbage, all an attacker would need to do is grab the hard drive out of the copier and plug it into a computer.

Now for something a little more complex, but still not outside the realm of possibility: Imagine a disgruntled employee who wants to see the latest payroll reports. He knows the address of the MFP (most people write it on a sticker on the side of the machine). He opens the Web page of the MFP, which is secured with the manufacturer's default password-typically "password."  He changes just one item: the SMTP server, which is the server that handles e-mail.  Normally, this value is set to a server on your network, but it can be changed easily to any server.

When a user invokes the scan-to- e-mail feature of your MFP, in order to send a copy of the document, the MFP sends the e-mail message to the SMTP server for delivery. If this value is changed, the MFP will send the document to an SMTP server on the Internet, which can send the message on to its destination and also send a copy to the hacker. This is very difficult to detect because the user to whom the message is addressed will still receive the message.

So, how do we protect our MFPs? With security, there's no one easy answer. Your MFP can probably be locked down in a few easy steps, but it's best to speak with your dealer or a security specialist. The first and easiest step to protecting the MFP is to prevent unwanted hosts from communicating with it. I usually start talking with customers by asking, "Who prints to the printer/MFP?" The common answer is "Everyone in the office," but that's not true. With most networks today, users print to a queue on a server, and the server then sends the document to the printer. So, the only machine which ever needs to talk to the printer is the queue server.

Newer MFPs and printers have features such as firewalls that can prevent communications from machines other than the server, but these features are often not used. Some companies take it a step further with inexpensive software solutions that protect the hardware on many levels.

With the increase in identity theft and the amount of corporate data stolen on a regular basis, everyone needs to be concerned with document security.

Dan Katz-Braunschweig is the president of DataIXL in Brooklyn, N.Y., an organization that provides consultation to various industry markets to identify security risks and develop compliant solutions.