Why fax machines pose a major cybersecurity risk

Security experts have warned companies and homeowners using fax machines that they may be at risk of falling victim to cybercrime.

A study by US-based cybersecurity advisers Check Point Research found an exploit in printers with built-in fax machines whereby criminals could “infiltrate any home or corporate network” with just a fax number.

The so-called faxploit occurs when hackers send a “specially created image file” to a fax number, which is then “automatically decoded and uploaded” to the printer’s internal memory, reports the Daily Mirror.

Subscribe to The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

Sign up for The Week's Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up

If hackers programme the files to contain malware, the disrupting software “takes over the device and can spread to any network the fax-printer is connected to”, the newspaper explains.

According to tech news site VentureBeat, Check Point researchers were able to replicate the security loophole on a Hewlett-Packard (HP) printer-fax machine. This prompted HP to issue a fix in the form of a firmware update for its fax-enabled devices.

However, many products have not been updated to close the loophole.

Although fax is considered an ageing technology, around 45 million printer-fax machines are still used worldwide, the London Evening Standard reports.

The NHS alone uses 9,000 fax machines - which is “particularly worrying” given that the health service handles “vast amounts of highly sensitive personal data” using the technology, the newspaper adds.

Yaniv Balmas, a researcher at Check Point, told the BBC that fax security systems were “standardised in the 1980s and have not been changed since”.

“Fax has no security measures built in, absolutely nothing,” he said.

Speaking to Wired, Check Point’s Eyal Itkin said that the best way to prevent a fax cyberattack is to stop using the technology altogether.

If that’s not possible, he recommends segregating printers by putting them on “a separate network”.

“So even if someone takes over the printer, they won’t easily be able to propagate into the main network”, Itkin concludes.