13 ms·
Printers are spontaneously printing odd "SQL" strings
- stordoff 14y ago> "[...] we're all forwarding port 9100 or 631 to our printer to allow ourselves to print from outside the network, which sets up an HTTP server at that address open to the internet. All it takes is for somebody to put the appropriate GET request in [...]" > "Both of our printers have public IP addresses" It looks like the printer are publicly accessible, and some automated tool (nmap?) is just scanning them for vulnerabilities, open ports, or similar. Not too surprising really.
- oelmekki 14y agoThat would definitely not be a stealthy scan :)
- freehunter 14y agoThe printed page even says NMap on it. nmapol=tlitcp is Transport Layer Interface and TCP. I'm not positive, but NMap OL could be NMap openvas-library, which is a vulnerability scanner. Sounds to me like someone scanning with NMap over TLI and TCP and it's hitting these printers. Don't expose your printers to the web without a strict firewall or VPN/reverse proxy!
- windexh8er 14y agoAgreed, I've seen this before as well. I doubt it really has anything to do with Apple and likely the HP printer server software instead - being directly related to an nmap scan.
- bcl 14y agoWhen nmap scans port 9100 it doesn't send anything (at least as of nmap 6.00 using -sV). It is probably a higher level vulnerability scanner, possibly metasploit, using nmap to discover open ports and then probe deeper on its own.
- dfc 14y agoNmap avoids sending to 9100 specifically to avoid sending data that the printer may misinterpret as data to be written to a page. You need to give it the --allports option. --allports (Don't exclude any ports from version detection) . By default, Nmap version detection skips TCP port 9100 because some printers simply print anything sent to that port, leading to dozens of pages of HTTP GET requests, binary SSL session requests, etc. This behavior can be changed by modifying or removing the Exclude directive in nmap-service-probes, or you can specify --allports to scan all ports regardless of any Exclude directive.
- bcl 14y agoThanks!
- jvdh 14y agoIt is not surprising that printers just accept (possibly malformed) requests just from anywhere?
- lucb1e 14y agoNot if the owners don't password protect anything. Without a valid login it shouldn't print anything, unless that login were exploited, but I don't see any mention of a password being bypassed.
- kd0amg 14y agoIf I remember the presentation I saw on this, some don't even verify firmware updates. http://ids.cs.columbia.edu/sites/default/files/CuiPrintMeIfYouDare.pdf http://ids.cs.columbia.edu/sites/default/files/CuiPrintMeIfY... http://engineering.columbia.edu/can-you-trust-your-printer http://engineering.columbia.edu/can-you-trust-your-printer
- adrinavarro 14y agoFrom the comments it seems that it's people sharing their printer, apparently some form of access over the internet (or local network).
- danieldk 14y agoGiven that these are connected to Airports, they are probably using Back to my Mac: http://en.wikipedia.org/wiki/Back_to_My_Mac http://en.wikipedia.org/wiki/Back_to_My_Mac
- grapefruit 14y agoServices shared via Back to My Mac aren't directly accessible from the internet at large. Services shared using Wide-Area Bonjour are publicly exposed.
- cantankerous 14y agoThe strings contain "sqli" which some of the posters inferred to mean they were experiencing a SQL injection. I doubt this is actually the case. I will say, though, that I have a Brother printer like the one described where I work and have seen similar odd strings on papers that come out of it. At least one time, it's just printed gibberish. I think the common denominator is that these printers are openly shared on a network with a public IP (at least mine is...it's at a big University with public IPs fore everybody). I don't know if this is related or not, though.
- alexchamberlain 14y agoI'm in the sqlite camp.
- cantankerous 14y agoThat would make sense, especially if it was just some kind of debugging message mentioning the sqlite version.
- CWuestefeld 14y agoThe strings contain "sqli" which some of the posters inferred to mean they were experiencing a SQL injection. I doubt this is actually the case. I'm certain you're correct. I've seen many SQL injection attacks, and not one of them has ever labelled itself as such.
