Tag Archive for Printer

Protecting Print Devices from Malware

Protecting Print Devices from MalwarePrinter/copier firm Xerox and anti-malware firm McAfee revealed new protection against malware and viruses with the first networked multifunction printer to use McAfee Embedded Control software, a filtering method that allows only approved programs to get through to protect print devices from malware.

Xerox, McAfee Protecting Print Devices from MalwareTom Moore, vice president, Embedded Security, McAfee told Help Net Security in a recent article,When a multifunction device receives data and processes it for printing, copying, scanning or faxing, it becomes susceptible to malware attacks a susceptibility that often is overlooked.

The Xerox and McAfee security solution simplifies processes for IT administrators with software embedded into a multifunction device’s controller to give an immediate alert and audit trail to track and investigate the time and origin of security threats – and take action. The blog says this eliminates the need for IT administrators to constantly stay on top of malware threats and proactively block them.

networked printers and multifunction devicesSurvey data from Xerox (XRX) and McAfee underscores the need for embedded security in networked printers and multifunction devices. In a poll of office workers taken earlier this year: 33% say they either don’t always follow their company’s IT security policies; 21% aren’t aware of the company’s IT security policies.

The survey also showed 39% of employees who copy, scan or print confidential information at work say they wonder whether information like customer credit card numbers, financial reports, human resources, and tax documents will remain secure on networked a device.

IT administrators Self protecting networkdon’t always consider printers as a threat – and with the Embedded Control software, we’ve put up even more defenses in our products so they don’t have to,” said Rick Dastin, president, Xerox Office, and Solutions Business Group.

Xerox devices protected and managed by McAfee Embedded Control and McAfee Embedded Management software will become available beginning in 2013, with products in the Xerox WorkCentre and ColorQube product lines.

rb-

Finally, some tangible results from Intel‘s (INTC) acquisition of McAfee. We use McAfee where I manage shared technical services, and just we just rolled out version 8.8 which says Intel on it.

I have covered the risks of putting multifunction devices on your network here, here, and here. This is not what I expected, maybe this is the first evolution before Intel builds McAfee anti-virus into a chip that goes on the mainboard or even right into the processor as a way to protect print devices from malware.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Malware Launches Massive Print Jobs

Malware Launches Massive Print JobsIf your printers start printing garbage characters until they run out of paper, it’s a sure sign your network has been hit by the Milicenso Trojan malware. Help Net Security reports that Symantec (SYMC) researchers have found that the garbled printouts are just a side effect of the infection and not its goal. The malware’s last variants have an extremely low detection rate – only 4 of the 42 solutions used by Virus Total detect them at the moment.

Trojan horse malwareThe article says the Milicenso Trojan is actually a backdoor used to deliver other malware on the affected machines. The infection vectors are links and malicious attachments in unsolicited emails, as well as websites hosting malicious scripts that trigger the download of the Trojan. “The Trojan creates and executes a dropper executable, which in turn creates a DLL file in the %System% folder”, shared the Symantec researchers.

The heavily encrypted DLL file creates a number of EXE and DLL files and uses a number of routines to discover whether the execution environment is a virtual machine, public malware sandbox or a black-boxing site. The Trojan also drops a piece of adware, whose aim is to serve as a decoy for AV solutions present on the machines. The blog says the  Adware.Eorezo has only one goal: to point Internet Explorer to an ad-relater URL.

Sandbox environmentHelp Net Security explains the malware triggers the massive printing by exploiting the Windows default print spooler directory. “During the infection phase, a .spl file is created in [DRIVE_LETTER]system32Spool PRINTERS[RANDOM].spl. Note the Windows’ default print spooler directory is %System%spoolprinters.”

The researchers explained “The .spl file, while appearing to be a common printer spool file, is actually an executable file and is detected as Adware.Eorezo. Depending on the configuration, any files, including binary files, created in that folder will trigger print jobs.”

rb-

I have written about the risks of copiers and printers here and here. I’m sure someone will figure out how to use this malware as a direct DOS on printers, and not as a side effect.

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Digital Food for Dinner

Digital Food for DinnerThe Fluid Interfaces Group at MIT has developed a “personal food factory.” The scientists have created a prototype 3D printer that stores, mixes, deposits, and cooks layers of ingredients that will rival your grandmother’s multi-layered lasagna according to Globalspec.

The project called Cornucopia is a concept design for a personal food factory that brings the versatility of the digital world to the realm of cooking.

