Security researchers have found a way to remotely execute code on a fax machine by sending a specially crafted document to it. So… who cares about fax? Well apparently a lot of persons are still using it in many institutions, governments and industries, including the healthcare industry, legal, banking and commercial. Bureaucracy and old procedures tend to die hard.
This is one of those exploits that deserve proper attention, for many reasons. It is well documented and is a great piece of proper old school hacking and reverse engineering. [Eyal Itkin], [Yannay Livneh] and [Yaniv Balmas] show us their process in a nicely done article that you can read here. If you are into security hacks, it’s really worth reading and also worth watching the DEFCON video. They focused their attention in a all-in-one printer/scanner/fax and the results were as good as it gets.
Our research set out to ask what would happen if an attacker, with merely a phone line at his disposal and equipped with nothing more than his target`s fax number, was able to attack an all-in-one printer by sending a malicious fax to it.
In fact, we found several critical vulnerabilities in all-in-one printers which allowed us to ‘faxploit’ the all-in-one printer and take complete control over it by sending a maliciously crafted fax.
As the researchers note, once an all-in-one printer has been compromised, it could be used to a wide array of malicious activity, from infiltrating the internal network, to stealing printed documents even to mining Bitcoin. In theory they could even produce a fax worm, replicating via the phone line.
The attack summary video is bellow, demonstrating an exploit that allows an attacker to pivot into an internal network and taking over a Windows machine using Eternal Blue NSA exploit.
Do you remember the screeching of a dial-up modem as it connected to the internet? Do you miss it? Probably not, but [Erick Truter] — inspired by a forum post and a few suggestions later — turned a classic modem into a 3G Wi-Fi hotspot with the ubiquitous Raspberry Pi Zero.
Sourcing an old USRobotics USB modem — allegedly in ‘working’ condition — he proceeded to strip the modem board of many of its components to make room for the new electronic guts. [Truter] found that for him the Raspberry Pi Zero W struggled to maintain a reliable network, and so went with a standard Pi Zero and a USB Wi-Fi dongle dongle. He also dismantled a USB hub to compensate for the Zero’s single port. Now, to rebuild the modem — better, faster, and for the 21st century.
If you tell someone these days to send you something via FAX, you are likely to get a look similar to the one you’d get if you asked them to park your horse. But in 1984, FAX was a mysterious new technology (well, actually, it wasn’t, but it wasn’t yet common to most people).
FedEx–the people who got famous delivering packages overnight–made a bold move to seize a new market: Zapmail (not to be confused with the modern mass mailing service). The idea was simple (you can see a commercial for it in grainy VHS splendor, below): Overnight is great but sometimes you need something sent across the country now. A FedEx driver picks up your documents, carries them to a FedEx office. There the documents FAX to another FedEx office where another driver delivers the printed copy. The process took two hours to get a paper document from one side of the continent to another.
By 2016, it is evident the FAX machine has peaked. Sure, you still see a few. There are even services that will let you send and receive FAXes via Internet–which could mean no FAX machine was involved at all. But looking back, you have to wonder where it all started. Most people had never seen a FAX machine until the late 1960s or early 1970s. It was 1980 before there was a standard. Some, like hams and weather service employees, were using them even earlier. But would it surprise you to know that the first experimental FAX machine appeared in 1843?
Wait a minute. Bell didn’t even build a telephone until 1875 (the patent issued in 1876). Turns out the first FAX machines didn’t work with a phone. They worked over a telegraph wire.
Legendary electrical engineer and linear IC trailblazer Bob Widlar was just like you. What I mean is that he would use everything available to him to mock up circuits, create prototypes, and make things work. One of the simplest and coolest tools he used was a conductive paper called Teledeltos. This wonderful stuff allowed him to define and test various configurations for the oddly-shaped ballast resistors he used in some of his high-performance circuit designs. But it wasn’t created for people like you and Bob. Teledeltos paper was created and trademarked by communications giant Western Union to drastically improve the convenience of telegrams.
Development of the electric telegraph ushered in the era of global communication. Suddenly, people could send messages to the other side of the world in a fraction of the time it took by post. The telegraph absolutely revolutionized human communication. It was the e-mail and the Twitter of its time. The telegraph’s efficiency made the Pony Express pretty much obsolete by the 1860s. And for a very long time it was much cheaper for people to send a telegram than make a long-distance phone call.
The Advantages of Facsimile
Translated from ancient Greek, ‘teledeltos’ basically means writing tablet at a distance. Western Union began developing Teledeltos paper in the 1930s for the purpose of transmitting telegrams by facsimile, a method that would greatly reduce the time it took to input messages into the system and get them out on the other side. As long as both the sender and the receiver had facsimile machines, a handwritten telegram could be transmitted without having to be typed by a clerk or translated into code. Teledeltos paper was also used in a variety of chart recorders, like seismographs and map plotters. The ability to feed a handwritten message, a photograph, or a map of enemy territory into a machine that transmitted an exact copy was a real game changer.