- ioquatix 14y agoI once found a public printer which I don't think was supposed to be public. There wasn't any way to contact the owner since it appeared to be in a different country based on IP address. ...so I set it up as a printer and printed a bunch of lolcats to it.. A few days later it wasn't accessible any more =)
- Achshar 14y agoYou could have, you know, printed out that the printer was publicly accessible on the printer itself.
- stevencorona 14y agoThis reminds me when I was in college- I used to have VNC running on a public IP without any authentication (on purpose). Randomly, bots would connect, take over control of the screen, and print a bunch of test characters out in Notepad before disconnecting. I don't know if they just hit it by luck or if they were actively looking for/testing/saving open VNC servers.
- jonknee 14y agoWhy would you have it set it up that way, especially after witnessing bots connecting?
- stevencorona 14y agoIt was an old PC that I didn't care about and only used for testing. I was into security stuff, so it was interesting to see the bots connect (which it why I left it open).
- freehunter 14y agoYou're always being scanned for everything. If I got a penny for every time my company was swept by a scanner, I'd be making more than my salary.
- fein 14y agoThis is almost an understatement. My home servers get SLAMMED on a daily basis by a whole wonderful plethora of bots. Most recently has been Muieblackcat. Going on the whole salary analogy: I'd make my current salary plus a bit if I had a penny for ever scan on the box in my living room. I keep the Ukrainian IP's off my blacklist just for fun. Nothing sensitive on the server, just my web playpen. I kind of hope that one of these exploits works one day so I can see where I've slipped up.
- LeRenard 14y agoIt's not a scan, it's free surprise pen testing!
- ethank 14y agoI did a project in college where I scanned networks for IPP ports and would print agit prop to them The printer panopticon. Oh art school.
- eternalban 14y ago> ... printer panopticon ... Oh "BBrother" what an ironic comment this is .. /takes off paranoid hat
- dfranke 14y agoHeh... a similar "project" when I was in high school got me sent to the principal's office once :-)
- ethank 14y agoYeah, I got a nice visit from campus security.
- borplk 14y agoIn the printed stuff it also says 'nmap' Most probably it comes from someone running penetration testing tools against the printer on the network
- rachelbythebay 14y agoI'm waiting for the great network printer security apocalypse. A bunch of these things are in a great position to turn around and launch attacks on the "chewy on the inside" networks of so many companies. Maybe this has already happened. My printer has a dumb little print server running an embedded flavor of Linux and a publicly known hard-coded (!) root password. While mine is going to the slag heap sooner or later for that and several other fundamental problems, you can guess that many many more of them are out there just waiting to be taken for a ride. These dumb little boxes may be underpowered, but once you get inside and set them up to forward packets for you, their raw CPU speed becomes less of an issue. You can run all of the fun attacks from a "real" machine and just let it bounce you to the inside world. Hypothetically speaking, of course.
- mjhall 14y agoThese two 28C3 talks[0,1] discuss the precursor to such an apocalypse. [0]: http://events.ccc.de/congress/2011/Fahrplan/events/4871.en.html http://events.ccc.de/congress/2011/Fahrplan/events/4871.en.h... [1]: http://events.ccc.de/congress/2011/Fahrplan/events/4780.en.html http://events.ccc.de/congress/2011/Fahrplan/events/4780.en.h...
- axx 14y agoI was going to submit those. Thanks!
- INTPenis 14y agoMy very first criminal act of hacking as a teenager was gaining access to a printer somewhere in Spain, by which I had limited access to the rest of the network but I was too dumb to understand what to do. So yeah, printers at least were a big gaping hole in the late 90s and early 00s.
- lftl 14y agoI've got a HP printer pretty similar to the one mentioned in the thread. In the course of trying to set it up, I by chance pointed my browser to the printer's network printing port. Interestingly enough it printed out all my browser headers. It seems like these printers just spit out anything that hits that port.
- igrekel 14y agoYes, I used to do a netcat on printers to print for free in college.
