Report: 'Faxploit' hack can penetrate networks with just a fax number

Fax machines are a lot more ubiquitous and vulnerable than you may think, according to Check Point.

Fax machines, very much still a thing, can be used as an entry point into an enterprise’s IT network, according to new research from Israeli cybersecurity company Check Point.

In a report released Monday, Check Point details an exploit whereby an attacker can infiltrate using only a fax number associated with a machine on a target network. Attacks can then move across a network, even if it’s not connected to the internet, according to the report.

As demonstrated by Check Point in the video below, the hacker can execute script that targets the victim’s fax number in order to obtain network access. The attacker can then use EternalBlue, a NSA-developed exploit leaked by the Shadow Brokers hacker group, to further infiltrate the network and execute malware.

In Check Point’s video, the hacker uses malware to locate a file on the victim network and send it back to the hacker’s fax machine.

Check Point says attackers could customize the attack to extract the information they’re looking for.

“These could include sending a copy of every fax that a customer sends to their bank, for example, with sensitive account information included, back to the attacker. Another possibility could be tampering with the fax content itself (i.e. replacing the documents received with altered versions of them),” the company said in the report.

Since, the exploit, which Check Point dubs “Faxploit,” targets the fax protocol, a network doesn’t even have to be connected to the internet to be infiltrated, the company says.

Check Point conducted its research on HP “all-in-one” devices with printer and fax capability, but says that Faxploit is not limited to HP because the attack relies on a vulnerability in the fax protocol.

HP has released a patch for the exploit, having collaborated with Check Point.

The news comes not long after HP launched a bug bounty program for its printers with Bugcrowd, inviting white-hat hackers to find and report vulnerabilities in its devices.

“Many companies may not even be aware they have a fax machine connected to their network, but fax capability is built into many multi-function office and home printers,” said Yaniv Balmas, group manager of security research at Check Point, in a press release. “This groundbreaking research shows how these overlooked devices can be targeted by criminals and used to take over networks to breach data or disrupt operations.

Check Point asserts that, contrary to popular belief, fax machines are still widely in use. Health care organizations use them due to privacy regulations and the banking and real estate industries use them to transmit signatures, among other uses.

“In fact, while our world becomes more connected through [internet of things] devices, the cloud and mobile platforms, there still remain simpler technologies which can allow potential hackers to infiltrate IT networks and provide unauthorized access to sensitive information,” Check Point wrote.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure