And Now They've Come For Your Printer

According to Information Week, "spammers have a new way to vex computer users: printer hijacking."

Building on the concept of cross-site scripting, whereby an attacker can
inject malicious code in Web pages viewed by others, security researcher Aaron
Weaver has demonstrated how an attacker can inject spam messages into a Web site visitor's printer.

Weaver's research is available in a paper published online. It describes
how the attack could be initiated by creating a hidden iframe -- a block of code
inserted into a Web page and often served from a different domain than the Web
page -- and a Web form that submits the spam message to the printer. An attacker
could also send the spam message as a fax, if the printer has fax capabilities.

"The end result is that by visiting a Web site on the Internet you could
end up sending printer spam to your printer without even knowing that anything
happened," Weaver explains in his paper. "Since most printers don't have any
security set, it is possible to print anything, control the printer, change the
print settings, and even send faxes."

Oh, good grief.