Sign in to follow this  
Followers 0
duper

Hax0ring Fax Machine Firmware

2 posts in this topic

I was thinking about an interesting attack vector today. Most fax machines are capable of receiving TIFF files. Let's say for example that I dial-up a fax machine and send a malformed TIFF file down the line that causes an overflow in the parser on the firmware. :ninja: How exactly could I debug this in order to develop a TIFF/PDF file that contained an exploit payload to execute arbitrary code? What OS do they run? I'm guessing VxWorks but I have no idea. I'd expect everything to run in ring 0. Anybody know? :roll:

0

Share this post


Link to post
Share on other sites
I was thinking about an interesting attack vector today. Most fax machines are capable of receiving TIFF files. Let's say for example that I dial-up a fax machine and send a malformed TIFF file down the line that causes an overflow in the parser on the firmware. :ninja: How exactly could I debug this in order to develop a TIFF/PDF file that contained an exploit payload to execute arbitrary code? What OS do they run? I'm guessing VxWorks but I have no idea. I'd expect everything to run in ring 0. Anybody know? :roll:

Every fax machine is different obviously, some are more sophisticated then others... you would need to do vendor/model specific research and plan the appropriate "attack vector".

This means, obtain an identical model.. attempt to dump any (E)EPROM's.. figure out the architecture used. (It very well could be a in house ASIC design, custom architecture.. embedded OS.).

Until you have a chance to disassemble the routines you're interested in "exploiting", you're most definitely flying blind... you'll have to reverse engineer the hardware before the software. ;)

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0