Fax machines' custom Linux allows dial-up hack

Re: A Major problem for Japan

@Crazy Operations Guy,

"Fax Machines are still used quite a lot in Japan. Nearly every household possesses one, even households without any other form of technology.

Makes sense given their technology lust where everyone bought a fax machine to exchange graphical data then didn't see the point of upgrading to e-mail when it became popular. Especially since if everyone has a fax machine, why would you want to purchase a computer, pay for an internet connection, and pay for an email address (Well, they're free now...) when a fax machine just needs a second phone line."

You appear to be stereotyping and out of date. I've not seen anyone use a fax in years, and even my aged Japanese mother in law uses email these days, though largely only to receive internet purchase confirmations.

The researchers tested their exploit on the Epson WF-2540 MFP, but reckon most WorkForce and Stylus devices are likely to be vulnerable. Since these units date back to 1999, “huge amounts” could be vulnerable.

So how many printers from 1999 offer "Windows 8" compatibility? Yes, I recall us getting an Epson Stylus years ago around 1997 or so. I recall it being one of the most modern printers I've used whose documentation included details on the control codes used so you could write your own driver for it.

It's possible they've been using the same firmware update code because "it works" overlooking its security shortcomings. If you bothered to look though, the exploit was discovered in a current model printer.

"Since 1999? Seeing as it is now 2016, I have to wonder how many of these devices are still in use vs being in landfill.."

For a client, I just "upgraded" an office multifunction printer (photocopier sized device) that had only recently been delivered, new. The upgrade? Adding a fax card and new console overlay and getting it plugged into a phone line.

In the rest of the world

you don't need dedicated fax lines as voice lines are of high enough quality to allow for faxes to be sent, even VoIP ones. All you need is a number, but small companies got 3 numbers with their ISDN line and large companies typically have a full block with more than enough numbers.

Re: Malicious firmware exploit

Quite. There are precious few devices that you *can't* install your own firmware on; this is how projects like OpenWrt work. And it sounds like the user has to make an active choice to install the firmware if they are "tricked" into doing it.

So forget fax machines from the 1990's: if this is a vulnerability, then pretty much every home router and access point is affected. Oh, and so is your PC. What, you mean Windows allows me to run programs which are not signed by Microsoft? Vulnerability!!

Re: Someone you know still uses them

"I have read that the NHS is a huge user of fax machines."

Don't believe everything you read