IT Baseline Protection Manual - The Information Warfare Site

Threats Catalogue Deliberate Acts Remarks
____________________________________________________________________ .........................................
T 5.32 Evaluation of residual information in fax
machines and fax servers
Fax machines
Depending on the technology a fax machine uses to store, process and print
information, it may contain varying amounts of residual information after
receiving a fax message. This information can be reconstructed by persons
having access to the fax machine or the relevant components.
In the case of fax machines which use thermo-transfer techniques, incoming
fax messages are first written onto an intermediate foil, which is then used to
print the information. This foil is a consumable and must be replaced
regularly; it is therefore designed to be easily removable. If an unauthorised
person gains possession of this foil (by theft or on disposal) he will be able to
reproduce the contents with a minimum of technical effort. Thus he would be
able to view several hundred pages' worth of information.
Most fax machines have an intermediate memory (document memory, buffer)
in which outgoing faxes can be read until they have been successfully sent and
incoming faxes can be stored temporarily until they have been printed.
Depending on the fax machine, this memory can contain a large number of fax
pages which can usually be printed by anyone who has access to the fax
machine.
Fax server
Fax servers are applications installed on IT systems which are generally fitted
with at least one hard disk or can access a disk drive over the network. Fax
transmissions are stored on this until they can be delivered to the recipient.
Modern operating systems also work with swap files which, too, can contain
residual information. There is a danger here that this information can be
evaluated without permission when this fax server is accessed. For example, if
a hard disk fails during the warranty period, it has to be returned to the dealer
or manufacture in order to make a claim under the warranty. However, the
hard disk could still contain data to which unauthorised persons could in this
way obtain access. If the hard disk is faulty, it is often not possible to delete
the data using software tools.
If a workstation or the fax software installed on it is not adequately protected,
it is possible to access fax data on the fax client without authorisation.
Information can also be read by unauthorised persons through access to the
workstation's hard disk.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Thermo-transfer printers
Intermediate data
storage in the fax
machine
Residual information on
hard disks
Inadequate protection of
main memory