HP printers can be remotely controlled and set on fire, researchers claim | Hacker News Reader

HP printers can be remotely controlled and set on fire, researchers claim

arstechnica.com

33 pointsjnazario25 comments

Perhaps they should reinstate the "lp0 on fire" error message. http://en.wikipedia.org/wiki/Lp0_on_fire

This article is from 2011, here is the talk from 28c3: http://media.ccc.de/browse/congress/2011/28c3-4780-en-print_...

Also on the subject of printers this talk from 28c3 is quite interesting: http://media.ccc.de/browse/congress/2011/28c3-4871-en-hackin...

The disclosures before this talk gave rise to this article http://www.youtube.com/watch?v=njVv7J2azY8

The talk clearly mentions that if you can put malware into a printer wouldn't you use it to pawn a network instead of just setting it on fire - also it isn't possible to set it on fire - they just made that up.

Well, if someone wants to use it for criminal activities, then arson may be much more profitable than a pawned network; it would be undetectable since any evidence of hacking would be destroyed in the fire, so it might be used in both harming competitors and also for insurance fraud.

Time to fork hpsetdisp.pl for some real fun. Besides, I have a printer at work that needs replacing.

http://kovaya.com/perl/show.cgi?program=hpsetdisp.pl

From the article:

>>"HP LaserJet printers have a hardware element called a 'thermal breaker' that is designed to prevent the fuser from overheating or causing a fire. It cannot be overcome by a firmware change or this proposed vulnerability."

I wouldn't be so sure about that last part, but I do doubt that the things can be made to cause adjacent objects to catch fire (unless maybe someone stores their gasoline in open containers near the printer).

A thermal breaker is a purely mechanical device, it opens the electrical circuit if temperature rises beyond its designed limit. It is not controlled by software. It is designed to be a failsafe against another hardware or software problem which is causing an overheating condition. I think HPs claim on at least that issue is credible.

Yes, I know what a thermal breaker is, and that the switch itself cannot be affected by firmware, so he is correct in that statement, but that is so obvious that doesn't really need mentioning. What I mean is that the protection that is intended by the thermal switch might be cleverly defeated. The thermal switch is usually mounted on the (metal frame) chassis, not always close to the parts that would catch fire. What I am suggesting is that one might find a way to cause a paper jam, and then get the paper to ignite before the chassis were heated enough to cause the thermal switch to open. It might even be dependent upon a specific model(s). I doubt it is possible to prevent without very careful placement of thermal switch(es). The kind of placement that would defy efficient manufacturing ideals, and possibly even user-safety-inspired design practices. TBH, I don't think it is likely to be a reliable ignition method. Besides, Randall Hyde has shown us the most satisfying way to get rid of printers (buckshot).

If I were HP, I think I'd put it right by the fuser.

(Although I would also do a lot of other things differently, so that may not be a strong point.)

You can also find HP printers through Google. They run a webserver publicly accessible form anywhere by default!

Search for on Google for the following (without quotes)

"inurl:hp/device/this.LCDispatcher?nav=hp.Print"

This will lead you to a decent user interface for printing as well.

The Shodan search engine is a great resource as well:

http://www.shodanhq.com/search?q=hp+laserjet

Aaaah Turing complete printers, always lovely! I cannot find the link, but there was the story of a hacker that sent raytracing programs made in postscript to printers, just to see them struggle to print, and then print some pretty but useless picture.

Heres a couple: http://www.physics.uq.edu.au/people/foster/postscript.html http://tog.acm.org/resources/RTNews/html/rtnv6n2.html

I have a networked HP printer (or perhaps I shouldn't admit that). Does anybody have a dummies guide on how to protect myself while maintaining connection to the internet? Thanks!

Firewall.

Exactly. http://en.wikipedia.org/wiki/Firewall_(construction)

Don't expose it directly to the Internet, such as by assigning it a publicly routable IP address or forwarding the ports it uses (typically 515 and 9000-9003/TCP) from hosts on the Internet.

For the most part, if it's on your "internal" network and isn't accessible from hosts on the Internet, you're safe (except from "insiders").

If you need it exposed to the internet you can at least attempt to change your port forwarding settings on your router to use a different port on the public side of the connection, for example, routing port 10000 to 192.168.1.x:500 or whatever the case is. Not sure why you'd want to print to your home/office printer while you're not there though.

When I was 14(in 2000) I took intro to computer science. The first program I built outside of class was a program that took over the users printer and printed out all sorts of stuff as well as shot out error codes etc. I just thought it was amazing that with just a little bit of visual basic I could own your printer.

It's even easier than that -- you can even do it with `telnet`, `nc`, etc.

If only HP had obtained the rights to BeOS when they picked up WebOS (via Palm). Then they would have a solution to this.

http://www.bebox.nu/bebooks/BeBookR5/The%20Kernel%20Kit/Syst...

This article is from 2011. What's the point in posting it now?

(2011)

I remembered reading this ages ago - I'm not sure why submitting a nearly two year old article was necessary.

The article is old... 2011

Reply on news.ycombinator.com