Two new vulnerabilities recently discovered in the fax protocol allow hackers to gain access to home and corporate networks, according to two Check Point who gave a talk on the subject at the DEF CON Security conference. The exploit, called Faxploit, works on the ITU T.30 Fax protocol. Specifically, it performs two buffer overflows.
Researchers Itkin and Balmas say that an attacker can send specially crafted fax images that contain malicious code. By executing the code, the attacker exploits the vulnerabilities and takes control of the device.
From there, through the fax device, the hacker can download and execute additional hacking tools, with which he can control the local network, and expand to "neighboring" devices.
The researchers recorded in a video the process by which the vulnerability is exploited, and then, they download the EternalBlue exploit, which infects "nearby computers" located on the same local network.
The execution of Faxploit is very simple and all that it requires is a telephone line. All the attacker needs is the victim's fax address. Since most businesses list their fax on their websites, and Google has indexed over 300 million fax numbers, Hackers can use the Faxploit technique against any organization worldwide.
Furthermore, preventing such an attack is virtually impossible as the Internet is not used, and to date, no program monitors the incoming data destined for the terminal device.
At the time of writing, only HP has released patch fixes for its Officejet all-in-one printers.
According to the researchers, the only way a corporate network can stay safe from this threat is to split its network into smaller parts. Separating faxes into their own sub-networks is a temporary solution for Faxploit.
[su_youtube url=”https://www.youtube.com/watch?v=1VDZTjngNqs” width=”640″ height=”380″]https://www.youtube.com/watch?v=B7o0qA4L4So[/su_youtube]
