FAXAGE Responds to Faxploit Vulnerability Report
- FAXAGE Blog Home
- Introducing FAXAGE System Status Monitoring
- Cost-Saving Strategies: How Online Faxing Reduces Overhead Expenses
- 50 Experts Weigh In: Entrepreneurs on HIPAA-Compliant Faxing
- HIPAA Compliant Faxing: Experts Weigh In On Why It Matters
- How to Send a Fax Without a Fax Machine
- Mobile Faxing: How Do I Fax From My Phone?
- Top Features to Look for in an Online Fax Service
- The Millenial/Gen Z Guide to Faxing
- Faxing in a Hybrid or Remote Work Environment
- The Environmental Impact of Online Faxing
- FAXAGE Adds SSL Fax Capability
- FAXAGE Earns HITRUST Certification
- How Different Industries Use Online Fax
- FAXAGE App Released
- COVID-19 & Cloud Faxing
- FAXAGE Reviewed by FitSmallBusiness
- FAXAGE Adds SSO
- Faxploit Information
- Security Auditing Added
- Ottawa fax numbers added
- Vancouver fax numbers added
- London fax numbers added
- Hamilton fax numbers added
- Toronto fax numbers added
- Alaska fax numbers added
- Enhanced fax spam blocking features
- Toll Free Fax Numbers in 844 Released
- Secure Email to Fax with Thunderbird
- Toll Free 844 Coming Soon
- Free Software - FAXAGE Staff Member Picks
- Scan to Fax Tips
On August 13, 2018, Checkpoint Research, a security research firm, released information regarding a vulnerability in HP's all-in-one fax machines and possibly other fax device implementations.
The original research write-up can be found at the link below and has been picked up by several press outlets as well:
Faxploit Link
Specifically, the vulnerability relates to how some implementations of color fax capabilities may be vulnerable to remote code execution via exploiting problems in their image parsing for color JPEG faxes.
The published findings further state that they were unable to find any vulnerabilities that could be exploited related to black and white faxing and the compression schemes used with TIFFs in faxing, noting 'We checked the decompression code for T.4 and T.6 and couldn't find any interesting vulnerabilities there.'
FAXAGE has evaluated the available information from Checkpoint Research and has determined that this vulnerability does not apply to our services. This is the case because FAXAGE offers only black and white faxing, and, thus does not offer the vector required for the exploit.
While we leave opinions to the mind of the reader, we would like to point out for the benefit of all that the way in which this has been portrayed, both by the researcher and by the press in picking it up, is as a general exploit for taking over networks via any network connected fax device. This is simply not the case. A color fax device with specific problems in its color parsing implementation is required.
Our view is that the vulnerability is being characterized as much more widely applicable than it actually is and that critical details are unfortunately being obscured. We hope that this post helps to debunk some of the sensationalism and give a more balanced view of what this vulnerability actually entails.
Happy safe faxing!
The original research write-up can be found at the link below and has been picked up by several press outlets as well:
Faxploit Link
Specifically, the vulnerability relates to how some implementations of color fax capabilities may be vulnerable to remote code execution via exploiting problems in their image parsing for color JPEG faxes.
The published findings further state that they were unable to find any vulnerabilities that could be exploited related to black and white faxing and the compression schemes used with TIFFs in faxing, noting 'We checked the decompression code for T.4 and T.6 and couldn't find any interesting vulnerabilities there.'
FAXAGE has evaluated the available information from Checkpoint Research and has determined that this vulnerability does not apply to our services. This is the case because FAXAGE offers only black and white faxing, and, thus does not offer the vector required for the exploit.
While we leave opinions to the mind of the reader, we would like to point out for the benefit of all that the way in which this has been portrayed, both by the researcher and by the press in picking it up, is as a general exploit for taking over networks via any network connected fax device. This is simply not the case. A color fax device with specific problems in its color parsing implementation is required.
Our view is that the vulnerability is being characterized as much more widely applicable than it actually is and that critical details are unfortunately being obscured. We hope that this post helps to debunk some of the sensationalism and give a more balanced view of what this vulnerability actually entails.
Happy safe faxing!
FAXAGE® is a registered trademark of EC Data Systems, Inc.
© Copyright 2004-2024 EC Data Systems, Inc. all rights reserved