Your Printer Might Be A Security Risk

If you need to regularly work with printed documents, then being able to access your office printer from the Internet might well be a godsend. Just remember that a network-connected printer represents a potential security vulnerability.

While few printers can install software directly (and those that do often have a complex approval process and performance issues), vulnerabilities in printer firmware can create opportunities for cyber-criminals. There are also other potential risks, ranging from your printer being filled with unwanted spam and junk to unexpected expenditure on supplies. Alexey Polyakov, head of the global emergency response team at security software developer Kaspersky Lab, gave an interesting example at the company's recent security summit in Malaga:

We had an experiment where we tried to find printers via the Web, and we found many of these. We could even order printer supplies for some of them.

Bottom line: if you're not confident your Internet printing infrastructure is secure, it might be best not to set up that option. After all, you're not going to have access to the documents until you return to the printer anyway; having to print on the spot might be simpler than cleaning up any security mess afterwards.

Disclosure: Angus Kidman travelled to Spain as a guest of Kaspersky Lab.


Comments

    why on earth would you put a printer available directly to the internet without it being behind a firewall or only accessible with a vpn client. seriously, if you just open your printer to the internet then its your own fault.

    the internet is the wild west, anything goes. there are no police to stop you and there is almost no-one to catch you doing illegal things.

      Why on earth would you put a fax machine available directly to the world-wide telephone network?

    The other huge security risk are documents that are stored on the printer's memory. This should ideally be cleared or wiped before selling the printer as this stuff is NOT stored encrypted

      Actually document security kits are available on some brands which encrypt the HDD. The RAM can be cleared and the HDD is wiped by overwriting up to seven times.

      The HDD can be wiped clean before trading the unit in.

    Reminds me of someone I used to work with who ran his firewall on his network printer (an old HP laser running Linux).

    And way back in the day the more paranoid sysadmins even had their security logs output to dot matrix printers (so if the logs were deleted or edited, you still had originals).

Join the discussion!