Security Threats and Measures on Multifunctional Devices

Headnote

Abstract: Multifunctional devices are employed in office networks for functionality and comfort, most often considered only as peripheral devices enabling the printing, copying and scanning of documents. Based on a study performed by InfoTrends in 2013 in the USA and Western Europe, the majority of people surveyed are of the opinion that computers pose the biggest security threats of all technological devices (Forbes, 2017a). In many cases, users of multifunctional devices do not realise that a multifunctional device is also a network device which have similar vulnerabilities, whereby the security threats relating to these devices are often overlooked. This paper provides an overview of the physical and network security risks relating to networked multifunctional devices. It includes a number of experiments and tests performed on multifunctional devices, security analysis, discussions on possible exploits as well as recommendations on various security measures. This paper could serve as a high-level guideline when installing multifunctional devices in a network environment and informing administrators and users of the security risks associated with installation and daily use.

Keywords: data extraction, multifunctional device, networks, printers, risk, security

1. Introduction

More or less all multifunctional devices (MFDs), or multifunctional printers (MFPs), built after 2002 contain a hard drive (Forbes.com, 2017a; Kassner, 2010), not only offering printing capabilities, but a range of additional capabilities such as copying and scanning. These devices can be assigned Transmission Control Protocol/Internet Protocol (TCP/IP) addresses and can act as standalone units accessible online. To host these capabilities, MFDs have their own embedded operating systems as well as TCP/IP ports (Baker, 2012; Condon et al, 2011). Network devices offer additional capabilities, which include the sharing of printers by multiple users. In addition, storage facilities may be present where printed, scanned or copied data is stored onto the hard drive (Condon, Cummins, Cukier & Afoulki, 2011; Kassner, 2010). Usually, when several copies of a document are needed, the document is scanned once and copies are made of the file saved on the hard disk of the device.

These features are very useful in an office environment, but can pose major security threats if not protected. In general, the security risks on networked MFDs can be divided into four areas: unclaimed output; unauthorised access to print, scan, email and copy...