Potential Effects of Getting Hacked - open discussion
With all of the back and forth about Bambu’s security update, I’ve noticed a lot of people may not be considering the full potential of a hacked 3D printer living on their network.
I just want to throw out some concepts and have a discussion, so that we can explore what the real impact could be.
To give you a little background on myself, I’ve been in the IT and software industry for over 20 years. I’ve worked for communications companies in network engineering, software development for desktop, and mobile, cloud infrastructure API development, cloud automation and I am currently an engineer at a major company (I won’t be more specific for personal security reasons). Needless to say I know a couple things about network and device security.
——
Consider for a moment that your 3D printer isn’t a 3D printer from the perspective of a hacker but in fact just another device to be exploited. Consider the device as a sum of its parts, its security (or lack thereof) and its level of access to the rest of your network. This group of attributes is often called an “attack surface”.
Consider also that some of the critical parts of your 3D printer include storage, network connectivity and the ability to execute code, not unlike your PC.
As a hacker I would only need to be able to access your printer, store my code and execute my code to achieve my goal, which is most likely not arbitrarily printing yet another plastic dragon that you never intended to, as a prank.
No, more likely I have targeted the weak link in your network to install a botnet, or other malware which could be leveraged for one of many nefarious activities including:
* Installing malicious code on any/all devices connected to your network like * your phone * Apple TV or Roku * your TV itself * your smart devices - like you’re new refrigerator * and of course any computer connected to that network * collection of personal data from those devices * monitoring your devices using that malicious code even when you leave the house * distributing that code to other devices across the internet
The possibilities are endless, really, but the point is that a vulnerable target isn’t about the target or controlling what it is *intended* to do, it’s about leveraging its resources for malicious activity.
I wanted to share this to put it in perspective for less technical users who may not have prior knowledge and to start the discussion.
What are your thoughts on this?
(Don’t be a jerk, this is just a discussion intended to expand our thinking and open minds.)