I've written about this before.[1] Many network-connected printers simply assume that the local network they connect to will be securely protected from external

I've written about this before.[1] Many network-connected printers simply assume that the local network they connect to will be securely protected from external threats, so they're not configured to withstand even the simplest of attacks. This is exactly the opposite of what many security experts recommend: devices should be secure regardless of whether the network they're on is secure or not. Bruce Schneier's personal WiFi network at home is fully open, because -- in his own words: "If I configure my computer to be secure regardless of the network it's on, then it simply doesn't matter. And if my computer isn't secure on a public network, securing my own network isn't going to reduce my risk very much."[2] I'm waiting for the great network printer security apocalypse... -- I ran a quick nmap command (nmap -T4 -A -v -PE [IP address]) on a few of the many printers indexed by Google, and here's a typical result, showing tons of open ports and passwordless login options (I've deleted the hostname and IP address to protect the innocent): Starting Nmap 5.21 ( http://nmap.org ) at 2013-01-25 12:15 EST NSE: Loaded 36 scripts for scanning. Initiating Ping Scan at 12:15 Scanning XXX.XXX.XXX.XXX [1 port] Completed Ping Scan at 12:15, 0.10s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 12:15 Completed Parallel DNS resolution of 1 host. at 12:15, 0.14s elapsed Initiating Connect Scan at 12:15 Scanning [HOSTNAME] (XXX.XXX.XXX.XXX) [1000 ports] Discovered open port 23/tcp on XXX.XXX.XXX.XXX Discovered open port 21/tcp on XXX.XXX.XXX.XXX Discovered open port 443/tcp on XXX.XXX.XXX.XXX Discovered open port 80/tcp on XXX.XXX.XXX.XXX Increasing send delay for XXX.XXX.XXX.XXX from 0 to 5 due to max_successful_tryno increase to 5 Increasing send delay for XXX.XXX.XXX.XXX from 5 to 10 due to max_successful_tryno increase to 6 Warning: XXX.XXX.XXX.XXX giving up on port because retransmission cap hit (6). Discovered open port 14000/tcp on XXX.XXX.XXX.XXX Discovered open port 631/tcp on XXX.XXX.XXX.XXX Discovered open port 280/tcp on XXX.XXX.XXX.XXX Completed Connect Scan at 12:15, 37.26s elapsed (1000 total ports) Initiating Service scan at 12:15 Scanning 7 services on [HOSTNAME] (XXX.XXX.XXX.XXX) Completed Service scan at 12:16, 13.09s elapsed (7 services on 1 host) NSE: Script scanning XXX.XXX.XXX.XXX. NSE: Starting runlevel 1 (of 1) scan. Initiating NSE at 12:16 Completed NSE at 12:16, 3.57s elapsed NSE: Script Scanning completed. Nmap scan report for [HOSTNAME] (XXX.XXX.XXX.XXX) Host is up (0.11s latency). Not shown: 978 closed ports PORT STATE SERVICE VERSION 21/tcp open ftp HP LaserJet P4014 printer ftpd |_ftp-anon: Anonymous FTP login allowed 23/tcp open telnet HP JetDirect telnetd 25/tcp filtered smtp 80/tcp open http HP-ChaiSOE 1.0 (HP LaserJet http config) | html-title: hp LaserJet 9050 |_Requested resource was http://XXX.XXX.XXX.XXX/hp/device/this.LCDispatcher 111/tcp filtered rpcbind 135/tcp filtered msrpc 139/tcp filtered netbios-ssn 280/tcp open http HP-ChaiSOE 1.0 (HP LaserJet http config) | html-title: hp LaserJet 9050 |_Requested resource was http://XXX.XXX.XXX.XXX/hp/device/this.LCDispatcher 443/tcp open ssl/http HP-ChaiSOE 1.0 (HP LaserJet http config) | html-title: hp LaserJet 9050 |_Requested resource was http://XXX.XXX.XXX.XXX/hp/device/this.LCDispatcher 445/tcp filtered microsoft-ds 515/tcp filtered printer 631/tcp open http HP-ChaiSOE 1.0 (HP LaserJet http config) | html-title: hp LaserJet 9050 |_Requested resource was http://XXX.XXX.XXX.XXX/hp/device/this.LCDispatcher 1433/tcp filtered ms-sql-s 1720/tcp filtered H.323/Q.931 3168/tcp filtered unknown 4550/tcp filtered unknown 6000/tcp filtered X11 6112/tcp filtered dtspc 8654/tcp filtered unknown 9100/tcp filtered jetdirect 14000/tcp open tcpwrapped 19315/tcp filtered unknown Service Info: Device: printer -- [1] http://news.ycombinator.com/item?id=4412714 http://news.ycombinator.com/item?id=4412714 [2] http://www.schneier.com/blog/archives/2008/01/my_open_wireles.html http://www.schneier.com/blog/archives/2008/01/my_open_wirele...