So your copier gets hacked !

Bing Chat AI says when asked what information can a hacker get from your network printer,

Network-enabled printers can contain sensitive information about your internal network. They are often integrated with business systems, unified with email systems, and given Local Area Network (LAN) authentication.

With all these important connections throughout the network, an unsecure printer setup could lead to serious exposure of sensitive data or password harvesting .

Hackers can use network scanning tools to search for security gaps in your network, especially in your copiers and printers. When a hacker scans your network, they look for open ports. Open ports can let them access the hard drive of the copier and view all documents in the hard drive . A successful attack could allow an attacker to siphon off the printer’s memory to access print jobs of potentially sensitive files, like contracts, corporate information, or patient.

To prevent such attacks, it is recommended to secure your printer by changing the default access password to the administration page, disabling unnecessary services, and keeping the firmware up-to-date

Copiers and printers are passive devices but they have access to a lot of information.

Going over the points listed:

The address book is the key area of interest. You'll have potentially both server paths and email addresses to better focus your navigation around the network. Phishing or impersonation becomes a potential threat as an attacker could attempt to impersonate a user or customer with contact information in the device to pull more information out of the business. Even with passwords not in cleartext on the device, it's possible to get the service account for SMB scanning or SMTP credentials to limit the accounts to try and brute force them, or obtain them by other means.

Gateway and subnet information isn't particularly useful: if you're already in the network you have that information.

SMTP client could be of value if it's an internal one that doesn't require authentication: it would then be easy to impersonate an existing email and attempt to send malicious attachments or other files by use of the same server.

The web interface is also a big issue in general: devices last much longer than security protocols. As an example, I still support some older devices that support the old, and VERY weak, export ciphers. Those are trivial to crack and can't be disabled on some of them.

For dealers, ideally there should be two admin accounts: one known by the dealer, one for onsite IT staff. During the setup of the machine, the onsite password would be created by the IT staff and known only to them. From there, the paperwork will then waive the dealer's responsibility once the device is added to the network.


Most of my larger clients have gone the route of segmenting their printers into a separate VLAN so that they know what a device is just by its IP range. The only devices that can reach them are the printer servers over ports 9100 or 515 (RAW/LPD) inbound, and outbound allowing 445 (SMB over DNS) to any scan destination, and whatever port the email server uses. The web interface then also only gets allowed from either the print server or from a dedicated management machine (PAW or Privileged Access Workstation).

For smaller clients in a flat network environment, the web interfaces are locked by a password and only available over HTTPS. If they have an internal CA server the certificate for the machine is generated from that to remove the self signed issues, if not they roll with it and just create an exception in their browser. Also all old protocols or services they don't use get disabled (Think AppleTalk, WINS, LLMR, FTP, WSD, etc).

As long as there is a clear delineation of who is responsible for what role in the security of the device there shouldn't be anything that comes back to bit the dealer. However, we've even seen here multiple instance of techs turning SMB1 or FTP on machines to get them working in customer environments, often potentially without the knowledge of their IT. In instances like that there's a good chance that the dealer could be held liable. Anything that goes against my regular config for a client has to be signed off on as a waiver.

Of course, there are also clients who have their networks incorrectly configured so that their devices are exposed to the public internet. A simple Google search for the name of the web interface for a manufacturer will likely bring up several hits. Example: a search for Web Image Monitor in Google brings up at least three machines exposed to the internet. There's no helping that...

Just keeping it real based on being the guy setting machines up on customer's networks going back to the earliest networked MFPs in the 90s.  Truth is the MFP is the least of most customer's vulnerabilities.  Most customers in the small and medium sized business space have little if any network security.  Never mind the wide open shred bins that could be a gold mine of info.  I see so many businesses who set their own networks up or have a friend or family member do it for them on the cheap.  Crazy.

It's my opinion that device manufacturers need to be more responsible with their technologies and not just rely on service providers to follow "best practices". It's simple human nature for people not to read instructions and will often take the path of least resistance. Therefore, the machines have to be secure by DEFAULT and not by configuration.

As it relates to a few simple items, devices MUST have dynamic passwords, multifactor authentication with geofencing, secure erase policies enforceable by the administrator, zero knowledge networking, and sealed channel communication, at the bare minimum.

While all these things might seem overwhelming, complicated, or expensive, that's not the case so there is no excuse for the manufacturers to start incorporating these cyber defense technologies or face the consequences when their devices are the result of a data breach!

Here is a podcast I did with Omnistruct on the topic of cybersecurity: https://omnistruct.com/cyberse...ent-with-kevin-neal/