- ZoFreX 14y agoTip for networked computers in colleges, schools, workplaces, and similar environments: You can upload postscript files to them via FTP, this lets you bypass the printer queue running on a server somewhere. Why would you want to do this? Various nefarious reasons, but the reason I did it was because in 90+% printer outages at university, it was the queue server and not the printer itself experiencing a fault. If you don't know the IP address of the printer, you can normally get them to print out a diagnostics page by fiddling with the buttons, and this page will contain that information. So far I have always succeeded at logging in with guest credentials. To network admins who don't want people bypassing their queues: vlan your printers!
- mindslight 14y agoI added several strategically-located university printers to my /etc/printcap such that I could just-in-time print homework from my dorm and pick it up on my way to class. True cloud printing ftw!
- hrrsn 14y agoWe had this problem when I was still at high school. It worked for the most part, but when us photography students started printing to the photo printer all hell broke loose. Things would frequently take 30+ minutes to go through the Pharos print server. At the time they had just hired a new IT guy so we asked him if he could set the printer up on our personal laptops (we only had 3 workstations in the room). After much frustration he managed to get it running, except he accidentally set them up to print directly to the printer, not via the print server. Magically things started popping out after a minute or two, which got the teacher inquisitive. Eventually they realised that we weren't being charged for printing anymore when the print information had our personal computer usernames rather than ID numbers but couldn't blame us as they had set it up themselves. After being told not to do that anymore, we all just set up secondary users with our ID numbers so it all looked legit.
- fest 14y agoIt seems to me that someone was scanning their network for specific services- probably, some DBMS. Printer received the initial communications packet(s) and happily printed whatever was received.
- justincormack 14y agoThere are known attacks on printers eg via firmware upload https://lwn.net/Articles/469865/ https://lwn.net/Articles/469865/ Although this mostly looks like scans.
- dagw 14y agoSpoke with a a security guy years ago who got called to a company after they'd been accused of running a warez server. After a bit of digging around he finally found the server on a printer that was running some ancient un-patched version Solaris.
- losethos 14y agoFiles are compressed. Songs are programs with a simple musical notation. They put graphics and stuff.
- jpcosta 14y agoCould this be related with Trojan.Milicenso or Trojan.Eorezo? This is the latest (although its from June/July) threat I know of that prints random stuff http://www.symantec.com/connect/blogs/trojanmilicenso-paper-salesman-s-dream-come-true http://www.symantec.com/connect/blogs/trojanmilicenso-paper-... http://www.symantec.com/docs/TECH190982 http://www.symantec.com/docs/TECH190982 http://isc.sans.edu/diary.html?storyid=13519 http://isc.sans.edu/diary.html?storyid=13519
- SoftwareMaven 14y agoOne poster said his/her printer did it on a machine not connected to the network, so it may not be a print server scanning thing.
- cs702 14y agoMany, perhaps most network-connected printers, NAS units, and other devices (e.g., home-automation hardware) simply assume that the local network they connect to will be securely protected from external attack, so they're not configured to withstand even the simplest of attacks. This is exactly the opposite of what many security experts recommend: ideally all devices should be secure regardless of whether the network they're on is secure or not. With more and more devices offering remote-Internet-access functionality every day, this principle of security is becoming ever more fundamental. Bruce Schneier's personal WiFi network at home is fully open, because -- in his own words: "If I configure my computer to be secure regardless of the network it's on, then it simply doesn't matter. And if my computer isn't secure on a public network, securing my own network isn't going to reduce my risk very much."[1] Like rachelbythebay, I'm also waiting for the great network printer security apocalypse.[2] -- [1] http://www.schneier.com/blog/archives/2008/01/my_open_wireles.html http://www.schneier.com/blog/archives/2008/01/my_open_wirele... [2] http://news.ycombinator.com/item?id=4412522 http://news.ycombinator.com/item?id=4412522 -- UPDATE: Just for the heck of it, I ran a fairly fast scan (nmap -T4 -A -v -PE [IP address]) on an HP all-in-one printer accessible over my LAN, and there were a LOT of open ports -- see pasted results below. I then pointed my browser to port 9100 on the printer, which instantly printed the HTTP headers without complaint. The printer's configuration page reports that it is "secured" by an administrative password. PORT STATE SERVICE VERSION 80/tcp open http HP PhotoSmart/Deskjet printer http config (Virata embedded httpd 6_0_1) 139/tcp open netbios-ssn? 6839/tcp open tcpwrapped 7435/tcp open tcpwrapped 8089/tcp open tcpwrapped 9100/tcp open jetdirect? 9101/tcp open jetdirect? 9102/tcp open jetdirect? 9110/tcp open unknown 9220/tcp open hp-gsg HP Generic Scan Gateway 1.0 9290/tcp open hp-gsg IEEE 1284.4 scan peripheral gateway 9500/tcp open unknown
- aidos 14y agoI get that this just looks like a scan but it's strange that half a dozen people reported it at the same time (so the problem is likely more widespread). How long would it take to send these packets to all public ips in the world (real question, I have no sense of the scale of ip addresses)? I guess it could be that the ips are known to be running printers by a previous scan. Maybe the printers contact home and the HP accidentally sent them a bad message?