Because of its composition, Teledeltos paper could be easily marked without an electrolyte. It marked so well that photographs and other graphic information could be transmitted, and no processing was required on the receiving end. A dry recording paper is also much less sensitive to light and to temperature extremes. More importantly, properly stored dry paper is impervious to fungal growth. Teledeltos paper could sit around indefinitely without becoming useless. The only real disadvantage to this type of paper was the somewhat laborious process that went into achieving the desired resistance. Fax machines eventually moved on to digital transmission and thermal printing technology.
Sparking a Revolution
Teledeltos paper has a light gray electro-sensitive coating on one side, and the other side is carbon black. When a current is applied with a stylus to the coated side of the paper, the coating is instantly burned away, revealing the carbon black. Teledeltos paper could be marked using either AC or DC. Polarity didn’t matter, either, but the boys in the lab at Western Union had better luck when they used a positive stylus with DC rather than a negative one.
Teledeltos paper was made in two types—“L” for low resistance and “H” for high. The resistivity of a roll of Teledeltos paper depended on the quality of the conductive fibers that went into it. The paper’s electrical characteristics were also influenced by the fiber beating process and the distribution of the conductive fibers by the supercalender, a system of hard rollers used in papermaking and other processes that press and smooth paper and other materials to increase the density.
Teledeltos to the Rescue
Western Union was eager to extend its reach into private businesses and public places so that patrons who weren’t heavy telegram users didn’t have to visit a telegram office in order to share a bit of good news or to send their condolences. The company’s Telefax division came up with several types of machines to serve different business needs.
Some messages continued to be delivered by hand, but they weren’t printed at the central office. Western Union created a Telecar service to print telegrams transmitted to the car by the central office and deliver them to people’s homes. Messages were printed onto recording blanks that were cut automatically by a Telefax recorder situated in the car’s passenger area. The Telecar’s radio and amplification equipment was in the trunk.
The standard Telefax machine for office use was fairly large, like an early microwave oven. A smaller version called the DeskFax was only about the size of a breadbox, and these units occupied the desks of many businessmen and secretaries because of their convenience.
Both the Telefax and the DeskFax scanned and recorded telegrams using a rotary drum mechanism. A message could either be typed or handwritten onto a telegram blank. The sender then wrapped the telegram around a drum and set the machine to send. The machine would scan the message optically and then transmit it to the central office.
Before sending it on to the recipient, an attendant at the telegram office had to remove the incoming message and wrap it around the drum of a transmitting machine. Once connected to the receiving party’s line, the far end unit would buzz to arouse attention. The receiving patron would then load a blank on to their DeskFax’s roller and set their machine to receive.
Teledeltos for Hacking and Education
Conductive paper like Teledeltos has many applications aside from fax machines and Fathometers. For starters, it’s great for making one-offs of both standard and variable resistors. Conductive paint can be used as connection points for wires. The paper is also well-suited for simulating current flow through circuits using a fraction of the current intended in production. Vacuum tube designers used Teledeltos for modeling potentials. Teledeltos can also be used to visualize electromagnetic potentials and perform field plotting.
We’re sure that at least a few of our readers out there used Teledeltos or something like it in school or on the job. Did you know you can still buy it? Teledeltos paper itself is still available from two companies in the UK, Better Equipped and Timstar. In the US, you can get it from Pasco in packs of 50 and 100 sheets, with and without a grid pattern.
[Dmitry] is a Moscow based artist. He’s also a an avid circuit bender and hardware hacker. His latest project is entitled “signes de vie” or signs of life. [Dmitry] started with an Arduino and an old thermal fax machine. He removed the thermal print head and replaced it with a row of 10 LEDs. These old fax machines would use rolls of paper, cutting each sheet of as it was printed. [Dmitry] kept the roll system, but treated his paper with fluorescent dye. As the paper passes under the LEDs, it pauses for a moment and the LEDs are flashed. This causes a ghostly glow to remain on the paper for several minutes as the next rows are printed.
While [Dmitry] could have made this the world’s biggest tweet printer, he chose to go a more mathematical route. Each printed row of dots represents a generation of one-dimensional cellular automata. Cellular automation is a mathematical model of generations of cells. All cells exist on a grid, and can be alive or dead. The number of neighboring live cells determines if any given cell will live on to the next generation. One common implementation of cellular automation is Conway’s Game of Life. In [Dmitry’s] implementation, a bank of switches select which of the 256 common cellular automata rules controls the colony. A second bank selects how long each generation lasts – from 1 to 18 seconds.
We really like how the paper becomes a printed, yet temporary history of the colony. [Dmitry] doesn’t say if he’s using a single long strip of paper, or if he created a loop. We’re hoping for the latter. Finally a useful implementation of the old black fax loop prank.
Internet blocked at your office and feel like you’re just not getting your fix of Nyan Cat? Don’t worry, you can now use the fax machine to get your fix. [Tom Scott] put together the project to our delight, which will work best if you can find one of those fax machines that uses the continuous roll of paper. But as you can see above, individual sheets will work too. The best part is that Nyan Fax is live for callers from the UK and internationally!
The hack is using something called ‘fax polling’. It allows the sender to set up an on-demand server where any caller will be sent a queue of documents. In this case [Tom] crafted a Nyan Cat document that never ends… you’ll need to disconnect the phone line or pull the pug to stop the printing. See for yourself in the clip after the break. If you’re interested in setting up your own it can be done with the mgetty and sendfax packages on a Linux box.