Image credit: billiondigital/ depositphotos. You can find out more about the research on the F-Secure site, HP has a security advisory with information firmware patching, and there's also a best practice guide for securing FutureSmart products.

Tomi Tuominen and Timo Hirvonen, both researchers at cybersecurity firm F-Secure, have discovered a security flaw in the most popular manufacturer line of digital hotel locks. F-Secure researchers unlock a hotel door using their device in a YouTube video.

F-Secure advises users to take other steps including limiting physical access to MFPs and segregating them in a separate, firewalled VLAN. Worlds most popular hotel door lock vulnerable to hackers. HP has now published firmware updates and security advisories for the affected devices. Helsinki, Finland.30 November 2021 HP Inc. Experienced threat actors see unsecured devices as opportunities, so organizations that don't prioritize securing their MFPs like other endpoints leave themselves exposed to attacks like the ones documented in our research,' says F-Secure security consultant Timo Hirvonen. F-Secure discovers vulnerabilities affecting over 150 HP printer models. And just like other endpoints, attackers can leverage a compromised device to damage an organizations infrastructure and operations. 'It's easy to forget that modern MFPs are fully-functional computers that threat actors can compromise just like other workstations and endpoints. Attackers could also then use compromised MFPs as a beachhead to penetrate further into an organization's network.

Their research demonstrates how these can be exploited to gain control of the device software, steal documents, and move laterally through the targets network infrastructure. This includes not only documents that are printed, scanned, or faxed, but also information like passwords and login credentials that connect the device to the rest of the network. Earlier this year, F-Secure security consultants Alexander Bolshev and Timo Hirvonen discovered multiple vulnerabilites in HP multi-function printers (MFPs). This would allow attackers to steal any information going through the MFP. The website would, automatically, remotely print a document containing a maliciously-crafted font on the vulnerable MFP, giving the attacker code execution rights on the device. Attackers could trick a user from a targeted organization into visiting a malicious website, exposing the organization's vulnerable MFP to what's known as a cross-site printing attack.

Timo hirvonen f secure