RE: Vulnerability testing in analog modem

[jfvanmeter () comcast net]

Hello Craig, A "fax machine" usually consists of an image scanner, a modem, and a printer combined into a single 
package. 

I seam to remember back in the late 90s, there was a way to gain tech support remote access to the modem via the Hayes 
Modem AT strings. It was something similar to the &T command. Maybe it twas &T2

&Tn - Test and diagnostics; 0=End current test; 1=Start local analog loop back test; 2=Unknown; 3=Start local digital 
loop back test 4=Grant remote request for remote digital loop back test; 5=Deny remote request for remote digital loop 
back test; 6=Start remote digital loop back test; 7=Start remote digital loop back test with self-test; 8=Start local 
analog loop back test with self-test.

Take Care and Have Fun --John


 -------------- Original message ----------------------
From: "Craig Wright" <Craig.Wright () bdo com au>
> As for point 1 - what is there to try. A fax is not a modem. There is no
> known (even in theory) attack against a fax to gain access.
>
> Regards,
> Craig Wright (GSE-Compliance)
>
>
>
> Craig Wright
> Manager of Information Systems
>
> Direct : +61 2 9286 5497
> Craig.Wright () bdo com au
> +61 417 683 914
>
> BDO Kendalls (NSW)
> Level 19, 2 Market Street Sydney NSW 2000
> GPO BOX 2551 Sydney NSW 2001
> Fax +61 2 9993 9497
> www.bdo.com.au
>
> Liability limited by a scheme approved under Professional Standards Legislation 
> in respect of matters arising within those States and Territories of Australia 
> where such legislation exists.
>
> The information in this email and any attachments is confidential.  If you are 
> not the named addressee you must not read, print, copy, distribute, or use in 
> any way this transmission or any information it contains.  If you have received 
> this message in error, please notify the sender by return email, destroy all 
> copies and delete it from your system. 
>
> Any views expressed in this message are those of the individual sender and not 
> necessarily endorsed by BDO Kendalls.  You may not rely on this message as 
> advice unless subsequently confirmed by fax or letter signed by a Partner or 
> Director of BDO Kendalls.  It is your responsibility to scan this communication 
> and any files attached for computer viruses and other defects.  BDO Kendalls 
> does not accept liability for any loss or damage however caused which may result 
> from this communication or any files attached.  A full version of the BDO 
> Kendalls disclaimer, and our Privacy statement, can be found on the BDO Kendalls 
> website at http://www.bdo.com.au or by emailing administrator () bdo com au.
>
> BDO Kendalls is a national association of separate partnerships and entities.
>
> -----Original Message-----
>
> From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
> On Behalf Of jfvanmeter () comcast net
> Sent: Tuesday, 30 October 2007 3:21 AM
> To: rohnskii () gmail com; security-basics () securityfocus com
> Subject: Re: Vulnerability testing in analog modem
>
> I had a similar pen test, it was on a xerox docucentra, I had several
> concerns with the multifunction printer
>
> 1. there was/is no auditing of the fax connection, so I could try and
> try and no one would never know about the attack.
> 2. the printer also had a web server, so I copied some test file to the
> hd and set up my very own web site.
>
> i believe it is possible to break out of the modem connection, via some
> type of diagnotic route and get access to the network.
>
> I recommend that to my client that they configure the phone jack for
> outgoing calls only., turn off the web server, set passwords, etc. 
>
> I would be interested in hearing anyones thoughts about this. I have a
> test coming up for a client on a multi function printer
>
> Take Care and Have Fun --John
>
>  -------------- Original message ----------------------
> From: rohnskii () gmail com
> > I don't know about connecting through the fax to the network but there
> is 
> > another security concern to think about.
> >
> >
> > Fax machines, and printers, that have an internal HD for document
> storage can be 
> > a security concern.  When the machine is sent out for servicing or
> retired there 
> > may be retrievable document images with confidential information on
> them.