Hacking Fax Machines? It Can Happen, and Mac Users Could Be Vulnerable
The average person, when they think about fax machines, probably puts them into the same class of technology as dial-up Internet — old, obsolete, and supplanted by more advanced technology. That last component, though, isn’t really true for the humble fax. In fact, many industries, including the medical sector, still rely heavily on fax machines for sending huge volumes of information daily. However, many of the fax machines in use today are not standalone devices, as they were in the 1980s; instead, they’re a component of all-in-one printers and scanners. Many people, from home users to businesses, employ these devices.
Based on new research presented recently at the DEF CON hacker convention in Las Vegas, a huge number of these all-in-ones are vulnerable to an incredibly simple hack, dubbed Faxploit. With a specially designed malware package that includes the EternalBlue exploit, all an attacker needs is a victim’s fax phone number to take over the unit. Since these all-in-one units tend to be connected to the user’s network, the attacker can easily penetrate the system, locate individual machines, and dump malware onto them. Faxploit can even be used to steal data and send it back to the attacker’s own machine. Though the researchers carried out their work on HP-branded machines, they believe most faxes remain vulnerable as well.
The good news: the researchers responsible for this hack worked with HP to ensure a fix was in place prior to their announcement. There is bad news, though. HP patches approximately 150 machines as a result of Faxploit, but roughly 25% of those have no updates available for the Mac. Instead, HP tends to release updates primarily for its Windows users. While many popular models have Mac updates now available, many do not. HP’s official solution for Mac users was to encourage them to dual-boot Windows or to use a virtual machine to use the updates. For those without a Windows license, this is not a realistic option.
Unfortunately, the only option otherwise is to unplug the phone line from your multi-function printer when you aren’t anticipating receiving a fax. For many businesses, this is likely not an option. HP says it is continuing to work on driver updates and that more Mac releases will come, but the timing remains a mystery. If you use a multi-function fax machine regularly at home or the office, be sure to check the official HP website for firmware updates. If you don’t find your device on the list, consider alternate solutions, including asking those with Windows machines to help install the updates.
