Embedded Security

Our copier rep was on-site today to discuss some printing oddness. As long as he was there I gave him a hard time about the copier still running an NT4 print server. This copier once had the distinction of being the most insecure thing in the entire enterprise. In fact it lapped the field with a blank administrator password and the lack of patches.
The copier rep commented that all the copiers were coming with Linux now days for security.
Oh you mean like the Toshiba copiers we used to have that ran Linux, but had every service running. The one with the unused FTP server that could be exploited to get root privileges?
To be true the appliances that are running Linux now days are a bit smarter than that copier from a few years ago. Like Windows XP SP2, by default the Operating System is protected by a firewall. That should take care of most of the vulnerabilties.
The copier rep wasn’t being dishonest. He’s just repeating what he had heard. Linux is secure, Linux is secure. Then faced with reality, they mutter something about “well, its less patches than Microsoft. Of course when the vendor never comes out to install any patches, what does it matter how many critical patches are missing. Let the firewall protect from remote attacks.
The I suspect the real reason for the copiers with Linux print server boards is cost rather than security.