Faxploit: Sending Fax Back to the Dark Ages
research.checkpoint.com
research.checkpoint.com
We believe that this security risk should be given special attention by the community, changing the way that modern network architectures treat network printers and fax machines. From now on, a fax machine should be treated as a possible infiltration vector into the corporate network.
This is a great piece of research and a beautiful write up which is extremely accessible to anyone interested in how these attacks are developed.
The twist at the end, of bundling NSA exploits for complete network takeover all starting from a faxed JPEG file with a malformed header, is icing on the cake.
1) Get a public IP address on the internet. 2) Put a server on the internet, with an open port, running software that can receive arbitrary files. 3) Connect to it from your computer and send it a file. 4) Receive confirmation that the remote server correctly received your whole file.
Everything else, like e-mail, depends on a chain of service providers and accounts to deliver and store content reliably over the network. Fax enables any person with a phone number to send documents to any person with a phone number. E-mail may seem similar (you need a phone service provider and a fax machine), but I think faxing is a less technically complicated solution, more reliable overall, and allows a lot more independence.
In your proposal, how do the packets get from point A to B?
Though I agree that for many end users sending a fax is easier and simpler, but that seems mostly because of experience and familiarity.
Can you count the number of times an internet connection has gone down for a business, compared to the number of times the PSTN has gone down? Unless a truck takes out a utility pole, there's no contest. And the lack of obstructions for user access removes a whole slew of other issues.
You most definitely need an "account" with your telephony provider in order to receive anything.
Faxes require no such accounts. Just plug the machine in to a phone line and send a document.
I will give you that point, but counter with this: fax machines rely on printers, which IME are one of the least reliable pieces of technology. A printer being jammed/broken is far more common than losing internet connectivity.
Also the quality is kind of crap. One of the pages was unreadable, so after having sent the "official" version as a fax (they accepted faxed raised-seal documents as originals), I had to follow up with a higher quality color scan anyway.
Still your point about it being P2P, relying on just the physical network and its addressing is appreciated and duly noted.
The last time I had to send a fax was when my back account had fraudulent charges made against it. My now-former bank wanted me to fill out a form — fine — which they would only snail-mail or fax to me.
This form could simply be hosted on their website, as a PDF. In fact, the form I received had something like Z:\BigBankCo_Shared\Docs\Forms\Fraud.docx on the bottom of it, and in the end, I gave them a number of a service that automatically converts faxes into PDFs in emails.
Now, they wanted me to fax (or snail mail) it back. A email with an attachment to a support address, such as fraud-form-returns@bigbank.example.com, would have suffice. Directly, bit for bit equivalent? No. Gets the job done? Yes.
All together, the entire thing was a few simple questions (my info, information about the transactions, and a statement essentially swearing up and down it wasn't my fault) that could also have just been gathered by an HTML form.
(And, I'm not saying these should replace the snail mail/fax; keep them, if there is sufficient demand for them. Which I suspect that once you have an HTML form, there won't be.)
Email, on the other hand, always got through.
For example, your doctor can fax a prescription to the pharmacist. Or a request for records to another doctor. A faxed copy of a signed contract carries some degree of official legal recognition/status (yeah, go figure).
Bog standard email did/does not carry such authority. Maybe closed email interconnects now do. For example, I think our area health care networks (we have 3 big ones, here) now support email requests for some things requiring authorization. But those emails are within their private network, and on private links between their networks where they've agreed to interconnect on such things.
Or they should be... Speaking more generally, I observe at least some doctors and offices emailing all sort of stuff on the public, general Internet, that should actually remain protected.
(One of the reasons I expect the Internet to continue to be de facto locked down by authority (laws and rubber hoses, as opposed to technically complete "solutions"). People, including authority figures, insist upon using it as if it is secure. They have a lot of power, that will end up enforcing "security" through physical power against those who don't "obey the rules".)
If both are subject to vulnerabilities are there any upsides to continuing to use fax?
Like a lot of things in the world, actual use comes down to practicality. There hasn't been a big enough scandal, yet, with regard to legal recognition of faxed documents. And it's a legacy format that remains in place, that allows for immediate communication of same. So, people use it.
