11 ms·
UK Teen Hacked 150,000 Printers
- patcheudor 10y agoHacking, IMHO is finding something cool about a thing & then taking that something and mixing it up. Make the thing do something never intended. In this particular case a kid found that he could print to printers which were connected to the Internet and then decided to start printing to printers using what amounts to a script. This isn't hacking. It's not novel. People connect printers to the Internet and he abused those connections. This is therefore a prank, not a hack.
- Dayshine 10y agoHacking is gaining unauthorized access to a system or computer...
- pavelmelnichuk 10y agoYour ellipsis suggests to are disagreeing with the original comment, else what you wrote is just a truism. The point of the original comment was that it was authorized by default as intended by design, and thus not a "hack."
- OJFord 10y agoI think Dayshine is disagreeing with the 'interesting' or 'novel' requirement of the top level comment.
- andai 10y agoThe design intended for random strangers to be able to print angry robots?
- patcheudor 10y agoYup. Sending a print-job to an open printing port isn't special and IMHO doesn't rise to be anything remotely close to "Hacking" or "Hacked". Everything is essentially working as designed, but just poorly implemented. It's similar to how DDoS isn't "Hacking".
- OJFord 10y agoIt's a well-overloaded term.
- eivarv 10y agoThere's some contention about the terms "hacking" and "cracking", as you might know.
- apocalypstyx 10y agoFor a large class of cases — though not for all — in which we employ the word meaning it can be explained thus: the meaning of a word is its use in the language. ---Ludwig Wittgenstein
- anewhnaccount 10y agoWriting and using a program not "using a script".
- pavel_lishin 10y agoNo True Scotsman would print funny things from a printer!
- pen2l 10y agoI apologize in advance for making a meta-comment. I hate news organizations using curse words. Don't get me wrong, using curse words is completely fucking fine, but it's weird in the worst way seeing news organizations using these words, they're supposed to carry a voice of impartiality. It's extremely unprofessional, and it seems overly emotional and petulant to use curse words. The Vice is absolutely one of the worse offenders of this.
- Alupis 10y ago> I hate news organizations using curse words. Don't get me wrong, using curse words is completely fucking fine, but it's weird in the worst way seeing news organizations using these words, they're supposed to carry a voice of impartiality While Vice does run some good content, calling them a news organization is hardly accurate.
- cr1895 10y agoThis criticism seems a bit misplaced levied against Vice. Their whole deal is edginess, defying the norms you think they should embody. Ignore them if you like, but it seems weird to say they should be fundamnentally something else. https://en.wikipedia.org/wiki/Vice_(magazine)#History https://en.wikipedia.org/wiki/Vice_(magazine)#History
- jwilk 10y agoGet we get "?utm_source=..." removed from the URL?
- OJFord 10y agoI wonder if there's a FF add-on that can strip query parameters by default on a cross-domain request?
- tbassetto 10y agoNot exactly what you are asking for but https://addons.mozilla.org/en-US/firefox/addon/au-revoir-utm/ https://addons.mozilla.org/en-US/firefox/addon/au-revoir-utm...
- jessaustin 10y agoI edited the bookmarklet: javascript:window.location="http://news.ycombinator.com/submitlink?u="+encodeURIComponent((document.location+'').replace(/.utm_.*$/,''))+"&t="+encodeURIComponent(document.title)
- jwilk 10y agoShouldn't you replace before URL-encoding?
- jessaustin 10y agoIt doesn't seem to matter. It's not as if "utm_" encodes to anything other than "utm_".
- jwilk 10y agoBut encoded "?" is "%3F".
- jessaustin 10y agoHmmm, I have seen an extra '%3' occasionally... it never hurt anything so I didn't bother fixing it. Thanks dude now I'm going to be totally tormented until I fix my bookmarklet. [EDIT:] ok moving that parenthesis and avoiding the update of document.location didn't take me too long...
- OJFord 10y agoThis deserves a better, less clickbaity (which I think has the opposite to intended affect with this audience) title. Particularly towards the end, s/he comes across extremely self-aware, and makes some salient points around the state of school CS education in the UK. It certainly resonated with my experience.
