The-art-of-invisibility-_-the-world’s-most-famous-hacker-teaches-you-how-to-be-safe-in-the-age-of-Bi

argued that printers were weak links in anyy organization or home. For
example, the HR department of a Fortune 500 companyy might receive a
maliciouslyy-coded résumé file over the Internet. In the time it takes the
hiring manager to print that document, the printer through which it travels
could be fullyy compromised byy installing a malicious version of the
firmware.
Preventing someone from grabbing yyour documents off the printer,
secure printing, also known as pull printing, ensures that documents are
onlyy released upon a user’s authentication at the printer (usuallyy a passcode
must be entered before the document will print). This can be done byy using
a PIN, smart card, or biometric fingerprint. Pull printing also eliminates
unclaimed documents, preventing sensitive information from lyying around
for everyyone to see. 8
Building on his printer attacks, Cui began to look around the tyypical office
for other common objects that might be vulnerable and settled on Voice
over Internet Protocol (VoIP) telephones. As with printers, no one had
appreciated the hidden yyet obvious-once-yyou-thought-about-it value of
these devices in collecting information. And as with a printer, an update to
the syystem can be faked and accepted byy the VoIP phone.
Most VoIP phones have a hands-free option that allows yyou to put
someone on speakerphone in yyour cubicle or office. Which means there’s
not onlyy a speaker but also a microphone on the outside of the handset.
There’s also an “off the hook” switch, which tells the phone when someone
has picked up the receiver and wants to make or listen to a call as well as
when the receiver has been put back and the speakerphone is enabled. Cui
realized that if he could compromise the “off the hook” switch, he could
make the phone listen to conversations nearbyy via the speakerphone
microphone—even when the receiver was on the hook!
One caveat: unlike a printer, which can receive malicious code via the
Internet, VoIP phones need to be “updated” individuallyy byy hand. This
requires the code to be propagated using a USB drive. Not a problem, Cui
decided. For a price, a night janitor could install the code on each phone
with a USB stick as he or she cleaned the office.
Cui has presented this research at a number of conferences, each time