In one demonstration, Columbia professor Salvatore Stolfo and colleague Ang Cui showed how a hijacked system could be sent commands that would overheat the printer’s fuser, causing the paper to brown, smoke, and sometimes even catch fire.
Every time a printer accepts a job, it checks for software updates. Since LaserJet printers manufactured before 2009 don’t verify the source of the update, nefarious hackers can easily intercept these requests and implant their own “updates” – a flaw that left security experts aghast.
“First of all, how the hell doesn’t HP have a signature or certificate indicating that new firmware is real firmware from HP?” said Mikko Hypponen, head of research at security firm F-Secure, when told of the flaw.
Way to go HP.