- dcole2929 10y agoI agree. It says a lot about society that someone who has clearly found his thing, due to some admittedly poor decision on his/her part, has basically zero options with which to pursue his interests in a controlled environment. I'm not from the UK so I will refrain from commenting on the state of their education system, but I've definitely seen this scenario play out here in the states. I'm not an educator but it's obvious that people are slipping through the cracks and that's something that should be deeply disturbing to most.
- noir_lord 10y ago> I'm not from the UK so I will refrain from commenting on the state of their education system. Fucked until Uni and not great then.
- vvanders 10y agoThat was actually the genesis around the Raspberry Pi. Eben Upton was really frustrated with the state of CS education in the UK(from what I recall it was mix of Excel and "computer skills"). The RPi was intended to be low cost computer that kids could hack on similar to what happened with the C64 back in the day.
- OJFord 10y agoYes, and not forgetting the micro:bit too. I'm glad it's being worked on, and I'm sure it will be better for those going through now - but if the subject of this post is in 'high school', s/he had none of that. We had 'ICT', in which we learnt to operate Microsoft products.
- atesti 10y agoHow is this possible? If random restaurants are able to assign a public IPV4 address to every POS printer they have, do they all have their own /24 net? Why wouldn't they all use NAT?
- tyingq 10y agoOne way this is done is exploiting routers that incorrectly allow upnp on their wan interface. http://toor.do/upnp.html http://toor.do/upnp.html
- semi-extrinsic 10y agoFWIW, my old 20k-student university (a few years back) had tons of printers sitting wide open on IPv4. The university had a full /16 that was used a lot for misc. computers and other equipment (no firewalls). Used to be very convenient that I could send off a few documents to print before I left home at morning, and have them waiting at the printer when I arrived at campus. Even after they added "swipe your card to print" to reduce waste, using plain old lpr to the printer IP still worked (it even cut in front of the queue, to much grumbling from the chemistry students we shared computer labs with).
- cominous 10y agoSomething that really presses my buttons is this mentality of lots of people to just jump on the complain-train and blame the world that certain technologies for beeing not "as good" as others. And even worse are the people using that to create cheap articles to generate clicks. "Javasript is sooo broken.. the world is unfair", "Iot is sooo shit...", "Language X is soo bad.. thanks Obama", "Framework Y is soo 2016...". Thousand people are trying to make a difference in the world and the ones just writing articles about "XY is shit" do mostly nothing. News about bad, bad "IoT", are so low hanging fruits to click-bait. There is almost never a constructive appraoch. Just complain and generate clicks. Where are the leading ideas to make "IoT" better? Where is the differentiation, that open printers installed by stupid users are not a prove how "shit" IoT is? You might also say the "internet is shit" because there is major dataleak happens every week. ... just my 2 cents...
- sp332 10y agoThere are constructive comments right at the top of the article. And companies are selling devices that put their users at risk, so until we get regulation, articles like this are the how people get informed about the problem.
- kevinwang 10y agoAgree, it's a terrible headline. Especially when, IN the interview itself, the interviewee says "I think the media blows it out of proportion a bit. People are thinking their toasters and shit are getting rooted on a daily basis."
- gens 10y agoThing is that.. JS is usually broken, the world is usually unfair, IoT has proven itself to be usually shit and most frameworks are bad. Xerox is not a small startup that just wants to make printing easier. Even if it was, at least some basic security practices should be considered. I mean i'm here writing a dinky little website using SQL and golang (i am a newbie at bout) and I am sterilizing inputs to make sure that SQL injection can't happen. Meanwhile the United Nations(!!) website has been exploited by same. There's even a defcon(?) talk about how a firm was hired to asses the security of that UN website and when the guy sent them an email saying that it is vulnerable to SQL injection, they responded by threatening him to never do that (year later it wasn't fixed). Wish i could find that talk.. it was great. Then there is the Technicolor router (big company) that my cousin has, that i just googled to find it vulnerable to all kinds of things and just horrid in general. Then there is ...
- mentos 10y agoCould anyone see the FTC creating some sort of unit test that crawls IP addresses in the US and tries to find vulnerabilities like this. Maybe printing out a message for the owner to contact some authority on the 'Internet of Things' ?
