Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!uwm.edu!rpi!brutus.cs.uiuc.edu!jarthur!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: ras@rayssdb.ssd.ray.com (Ralph A. Shaw)
Newsgroups: comp.virus
Subject: Re: Virus Trends (and FAXes on PCs)
Message-ID: <0002.9001051609.AA06289@ge.sei.cmu.edu>
Date: 4 Jan 90 17:40:26 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 28
Approved: krvw@sei.cmu.edu

Nagle@cup.portal.com says:

>     - A FAX message is a bitstream interpreted by an interpreter at
>       the receving end.  Could it be induced to do something interesting
>       through the use of illegal bit patterns?  Group III is probably too
>       simple to be attacked, but group IV?  Imagine a message which
>       causes a FAX machine to send an extra copy of transmitted documents
>       to another location.

Something that has come to the attention of security paranoids here
lately is that some manufacturers of PC FAX boards have added a
feature that allows the FAX modem to be used as a bisync modem to
communicate with the PC directly, rather than transmitting just FAXes.

I assume the PC would have to be running some software to enable it
and reassign the console (requiring local intervention), but a
networked PC could then prove to be a leak onto the corporate network,
(or at least, for handy distribution of the Trojan-of-the-month program).
Added to this is the promise that at least one FAXboard vendor
promises that both async and bisync modem capability will be available
in the future.

I don't have the details of which boards provide this "feature",
or of what functionality is really there via this inboard modem
and accompanying software, but will pass on any other details I can
ferret out.
- --
Ralph Shaw			ras@rayssd.ray.com