Then Whitman hedged: “Let me put it that way. I would say these are going to be more acquisitions, in the sub-$500 million range would be my guess. We might get to $1 billion, but I doubt it.”

Now we know what she meant by that. Overnight, HP said it will acquire Hiflex Software, a German maker of printing management software. The deal is small enough that terms haven’t been disclosed, and that makes it hard to analyze.

Hiflex is based in Aachen and specializes in supplying print services to the commercial printing and graphics industry. Launched in 1991, it has completed some 300 customer projects, and its products are generally used to help different parts of a printing operation work together.

Vyomesh Joshi, HP’s executive vice president and the head of its Imaging and Printing group, described the deal like so: “HP wants to break the traditional barriers of how and where business customers print, making it easy for them to produce custom or personalized materials anywhere, anytime … Hiflex’s technology provides a powerful platform to deliver on this goal as part of our overall cloud printing strategy.”

Brian Marshall, an analyst with ISI Group, said in a note to clients this morning that he thinks it’s a “small deal,” but one that amounts to “an inexpensive way for HP to build exposure to cloud services that integrate with existing HP assets,” like printing.

If HP is going to be acquisitive at all during 2012, the deals are going to look like this. Now, at least, we know what to expect. And, as Whitman sets expectations, so far she’s sticking to what she says, which is a good sign.

Printers are Internet-connected devices just like computers. They have their own operating systems and software, and so, in theory, are vulnerable to attacks by hackers just as computers are. There was an old urban myth that in the run-up to the first Iraq War in 1991, hacked HP printers shipped to Iraq were instrumental in shutting down Iraqi radar systems. It wasn’t true — it was published on April 1 of that year by the trade magazine InfoWorld — but the idea stuck, and at least one group of security researchers has been studying the use of Trojans installed into printers.

The Columbia researchers had claimed that a part inside a printer called a fuser, used to dry the ink, could be remotely instructed to overheat, eventually causing paper inside the printer to turn brown and start to smoke.

Conceptually it’s not that different from the Stuxnet attack against the Iranian nuclear research program. The attackers in that case, thought to be Israel with a little help from the U.S., attacked industrial control computers known as SCADA systems that serve as the bridge between typical Windows-based machines and industrial equipment that the SCADA systems control. In the case of Stuxnet, the SCADA systems were controlled — often they have only default passwords or no passwords at all — and the machines they were connected to could be instructed to literally destroy themselves.

Some researchers at the U.S. Department of Energy’s Idaho National Lab did just that in the video below, showing in a controlled environment that a generator could be hijacked over the Internet and made to destroy itself.

But could you do the same thing with a printer? Theoretically, I’d say it’s possible. But in this case, HP says not where its printers are concerned.

Below is an internal HP memo from Vyomesh “VJ” Joshi, the head of HP’s Imaging and Printing Group, that was circulated to employees today.

First off, he says, the fire issue is not true. As noted in the public statement, HP’s printers have a component called a thermal breaker that prevents the fuser from overheating, and it can’t be overcome by a firmware upgrade.

But Joshi also spanks the Columbia researchers for turning to the media and not calling HP first, which is the way security researchers usually operate when they identify a serious vulnerability. There is, he concedes, a vulnerability to malicious firmware modifications, especially on printers that are left unprotected on a network without a firewall running. HP aims to fix that. But usually in these situations, the media doesn’t get called until a fix is ready. “Unfortunately in this situation, a Columbia representative took it upon himself to contact the media and reports were published prior to a solution being available,” he writes.

Joshi’s full memo is below.

From: IPG, Vyomesh Joshi
Sent: Tuesday, November 29, 2011 4:40 PM
Subject: Inaccurate Printer Security Press Coverage

Dear IPG Employees,

As many of you have read today there has been sensational and inaccurate press coverage regarding potential security risks with some HP LaserJet printers. I wanted to make sure you had the most current information and context for this situation. No customer has reported unauthorized access. We have also seen speculation in the media regarding the potential for devices to catch fire due to a firmware change. This claim is inaccurate. We have issued a public statement communicating to customers and partners and refuting inaccurate information.

This information first came to us late last week from a research lab based at Columbia University. As a result, we have identified a specific vulnerability exists for some HP LaserJet devices if placed on a public internet without a firewall or if a malicious effort is made to modify the firmware of the device by a trusted party on the network. Our security team is taking immediate measures to build a firmware upgrade to resolve any potential risk and will be communicating this proactively to customers and partners who may be impacted.