- milesf 10y agoThe "S" in IoT stands for security :)
- jloughry 10y agoI wish I could upvote you more than once.
- MorePowerToYou 10y agoAnother fun one: I Don't IOT
- h4nkoslo 10y agoWeev's use of every IP-connected printer in the US to publish antisemitic "samizdat" significantly predates this. There's no real exploit in most cases, just things connected to the internet doing what they're told. https://storify.com/weev/a-small-experiment-in https://storify.com/weev/a-small-experiment-in https://storify.com/weev/why-i-am-getting-a-bowlcut https://storify.com/weev/why-i-am-getting-a-bowlcut
- kevinwang 10y agoSad to hear that they feel gloomy about their future. Very knowledgeable for high schooler.
- bdukic 10y ago>One problem I have is that I'm not noticed at all for my skills. Everyone I know who is this age and has the skillset I have are either blackhat or legit depressed. There's nothing for us at this age. Anyone else found this part a little bit sad and somewhat disturbing?
- kieranmjones 10y agoIt is sad for sure, he is clearly very skilled but because it doesn't fit into the framework of the national curriculum for computer science or IT he is getting bad grades. It just goes to show that grades aren't everything, I just hope he can apply those skills and make it in the industry doing legitimate work not malicious work. Some employers are quite good at seeing past grades so fingers crossed for him!
- kieranmjones 10y agoReading the article I found myself dwelling on the quote, "People need to take their printer out of the public internet unless it's needed..." I'm trying to think of a single reason that a printer would need to be exposed to the public internet in any way at all. Even a corporation sharing printers between offices surely would rely on inter-site VPNs rather than just opening ports and exposing the printer to the world? If anyone can think of a good reason to put a printer on the internet I'm all ears because I'm struggling to think of a good reason. Credit to the teenager for not doing something malicious and in fact just being a little playful with it and educating the owners with a cheeky print out. Good work, I hope he can do well going forward and get a career from his skills despite his worries about grades etc.
- vorticalbox 10y agoExcept here in the UK he has broken the computer misuse act and could face jail time if someone decided to prosecute so he technically did something "malicious".
- kieranmjones 10y agoWell yes, he did break the law of course there is no denying that. But in the spirit of what he did he wasn't malicious in that he kicked off a DDoS with these printers or anything more than that, it was of course illegal but at least those people now know. One of the few internet connected devices that is actually capable of giving some output to inform the owner that something is wrong!
- ghurtado 10y agoAs long as you consider smoking a joint "malicious" too (cause, you know, technically, it's illegal).
- elcct 10y agoSmoking a joint isn't illegal. Possession without licence is.
- tlow 10y ago"Smart" (and in this case home) tech which is basically a form of IoT should really be a pejorative.
- umberway 10y agoThe principle battle with printers as I see it is getting them to accept a third party print cartridge.
- fny 10y agoIs it safe for this kid to have a "public" presence about these wonderful shenanigans? I feel like he's bound to have the feds knocking on his door pretty soon despite how harmless this is... A classmate got hosed for doing something very similar years ago.
- nicky0 10y agoIt's probably not a good idea. Children don't tend to have the best judgement.
- mordechai9000 10y agoBack in the 90s, the Internet was full of Windows machines with open file and printer shares. How far we've come...
- ryanmarsh 10y agoI love how this guy thinks he has no future because he makes bad grades. LOL. So many great programmers I know were flunkies because they only cared about doing different hard things. Myself included.
- __m 10y agoI don't know man, hiring a teen with questionable ethics to take care of security seems like a bad idea.
- collinstevens 10y ago"teen" "ethics" I'm sure he will be able to become more professional when entering the work place. He's not Mr. Robot.
- ryanmarsh 10y agoYah cuz we were all such paragons of responsiblity in our teen years. I got in trouble for hacking as a kid too. Now I coach VP's on how to manage app dev. ¯\_(ツ)_/¯
- deleted 10y ago[deleted]
- hathawsh 10y agoThere's a great business opportunity hidden here. This kid (or anyone else) could set up a web site where people go to scan their own network for IoT vulnerabilities. Make it like the Qualys SSL testing service: let people test for free without installing anything, but charge for additional services like repairs, enterprise service, deeper inspection, etc. If there really are so many IoT vulnerabilities out there, this should be a slam-dunk business.