Thinking of this reminds me of U.S. voter registration and voting. Right now, we have a manufactured political uproar about supposed fraud and abuse of the extant systems. But studies have shown this to be very negligible. Yes, in theory voter registration in the states and municipalities could be further "secured". But, up until this use as a political tool, doing so wasn't viewed as necessary. Localities did a sufficient job of managing registration and identification of their own bases.
And actually, the "security" of voter registration had to be forcibly loosened, in order to prevent it from being used as a tool of disenfranchisement (e.g. difficult tests to pass, in order to register -- but only for African Americans).
Faxes aren't really "secure". But they are used to put an official, sanctioned imprimatur on what is already understood and happening, anyway, when the parties involved aren't immediately face-to-face.
Maybe there are some cases over whether a faxed signature is genuine, but these apparently haven't risen in prominence to the point of derailing the faxed signature as legal mechanism. They would have a lot of convenience and "efficiency" -- these days, "necessity" -- to outweigh, before they would do so.
Much of this is the direct consequence of fax being carried over the POTS copper telephone network, where there is some belief (not necessarily accurate in today's world) that the link between sender and receiver over a POTS line is free of "men in the middle". Therefore fax is viewed as 'secure' due to this belief.
They also used X.25 a lot, as they didn't trust the fancy new TCP/IP stuff that was around, though, so there's that...
In the US, there is a widespread problem of robocalls that appear to originate from the same exchange as the phone number assigned to the cell phone. Couldn't this also affect faxes?
Unlike email, caller id does not have the equivalent of SPF[1], DKIM[2] or DMARC[3].
[1] https://en.wikipedia.org/wiki/Sender_Policy_Framework [2] https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail [3] https://en.wikipedia.org/wiki/DMARC
I don't have any numbers about monthly active users and other relevant KPIs, but I bet they are really low.
1. The buffer overflow identified exists in a JPEG parser that was written by HP from scratch. Therefore this exploit may only apply to the specific models of HP fax that utilise this firmware (and HP have already patched it, so a fix is available).
2. Disabling colour faxes would mitigate the vulnerability. (I've just scanned three years worth of fax logs from our fax server and we've never received a colour fax).
3. These mitigations aside, the principle remains that fax is often present without any kind of security attached directly to the network and thought should be given to isolating fax infrastructure to reduce exposure to exploitation. (Additionally the constant and ongoing lobby to management to permanently retire fax should be maintained).
2. Would mitigate this vulnerability. And, the nasty thing about this is that it could potentially rewrite your logs. You can't trust a compromised machine to tell the truth.
3. Yup.
Some low-level clients make this easier (say, Mutt) but most clients allow you to do so. For instance, all desktop and mobile apps, such as Outlook, Thunderbird and Apple Mail have an Accounts setting screen where you can change your "sender" email address. You can write anything you want in that field.
Online services, such as GMail, require you to have access to the addresses you wish to use as "sender", but they are the exception. Anybody can still use your GMail address as sender in their emails. (Anti-SPAM features such as SPF notwithstanding.)
I've checked Dell's sites for updated firmware but for the models I would need, they haven't released a firmware upgrade since 2016.
However, superficially, fax is more secure because there are no stored copies (maybe depending on the machine?). There's the original, and the copy that gets printed out on the other end. If you were to fax over a script for a movie, there wouldn't be a copy sitting on a disk on the receiving end, there would only be a printout. That's what Ridley Scott is alluding to in that video.
Seems like fax has fewer folks targeting that system.
How is the encryption done? Password?
I've never heard about anything like this; fax machines have always been the POTS analog kind over in Australia.
in the us these are standard in scif locations.
Though no reason why such an approach could be utilised for pots based FAX machines.
As for the encryption - was pre-shared key type affair and unable to elaborate further.
So, if we go from there and then take something like https://theintercept.com/2018/06/25/att-internet-nsa-spy-hub... and consider the complexity of that, then ponder XKEYSCORE and so forth, yes, absolutely ISPs store faxes __precisely because they're unencrypted__ and __precisely because they're routinely used for medical and other sensitive data__.
Or the NSA isn't worth its $1B/yr.
I don't know Ridley Scott, but he needs to talk to a nice security researcher at some point, someone whose feet are on the ground and who likes sharing honestly.