- PaulHoule 14y agothis would be a great attack if you could get the printers to print ads!
- ahi 14y agoThose are called fax machines.
- drone 14y agoPretty typical behavior when running vulnerability scanning against a printer target. Many printers will simply print whatever data comes into certain ports. Have seen similar behavior many times when running web scanning against a printer accidentally instead of a webserver.
- doctorwho 14y agoNo need to worry, all Mac's are virus, malware and attack proof and so (by the law of distortion of reality) are any devices or networks attached to a Mac. Go about your business and forget about that pesky "security" thing everyone else likes to talk about. Just etch a picture of Steve striking a thoughtful pose on the lid of your laptop and all your problems will be forgotten.
- podperson 14y agoThanks for injecting helpful -- not to mention hilariously witty -- points into this conversation. You left out the following points: * Apple's stuff is incredibly overpriced * Apple never invented anything, it's just good at marketing * Apple's lawsuits are all based on rounded rectangles * Xerox invented the GUI from scratch and it was perfect * Anyone who uses an Apple device is a hipster fanboi cultist
- gonzo 14y agoI am not a hipster.
- MarvinYork 14y agoWelcome to hecklernews.
- podperson 14y agoslashdot -> digg -> reddit -> hackernews -> slashdot? Also: sarcasm is like violence -- any problem it can't solve just requires more sarcasm.
- doctorwho 14y agoIf Apple's stuff wasn't incredibly overpriced they wouldn't have $100B in the bank. Steve's ghost would be sad and they wouldn't be able to bankroll all their lawsuits (which would also make Steve's ghost sad). Apple USED to be good at marketing. Have you seen those new ads? The ghost of Steve just barfed in his mouth a little bit. Quick! Someone call Justin Long and John Hodgman, that was working okay... Rounded rectangles are the new lucite, and therefor not relevant in any way. Apple's lawsuits were based on Steve Jobs being a big baby about how well Android was selling. Now? Who knows how the Apple lawsuit of the day gets kicked off, but you can bet it involves Androids (and not the Star Trek variety). Now you're just being thick, the first GUI was done by Doug Engelbart (Stanford Research) in '68. It was perfect. Any CS student who took an HCI knows that. Extra points if you know what HCI stands for and don't have to google Engelbart to verify, but I bet you do :) Some people who use Apple devices just want some of the discretionary income that hipster, fanboi (and fangrl, you sexist) and cultists seem quite happy to part with. Will that be cash or credit?
- alanbyrne 14y ago<snip> I'm going to guess that the common theme here is that we're all forwarding port 9100 or 631 to our printer to allow ourselves to print from outside the network, which sets up an HTTP server at that address open to the internet. </snip> Seriously?! Ignoring the fact that I can't remember when I last print something, who needs to print to their house from the internet? Can't they just print it when they get home?
- corin_ 14y agoI've actually found it useful in the past to be able to print stuff when I'm not in the office - not useful enough that I really care about the feature, just that since it's there it saves a small step in the alternative of emailing then having them open and print it.
- jorts 14y agoWhy not setup a VPN to your home?
- corin_ 14y agoWould be to my office, and why not because I've never needed to. Our current printer can't do printing from over the internet and I don't care enough to bother setting it up.