Typically when a security issue is identified, responsible disclosure is followed so that vulnerabilities are not made public until a solution is available. Unfortunately in this situation, a Columbia representative took it upon himself to contact the media and reports were published prior to a solution being available.

We have always taken security very seriously. In fact, HP’s reputation for security continues to be among the highest in the industry. I want to assure you that our security experts are working around the clock to mitigate any potential risk.

We will make every effort to communicate new information as it becomes available.

Regards,

VJ

BoomTown’s got nothing, which is not something I like to say very much.

I am talking about the Yahoo CEO search, which is either being done by the Internet giant’s board in such elegant secrecy and with such amazing stealth that it is getting by everyone.

That or it’s business as usual for the Yahoo (YHOO) board, which so far has never met a challenge for the company it could not drag out painfully and with great public dithering.

I am hoping, of course, it is the former–that my crack sleuthing skills have been frozen solid here in Buffalo–and the choice will be announced to great fanfare by year’s end (which is, er, tomorrow).

But from reporting I have done over the last several days, the latter seems to be the case and Yahoo might not have a new leader in place for a few weeks at least.

Still, I vote for tomorrow!

But, if I had to make a prediction, Yahoo will pick an external candidate among the several candidates it is vetting now, given the time this has taken and also the need to show Wall Street, investors, their employees and the rest of us it intends to change.

In any case, if Yahoo cannot land someone by the end of January, many sources I spoke to expect the board to pick one of its own–most likely, former Nextel head John Chapple, a new director.

I have also heard that longtime Hewlett-Packard (HPQ) exec, Vyomesh (VJ) Joshi, who runs its massive imaging and printing group, is also a possibility, as well as others on the board.

When Yahoo CEO Jerry Yang announced he was stepping down in mid-November, sources I spoke to said the board was ready to act with urgency and boldness to get a leader in place to drag the company out of the doldrums.

It even made a little list, as I wrote in a post:

The board, though, has apparently made a list of six–I have no idea why that is the number chosen–clear criteria for the new leader of Yahoo.

The first is that the candidate have ‘extensive’ experience as the CEO of a public company. Another calls for media and advertising expertise. And mergers and acquisitions experience. Also strategic skills.”

While sources inside and outside the company say several candidates were considered and contacted, thus far there is no clear front-runner, as some–such as News Corp. (NWS) COO Peter Chernin and former Vodafone (VOD) CEO Arun Sarin–have discounted their interest so far. (News Corp. is the owner of this Web site.)

One response to my progress of the Yahoo CEO search from an insider was typical: “Not a peep. Oddly quiet.”

A major reason for the lack of swiftness might be Yang, who is very involved in the search along with Yahoo Chairman Roy Bostock (who might think twice about parking his chauffeured car with his name splashed on it somewhere else than in front of Yahoo, for all the emails I get about sightings of it).

Many sources said Yang is intent on getting the CEO choice just right, given so many other missteps made under his management.

“This is his last act and he is really serious about not making a bad choice,” said one exec who has talked to Yang.

That kind of consideration takes time, of course, even though many think that a bit of decisive speed might be a good thing to see from Yahoo right about now.

Still, with the holidays, as well as the weak economy, Yahoo is no Shangri-La for potential candidates.

In addition, Yahoo will wrap up a quarter this week that is sure to be especially weak, given all the internal and external turmoil.

“It is a very tough job and anyone worthwhile has to think long and hard before taking it,” said one person who has been contacted by Yahoo’s headhunter, Heidrick & Struggles, about interest in the No. 2 job at Yahoo, once a CEO is found.

This concept being bandied about is to put a new top team in place to replace Yang, and possibly President Sue Decker, who is the leading internal candidate for CEO.

Interestingly, a COO/President choice is perhaps the more interesting choice for Yahoo, since the field of candidates here widens considerably and has a lot more digital experience.

But first, of course, the CEO needs to be picked, and that’s still to come, delaying everything from doing a deal with Microsoft (MSFT) over search to buying Time Warner (TWX) online unit AOL, all of which are being pushed into 2009.

Well, only the Yahoo board knows for sure who that will be, although I am still digging away like a rabid gopher to find out more.

But here is a great music video of Val Emmich singing “(C’mon), Get On With It,” to spur the Yahoo board on: