Cyber Response Systems Notes

Office printers with their admin pages open to the internet

During assessments this quarter, one office in five had a multifunction printer reachable from outside, default password intact, address book full of staff email addresses.

What we are seeing

A large multifunction printer is a computer with a hard disk, a web server, an address book and, very often, stored credentials for a mailbox and a file share. Somebody once forwarded a port to it so that scan-to-email would work from a second office, or so the supplier could read the meter. Nobody wrote it down.

From the outside it looks like a login page with the manufacturer's logo on it. The default password is in the manual, and the manual is on the internet.

Why it matters more than it sounds

  • The address book is a verified list of real staff addresses, ideal for phishing
  • Scan-to-email credentials are often a real mailbox with a password that never expires
  • Scan-to-folder credentials are sometimes a domain account, occasionally an administrator
  • The disk keeps copies of what was scanned. Payroll. Passports. Contracts.

What to do this week

  1. Look from the outside. Ask whoever manages your firewall for the list of port forwards. If nobody can produce one, that is the finding.
  2. Remove the forward. There is no good reason for a printer to accept connections from the internet. Supplier meter readings work outbound.
  3. Change the admin password and update the firmware while you are there.
  4. Replace stored credentials with an account that can do exactly one thing.

Returning a leased machine?

Ask for the disk to be wiped or removed, and get that in writing. Lease returns are resold with their contents more often than the industry likes to admit.

Cyber Response Systems

Managed detection and response for organizations too small to staff a security desk and too important to go without one.

Get in touch

hello@example.com
+1 555 0100
Mon–Fri, 8am–6pm