- tonyedgecombe 14y agoIsn't this the purpose of Google Cloud Print http://www.google.com/cloudprint/learn/ http://www.google.com/cloudprint/learn/
- samstave 14y agoSemi off topic anecdote: when I was at Lockheed the head of HR came to me with a Manila envelope and said "I need to know who printed this and when! And I need to know now!" I took the envelope and looked at it... It was a bunch of prints of gay porn and gay porn websites. After a few minutes of digging, it was revealed to be one of the directors in the company had printed them late the night before. Checking the badge system he wasn't in the building. Checked VPN logs and he was logged in at the time. He was mistakenly on VPN from his house and printed stuff that went to his default printer which happened to be the one in the office. He was previously thought to be a married straight guy.
- alanbyrne 14y ago<snip> I'm going to guess that the common theme here is that we're all forwarding port 9100 or 631 to our printer to allow ourselves to print from outside the network, which sets up an HTTP server at that address open to the internet. </snip> Seriously?! Ignoring the fact that I can't remember when I last print something, who needs to print to their house from the internet? Can't they just print it when they get home?
- android_gg 14y agothis is pretty damn scary
- axx 14y agoWith IPv6 and public IPs this is going to be so much fun. :)
- cantankerous 14y agoFor what it's worth. This issue (or an issue very similar to this issue) has been discussed on the nmap seclist. From the email: "....However, I've noticed a problem now that I've put this into production. When it scans a network printer, the printer spews out garbage, I have a couple wads of paper on my desk with one or two lines of garbage at the top of each page." http://seclists.org/nmap-dev/2006/q3/406 http://seclists.org/nmap-dev/2006/q3/406
- cantankerous 14y agoAfter playing around with it. I think that what is causing this to happen is that the JetDirect port on the printer (usually 9100) is getting written to by a port scanner. This will cause a printer using JetDirect to print out whatever gets sent to it on that port. Try it yourself if you have a printer that implements it. For me it was a Brother HD-5370DW. 1. telnet <printer> 9100 2. Type a hello world message. 3. Close the connection 4. The printer will print out whatever you typed. At least it did for me.
- da_n 14y agoCan confirm this works on my Epson printer (SX535WD).
- brokenparser 14y ago@PJL RDYMSG DISPLAY="Tray 1 Load Plain Letter" Confuses the heck out of your coworkers.
- eli 14y agoA while back I hacked a cronjob to update mine with the current weather forecast.
- eli 14y agoIn fact, it's here http://www.elidickinson.com/story/weather-updates-your-hp-printer-lcd-display http://www.elidickinson.com/story/weather-updates-your-hp-pr... I think it was the first python script I wrote.
- b_emery 14y agoWow, this works on my HP printer. That would explain the reams of pages I get that look like this: GET http://www.baidu.com/ http://www.baidu.com/ HTTP/1.1 Host: www.baidu.com Accept: / Pragma: no-cache User-Agent:
- 14y ago
- JonnieCache 14y agoDon't trust your printer! There were a lot of demos of printer hacks at 28c3 and basically I think I might not print anything ever again. A lot of these things have their firmware implemented in postscript. Updating the firmware consists of printing a special document. It's pretty mental tbh. Your jaw will be scraping along the floor at some of the holes these things have. Print Me If You Dare: http://www.youtube.com/watch?v=njVv7J2azY8 http://www.youtube.com/watch?v=njVv7J2azY8 Hacking MFPs: http://www.youtube.com/watch?v=PqL5P46m_zQ http://www.youtube.com/watch?v=PqL5P46m_zQ EDIT: Beaten by 4 hours. Oh well.
- blhack 14y agoThey're getting portscanned. I'm surprised this isn't common knowledge. If you throw ascii at a jetdirect printer, it will generally just print it out for you. I've used this to debug printers before, as well as to goof around with my coworkers a bit.
- colton36 14y agoFor slightly more amusing attacks on printers, there is an android app available - HP Printer Fun. https://play.google.com/store/apps/details?id=com.angryhacker.printerfun https://play.google.com/store/apps/details?id=com.angryhacke...
- jpswade 14y agoI've so far been unable to replicate this problem.