While security managers find it challenging enough to maintain secure patch levels across their organisations' desktops, servers and networking gear, there’s a new class of network equipment that you’ll need to add to the list: high-end networked scanners, copiers, printers and multi-function devices.These may not be the devices most targeted for attack right now, but they’re likely to move up that list very soon.
First, the manufacturers are increasingly moving away from proprietary operating systems and software that run these devices in favour of readily-available operating systems. Second, there has been heightened visibility regarding the vulnerabilities associated with these devices, including a presentation at this year’s Black Hat security conference. Recently, while at a customer site, we identified vulnerabilities on a networked printer that left the organisation open to attack.
Until recently, these types of devices were based on specialised software running on RISC-based processors, and few attackers had the knowledge or skills necessary to identify and exploit the vulnerabilities that would make a successful attack possible. Today, more of these devices are built on traditional Intel processors running common operating systems such as Linux, and even Apache Web server software. That’s why high-end multi-function devices and printers are beginning to look amazingly similar to any other IT appliance attached to the network.
The result is that they’re now vulnerable to the same types of attacks as standard desktops and servers, and can be used as a potential jump-point to other devices and systems, to even monitor data traveling across the network, or be used to launch DoS attacks. And the data actually residing on these devices can be critical, even regulated. More and more of these devices are coming equipped with hard disks, and everything copied can be cached.