LetterAgent
Mail physical letters by just asking your AI assistant.
Home > Guides > Can Fax Machines Be Hacked
Yes. In 2018, security researchers demonstrated that a specially crafted fax image could take over a network-connected all-in-one printer, then use it as a stepping stone into the office network. Fax machines are rarely patched and always on, which makes them a real, documented target rather than a theoretical one.
Faxploit is the name researchers at Check Point gave to the attack they demonstrated in 2018 against a widely sold HP all-in-one printer with fax. Here is how it worked: the attacker sent a fax containing a maliciously crafted image. The printer's fax software decoded that image in its own memory, and the decoding step contained a bug. That bug let the attacker run their own code on the printer. Because the printer sat on the office network, the attacker could then reach other computers on that network. The fax line, an input nobody monitors, became a doorway into the building.
What made this genuinely alarming was the attack surface. You cannot screen incoming faxes the way you screen email: the machine answers automatically, decodes whatever arrives, and needs no click from anyone. A fax number is public by design, so anyone can dial it and send an image. The researchers showed the same class of bug existed across the fax-handling code of multiple vendors, not just one model.
| Weakness | Why it matters |
|---|---|
| Never patched | Firmware updates on printers are rare, and nobody schedules them. A five-year-old fax machine runs five-year-old code. |
| Always on and always answering | The machine picks up and decodes images automatically, so an attacker never needs a user to click anything. |
| Trusted on the network | Printers usually sit on the same office network as everything else, with no firewall between them and file servers. |
| Stores old faxes | Many machines keep copies of sent and received faxes in memory, so a compromised machine hands over its history too. |
Receiving is the riskier direction. Sending a fax means your machine decodes nothing; the other end does. Receiving means your machine accepts and decodes an image from a stranger, automatically. If you run an old fax machine or an old all-in-one on your home network and receive faxes from unknown senders, you are holding the more exposed end of the line.
Online fax services change the equation because there is no machine on your network doing the decoding. You upload a document or send it through an app, the provider's servers handle the fax protocol, and nothing ever answers a phone line in your office. Your network never touches the raw fax image. This does not make the provider invulnerable, but it removes the specific risk of a compromised machine sitting inside your network, which is what Faxploit exploited.
If you still keep one, treat it like the networked computer it is. Install firmware updates when the manufacturer releases them. Put the printer on a separate guest or IoT network so a compromised machine cannot reach your computers and file storage. And ask whether you still need the machine at all: every year the list of things that truly require a physical fax line gets shorter. LetterAgent's fax flow, currently in testing, sidesteps the hardware entirely: you describe the fax to your AI assistant, approve the exact quoted price, pay once through Stripe, and it is sent to US and Canadian fax numbers only, with no machine on your network. Pricing is quoted up front and you approve the exact price before anything is sent. Fax is currently in testing, so treat it as available in testing, not as a guaranteed send.
Ready to fax it? Fax with LetterAgent: describe it to your AI assistant, approve the exact quoted price, and it is sent.
LetterAgent is a working name. Prices include print, postage, and our service fee. US prices in USD, Canadian prices in CAD (Canadian prices exclude applicable sales tax, added at checkout). Currently in private testing.
Need help? Ask your assistant: it can check a job's status any time. If it ever can't handle something: hello@getletteragent.com