MIT 3D Food Printer, Virtuoso Mixer and Robotic Chef

MIT says Cornucopia’s cooking process starts with an array of food canisters, which refrigerate and store a user’s favorite ingredients. These are piped into a mixer and extruder head that can accurately deposit elaborate combinations of food. While the deposition takes place, the food is heated or cooled by Cornucopia’s chamber or the heating and cooling tubes located on the printing head. This fabrication process not only allows for the creation of flavors and textures that would be completely unimaginable through other cooking techniques, but it also allows the user to have ultimate control over the origin, quality, nutritional value, and taste of every meal.

rb-

Will work for food

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

The Secret Life of Copiers

The Secret Life of Copiers-Updated – 05-11-2007- Most digital copiers manufactured in the past five years have disk drives to reproduce documents. As a result, the seemingly harmless machines that are commonly used to spit out copies of sensitive information can retain the data being scanned.

Digital copier manufacturer Sharp issued a warning about photocopier vulnerabilities in conjunction with tax season. The company warned that it isn’t just people who make copies of their tax returns who are at risk.

A few years ago Sharp was among the first to offer a security kit for its machines. The security kit would encrypt and overwrite the images being scanned. Overwriting the data ensures it isn’t stored on the hard disks indefinitely.

In many cases, a central administrative or IT department monitors an entire fleet of copiers using each machine’s Internet Protocol (IP) address. What they forget is that, because the copiers are managed remotely, other people could get access to them. Firms can take action in several ways.

One option is to close IP ports. When a copier is being installed, the IT staff should close IP ports to ensure there is only one access point to the machine. Another option would be to use media access control (MAC) filtering. MAC filtering sets rules to accept commands only from specified MAC addresses such as the help desk, restricting outsiders.

The Secret Life of Copiers, CFO Magazine May 01, 2004

Last fall, reports began circulating that a large university in the Northeast had uncovered an illegal music-file-swapping service on campus. The music files were stored in a spot nobody would ever think to look: a copy machine. The students were actually transferring MP3s to and from a hard drive on a copier, The machine’s hard drive was designed to capture and store scanned documents. Apparently, a member of the school’s IT department stumbled on the plot after noticing a remarkable amount of traffic going to and from the networked copier.

While the technology for making copies has changed little in the past 50 years, most copiers are now full-blown IT devices, with network and E-mail server connectivity. employees typically have unfettered access to copiers — and thus any information stored on them. This makes copy machines perfect targets for hackers or, since the drives are usually removable, thieves.

Enterprise appliance security could prove to be of real importance in the new era of privacy (for example, the Health Insurance Portability and Accountability Act of 1996, or HIPAA) and document management (the Sarbanes-Oxley Act of 2002). That’s doubly true if a company uses copiers to scan sensitive personal documents such as medical records, birth certificates, or financial forms. Louis E. Slawetsky, president of Rochester, N.Y.-based research firm Industry Analysts Inc said, “People don’t think of copiers as a vulnerability … That’s a problem since they have hard drives and can store whatever has been copied for an indefinite period of time.

This creates a potential security problem: customers have access to a machine connected to the bank’s network. mitigates the danger by placing the machine behind two firewalls and making the copier password-protected. Security consultants say potential buyers of new copiers should almost always look for machines with encryption or overwriting capabilities.

Hard-copy security is also an issue — you don’t want the wrong person picking up someone else’s copy job. Hence, experts advise prospective buyers to stick to machines that come with password protection. That way, says Larry Kovnat, systems security program manager for Xerox’s office group in Rochester, N.Y., “no one can inadvertently see documents or pick them up.”

Despite the improvements in copier-machine defenses, one security hole still has not been addressed: E-mail. Although copiers generally can keep track of who is E-mailing a document (through passwords), it is nigh impossible to put limits on what can be sent or where the E-mails can be sent. This could change, however, as copier hard drives and network connections become more sophisticated.

Related articles

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Vulnerabilities

VulnerabilitiesNetwork edge devices: border routers with their admin interfaces open, so people can manage them from home, but so can anyone else

Networked printers/copiers: have IP addresses without VLANs, making them a convenient and undefended jumping-off point to the whole network.

Web servers and Web applications: With Web servers sitting off the firewall in a demilitarized zone (DMZ), they can often be the ideal gateways to internal company processes. Web servers without patches and passwords are common. Three-quarters of hacker attacks are on Web servers since that’s what’s out there. This is particularly dangerous with the proliferation of Web applications. Attacks have typically moved up into the application layer, and that’s one of the hardest things to protect against because there are no one-size-fits-all solutions. The danger, of course, is that Web applications typically connect attackers into your databases, and that can be a huge problem.

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.