- olleromam91 10y agoWould this become a search engine for malicious people to find vulnerabilites on other networks then? Sounds risky.
- RIMR 10y agoThis is insanely easy to do. I know exactly what he did, and the only reason I didn't do it myself was because I didn't want the inevitable legal problems. Best of luck to this kid, because as smart as he is, and as destructive as this isn't, the law takes a very dim view of taking over other's equipment, even if it's wide-open.
- 234dd57d2c8dba 10y agoI hope this guy realizes that school was designed to churn out factory workers in 1900s Prussia. The education system is so broken because of this, and it will never change. There's way too many people's job-security and momentum riding on this system. He's not broken, the school system is.
- onmobiletemp 10y agoI go to a good college in california. Im currently in the dining hall and the peraon across the table from me was using his laptop. He just walked away, presumably to get more food, leaving his open and unlocked laptop completely unattended. This is why there are still printers connected to the internet and why it wont change for a long time.
- smnscu 10y agocringe I used to do this so often. I've now set my laptop to ask for a password after 5s (on Macs it's really easy to turn off the screen with Ctrl+Shift+Power). And the disk encryption from Apple puts my mind at rest somewhat, even in busy coffee shops. edit: I feel like in small startup offices not locking your computer is a subtle sign that you trust your team, but this might be just my weird interpretation
- x1798DE 10y agoThis is really not the same problem. For the most part, the people who are going to fuck with your shit are pretty rare, so the chances that one of them will happen to be around and ready to pounce in a dining hall in a good college (and that no one else around will notice) are reasonably low. Compare that with the internet where everyone is just as far away as anyone else, you can automate the malicious actions, and attribution is a pain.
- onmobiletemp 10y agoThey are the same though because most people have no idea there is even a difference. They are titally unaware. Would you or anyone else who knows anything honestly leave your laptop open and unattended?
- pavel_lishin 10y ago> I don't know enough people. I don't talk about any of this stuff with my friends. Nobody is interested in it. I've had my fair deal of shit from teachers when it comes to computing, too. What a bummer. When I was a kid, I was nowhere as skilled as this guy, but I was online a lot and talked to a fair amount of people whom I would consider friends. It seems that today, it should be even easier to reach out and connect to people with your shared interests, especially when those shared interests are effectively marketable skills and ought to translate into job offers out of high school.
- CM30 10y agoHe isn't kidding about the state of computer 'science' in the UK being atrocious. Up until sixth form college, it's pretty much 'how to use Microsoft Office the class', with programming being mostly non existent and even coding in HTML being rare in a lot of cases. So anyone who doesn't study IT past the age of 16 or have an interest in computers outside of school is likely going to be absolutely clueless in regards to how to use a computer. Once you're in sixth form college, it's then hardly any better, with the worst ones literally being 'how to use Microsoft Office, Access and Front Page edition'. So you could theoretically get away with not writing a single line of code until university, despite doing 'IT' as much as humanly possible. Add the lack of extra activities, and well... anyone who's done programming at all may as well skip GCSE and A level IT altogether, since it's got absolutely nothing of value to someone with even the simplest computer skills. Thank god you don't need a degree to get work as a developer in this country. Otherwise we'd have barely anyone interested in programming at all. He's also right about the internet of things being a security disaster... but hey, absolutely everyone with experience in this stuff knew that already. That said, he should probably get out of this blackhat stuff now rather than later, since it's very likely he'll be caught and end up facing a pretty long prison sentence at some point in time if he doesn't. Especially when you realise most people will see what he's doing here and think it's somehow as serious as breaking national security.
- rhaps0dy 10y agoSo is this the same as https://arstechnica.com/security/2014/02/dear-asus-router-user-youve-been-pwned-thanks-to-easily-exploited-flaw/ https://arstechnica.com/security/2014/02/dear-asus-router-us... but with printers?