Printers are spontaneously printing odd "SQL" strings
discussions.apple.com
Printers are spontaneously printing odd "SQL" strings
1–10 of 150 posts
Re: Printers are spontaneously printing odd "SQL" strings
#2> "[...] we're all forwarding port 9100 or 631 to our printer to allow ourselves to print from outside the network, which sets up an HTTP server at that address open to the internet. All it takes is for somebody to put the appropriate GET request in [...]"
> "Both of our printers have public IP addresses"
It looks like the printer are publicly accessible, and some automated tool (nmap?) is just scanning them for vulnerabilities, open ports, or similar. Not too surprising really.
Re: Printers are spontaneously printing odd "SQL" strings
#3From the comments it seems that it's people sharing their printer, apparently some form of access over the internet (or local network).
Re: Printers are spontaneously printing odd "SQL" strings
#4The strings contain "sqli" which some of the posters inferred to mean they were experiencing a SQL injection. I doubt this is actually the case. I will say, though, that I have a Brother printer like the one described where I work and have seen similar odd strings on papers that come out of it. At least one time, it's just printed gibberish. I think the common denominator is that these printers are openly shared on a network with a public IP (at least mine is...it's at a big University with public IPs fore everybody). I don't know if this is related or not, though.
Re: Printers are spontaneously printing odd "SQL" strings
#5I once found a public printer which I don't think was supposed to be public. There wasn't any way to contact the owner since it appeared to be in a different country based on IP address.
...so I set it up as a printer and printed a bunch of lolcats to it.. A few days later it wasn't accessible any more =)
Re: Printers are spontaneously printing odd "SQL" strings
#6This reminds me when I was in college- I used to have VNC running on a public IP without any authentication (on purpose). Randomly, bots would connect, take over control of the screen, and print a bunch of test characters out in Notepad before disconnecting.
I don't know if they just hit it by luck or if they were actively looking for/testing/saving open VNC servers.
Re: Printers are spontaneously printing odd "SQL" strings
#7> "[...] we're all forwarding port 9100 or 631 to our printer to allow ourselves to print from outside the network, which sets up an HTTP server at that address open to the internet. All it takes is for somebody to put the appropriate GET request in [...]" > "Both of our printers have public IP addresses" It looks like the printer are publicly accessible, and some automated tool (nmap?) is just scanning them for vuln…
That would definitely not be a stealthy scan :)
Re: Printers are spontaneously printing odd "SQL" strings
#8The strings contain "sqli" which some of the posters inferred to mean they were experiencing a SQL injection. I doubt this is actually the case. I will say, though, that I have a Brother printer like the one described where I work and have seen similar odd strings on papers that come out of it. At least one time, it's just printed gibberish. I think the common denominator is that these printers are openly shared on a…
I'm in the sqlite camp.
Re: Printers are spontaneously printing odd "SQL" strings
#9I did a project in college where I scanned networks for IPP ports and would print agit prop to them
The printer panopticon. Oh art school.
Re: Printers are spontaneously printing odd "SQL" strings
#10> "[...] we're all forwarding port 9100 or 631 to our printer to allow ourselves to print from outside the network, which sets up an HTTP server at that address open to the internet. All it takes is for somebody to put the appropriate GET request in [...]" > "Both of our printers have public IP addresses" It looks like the printer are publicly accessible, and some automated tool (nmap?) is just scanning them for vuln…
The printed page even says NMap on it. nmapol=tlitcp is Transport Layer Interface and TCP. I'm not positive, but NMap OL could be NMap openvas-library, which is a vulnerability scanner. Sounds to me like someone scanning with NMap over TLI and TCP and it's hitting these printers.
Don't expose your printers to the web without a strict firewall or VPN/reverse proxy!