Hewlett-Packard offers fix for printers susceptible to remote hacks

Dec 26, 2011 By Jeremy C. Owens

Hewlett-Packard released a firmware update Friday that it says will fix a susceptibility in some of the Palo Alto, Calif., company's popular LaserJet printers that researchers said could allow hackers to remotely take control of the devices.

Last month, MSNBC reported a team of researchers from Columbia University discovered that some Hewlett-Packard LaserJet printers, and possibly similar devices, did not verify software upgrades contained within so-called remote updates. The researchers were able to offer firmware updates that included and then take control of the printer.

Once the researchers were able to take control of printers, they were able to accomplish a host of potentially dangerous tasks. They said they could print a tax return while sending a copy to a hacker's , compromising a host of personal information; easily disable printers; and even command a printer to continuously heat up its ink-drying component until it started to set on fire.

Hewlett-Packard issued a statement after the report was released vehemently denying that printers could be commanded to burst into and saying "no customer has reported unauthorized access," but the company did admit there was a flaw.

"HP has identified a potential security vulnerability with some HP LaserJet printers ... if placed on a public Internet without a firewall. In a private network, some printers may be vulnerable if a malicious effort is made to modify the firmware of the device by a trusted party on the network," the statement read.

On Friday, HP issued a news release reiterating that no customers have reported unauthorized access to their LaserJet printers, and offered a firmware update that the company says will "mitigate this issue." The update is available at www.hp.com/support, in the "Drivers" category.

Researchers warned that if a hacker had gained control of a printer in this manner, however, there would be no way to reverse the process.

"If and when HP rolls out a fix, if a is already compromised, the fix would be completely ineffective. Once you own the firmware, you own it forever. That's why this problem is so serious, and so different," researcher Ang Cui said. "This is nothing like fixing a virus on your PC."

Hewlett-Packard recommends placing printers behind a firewall to protect exposure to remote hacks and disabling remote firmware upload capabilities on exposed printers.

Explore further: Tomorrow's tablets? Look, no hands

3 /5 (3 votes)
add to favorites email to friend print save as pdf

Related Stories

HP Launches New Enterprise Printers

Apr 12, 2007

The company adds to its printing portfolio with two new ink-based color multifunction printers, updated management tools and a universal print driver.

HP Expands with New Deskjet Printer Line

Apr 19, 2007

Hewlett-Packard will be adding on to its printing portfolio with three new deskjet printers designed for home and small and midsize business users.

Federal agency backs HP inkjet patent complaint

Jun 11, 2011

Hewlett-Packard said Friday that a US federal agency has backed its claim that rival MicroJet Technology Co. was infringing on patents for lucrative inkjet printer cartridges.

Recommended for you

Tomorrow's tablets? Look, no hands

Oct 24, 2014

Engineers in a suburban Chicago office complex have designed a new microphone that they say will be key to the future of smartphone and tablet technology because it gives consumers the ability to operate hand-held devices ...

Apple computer sells for record $905K in NY

Oct 23, 2014

One of the first Apple computers ever built has sold in New York for $905,000, leading Bonhams auction house to declare it the world's most expensive computer relic.

Review: Better cameras, less glare in iPad Air 2

Oct 22, 2014

If I've seen you taking photos with a tablet computer, I've probably made fun of you (though maybe not to your face, depending on how big you are). I'm old school: I much prefer looking through the viewfinder ...

Samsung phones cleared for US government use

Oct 21, 2014

Samsung Electronics Co. said Tuesday some of its Galaxy mobile devices were approved by the National Security Agency for use with classified U.S. government networks and data, a boost to the company's efforts to expand in ...

User comments : 0