6 ms·

I can tell you that my UK printer has the same shit! I went through it with a magnifying glass to make sure it didn't select anything. In addition, I set up t

I can tell you that my UK printer has the same shit! I went through it with a magnifying glass to make sure it didn't select anything. In addition, I set up the IP stuff manually on the printer to ensure there was no gateway... can't get out without a gateway.

jlgaddis 7y ago
I used to do the same exact thing. At some point, though, I noticed that "something" [0] still managed to "get out". After running some packet captures, it became clear what was going on. Although the device was using the network settings that I had manually configured, I had not specified a default gateway. The device decided it would use DHCP to discover the default gateway for the network and began automatically using it so it could get out to the Internet. Since then, I've started specifying a default gateway for any devices that I don't want to get out. I give 'em an IP address that isn't in use on the network and, fortunately, I haven't ran into any other instances of crap like this happening. [0]: I really wish I could remember what device this was but it's been a long time ago and I really have no idea, sorry.
- dvdkhlng 7y ago
  These kinds of concerns are why I put all my "untrusted" devices on a separate VLANs, so I can reliably shut them out of the internet. Simple VLAN-enabled switches don't cost that much any more. Such a switch allows you to treat any port of the switch as a distinct network interface on your main router, where you can just disable forwarding for selected interfaces entirely. It also prevents your untrusted devices from seeing each other, i.e. your printer wont't be physically able to send ethernet frames to your VoIP phone, even if connected to the same switch. Here is some introduction to the concept: http://corecom.com/external/livesecurity/vlans.htm http://corecom.com/external/livesecurity/vlans.htm
  - fucking_tragedy 7y ago
    > Simple VLAN-enabled switches don't cost that much any more. They're dirt cheap and have been for the better part of a decade. If you're looking to upgrade, cost isn't a reason not to.
    - dngray 7y ago
      I did exactly that: • http://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi http://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_... • https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi_(IPv6) https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... My printer is in a VLAN which has no route out over the Internet. (The second link there uses VLANs).
  - jlgaddis 7y ago
    VLANs, huh? I'll have to Google that sometime. ;)
  - dvfjsdhgfv 7y ago
    True, but assigning it a static IP and blocking egress traffic originating from it should accomplish the same thing.
    - dvdkhlng 7y ago
      I think static IPs and blocking egress traffic only keeps well-behaved devices from doing any harm. It does not protect you from compromised, malicous (IoT) devices. Think about a network printer doing ARP spoofing and MiTM-attacking your VoIP phone or IP cam. E.g. googeling immediately turns up vulnerabilities like this [1] one. A properly configured VLAN setup can help to prevent or limit this threat. [1] https://www.scmagazine.com/home/network-security/hp-officejet-printers-bug-puts-entire-network-at-risk-coupled-with-eternalblue/ https://www.scmagazine.com/home/network-security/hp-officeje...
  - DCoder 7y ago
    New printer next year: "Hmm, I can't contact my telemetry server with these internet settings… time to connect to any open Wi-Fi I can find nearby!"
justinclift 7y ago
Are you up for filing a GDPR complaint with the Data Protection Authority? :)
- alexis_fr 7y ago
  I’d like to see a big hardware company explaining its shareholders that they got a fine of 4% of the company’s worldwide revenue because they wanted data that was supposed to increase sales.

jlgaddis 7y ago

I used to do the same exact thing. At some point, though, I noticed that "something" [0] still managed to "get out". After running some packet captures, it became clear what was going on. Although the device was using the network settings that I had manually configured, I had not specified a default gateway. The device decided it would use DHCP to discover the default gateway for the network and began automatically using it so it could get out to the Internet. Since then, I've started specifying a default gateway for any devices that I don't want to get out. I give 'em an IP address that isn't in use on the network and, fortunately, I haven't ran into any other instances of crap like this happening. [0]: I really wish I could remember what device this was but it's been a long time ago and I really have no idea, sorry.

dvdkhlng 7y ago
These kinds of concerns are why I put all my "untrusted" devices on a separate VLANs, so I can reliably shut them out of the internet. Simple VLAN-enabled switches don't cost that much any more. Such a switch allows you to treat any port of the switch as a distinct network interface on your main router, where you can just disable forwarding for selected interfaces entirely. It also prevents your untrusted devices from seeing each other, i.e. your printer wont't be physically able to send ethernet frames to your VoIP phone, even if connected to the same switch. Here is some introduction to the concept: http://corecom.com/external/livesecurity/vlans.htm http://corecom.com/external/livesecurity/vlans.htm
- fucking_tragedy 7y ago
  > Simple VLAN-enabled switches don't cost that much any more. They're dirt cheap and have been for the better part of a decade. If you're looking to upgrade, cost isn't a reason not to.
  - dngray 7y ago
    I did exactly that: • http://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi http://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_... • https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi_(IPv6) https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... My printer is in a VLAN which has no route out over the Internet. (The second link there uses VLANs).
- jlgaddis 7y ago
  VLANs, huh? I'll have to Google that sometime. ;)
- dvfjsdhgfv 7y ago
  True, but assigning it a static IP and blocking egress traffic originating from it should accomplish the same thing.
  - dvdkhlng 7y ago
    I think static IPs and blocking egress traffic only keeps well-behaved devices from doing any harm. It does not protect you from compromised, malicous (IoT) devices. Think about a network printer doing ARP spoofing and MiTM-attacking your VoIP phone or IP cam. E.g. googeling immediately turns up vulnerabilities like this [1] one. A properly configured VLAN setup can help to prevent or limit this threat. [1] https://www.scmagazine.com/home/network-security/hp-officejet-printers-bug-puts-entire-network-at-risk-coupled-with-eternalblue/ https://www.scmagazine.com/home/network-security/hp-officeje...
- DCoder 7y ago
  New printer next year: "Hmm, I can't contact my telemetry server with these internet settings… time to connect to any open Wi-Fi I can find nearby!"

justinclift 7y ago

Are you up for filing a GDPR complaint with the Data Protection Authority? :)

alexis_fr 7y ago
I’d like to see a big hardware company explaining its shareholders that they got a fine of 4% of the company’s worldwide revenue because they wanted data that was supposed to increase sales.