Image credit: billiondigital/ depositphotos. You can find out more about the research on the F-Secure site, HP has a security advisory with information firmware patching, and there's also a best practice guide for securing FutureSmart products. F-Secure advises users to take other steps including limiting physical access to MFPs and segregating them in a separate, firewalled VLAN. Whilst working in F-Secure’s Tactical Defense Unit (TDU), Timo specialized in exploit analysis and studied the latest tricks used by advanced threat actors.

today revealed they have discovered a range of security vulnerabilities that affect more than 150. HP has now published firmware updates and security advisories for the affected devices. Timo Hirvonen, Senior Security Consultant, F-Secure Consulting Timo has been with F-Secure since 2010. If exploited successfully, F-Secure consultants Timo Hirvonen and Alexander Bolshev said they could be used to gain full control of a target enterprise’s network. Researchers at cybersecurity solutions firm F-Secure Corp. Experienced threat actors see unsecured devices as opportunities, so organizations that don't prioritize securing their MFPs like other endpoints leave themselves exposed to attacks like the ones documented in our research,' says F-Secure security consultant Timo Hirvonen. And just like other endpoints, attackers can leverage a compromised device to damage an organizations infrastructure and operations. 'It's easy to forget that modern MFPs are fully-functional computers that threat actors can compromise just like other workstations and endpoints.

Attackers could also then use compromised MFPs as a beachhead to penetrate further into an organization's network. This includes not only documents that are printed, scanned, or faxed, but also information like passwords and login credentials that connect the device to the rest of the network. Tomi Tuominen and Timo Hirvonen, both researchers at cybersecurity firm F-Secure, have discovered a security flaw in the most popular manufacturer line of digital hotel locks. F-Secure researchers unlock a hotel door using their device in a YouTube video. This would allow attackers to steal any information going through the MFP. Worlds most popular hotel door lock vulnerable to hackers. The website would, automatically, remotely print a document containing a maliciously-crafted font on the vulnerable MFP, giving the attacker code execution rights on the device. Attackers could trick a user from a targeted organization into visiting a malicious website, exposing the organization's vulnerable MFP to what's known as a cross-site printing attack.

Timo hirvonen f secure