Live data from Hacker News

Printers are spontaneously printing odd "SQL" strings

discussions.apple.com

11–20 of 150 posts

Re: Printers are spontaneously printing odd "SQL" strings

#11

This reminds me when I was in college- I used to have VNC running on a public IP without any authentication (on purpose). Randomly, bots would connect, take over control of the screen, and print a bunch of test characters out in Notepad before disconnecting. I don't know if they just hit it by luck or if they were actively looking for/testing/saving open VNC servers.

Why would you have it set it up that way, especially after witnessing bots connecting?

Re: Printers are spontaneously printing odd "SQL" strings

#12

This reminds me when I was in college- I used to have VNC running on a public IP without any authentication (on purpose). Randomly, bots would connect, take over control of the screen, and print a bunch of test characters out in Notepad before disconnecting. I don't know if they just hit it by luck or if they were actively looking for/testing/saving open VNC servers.

You're always being scanned for everything. If I got a penny for every time my company was swept by a scanner, I'd be making more than my salary.

Re: Printers are spontaneously printing odd "SQL" strings

#13
post #11

This reminds me when I was in college- I used to have VNC running on a public IP without any authentication (on purpose). Randomly, bots would connect, take over control of the screen, and print a bunch of test characters out in Notepad before disconnecting. I don't know if they just hit it by luck or if they were actively looking for/testing/saving open VNC servers.

Why would you have it set it up that way, especially after witnessing bots connecting?

It was an old PC that I didn't care about and only used for testing. I was into security stuff, so it was interesting to see the bots connect (which it why I left it open).

Re: Printers are spontaneously printing odd "SQL" strings

#14

The strings contain "sqli" which some of the posters inferred to mean they were experiencing a SQL injection. I doubt this is actually the case. I will say, though, that I have a Brother printer like the one described where I work and have seen similar odd strings on papers that come out of it. At least one time, it's just printed gibberish. I think the common denominator is that these printers are openly shared on a…

I'm in the sqlite camp.

That would make sense, especially if it was just some kind of debugging message mentioning the sqlite version.

Re: Printers are spontaneously printing odd "SQL" strings

#15
I'm waiting for the great network printer security apocalypse. A bunch of these things are in a great position to turn around and launch attacks on the "chewy on the inside" networks of so many companies. Maybe this has already happened.

My printer has a dumb little print server running an embedded flavor of Linux and a publicly known hard-coded (!) root password. While mine is going to the slag heap sooner or later for that and several other fundamental problems, you can guess that many many more of them are out there just waiting to be taken for a ride.

These dumb little boxes may be underpowered, but once you get inside and set them up to forward packets for you, their raw CPU speed becomes less of an issue. You can run all of the fun attacks from a "real" machine and just let it bounce you to the inside world.

Hypothetically speaking, of course.

Re: Printers are spontaneously printing odd "SQL" strings

#16

This reminds me when I was in college- I used to have VNC running on a public IP without any authentication (on purpose). Randomly, bots would connect, take over control of the screen, and print a bunch of test characters out in Notepad before disconnecting. I don't know if they just hit it by luck or if they were actively looking for/testing/saving open VNC servers.

You're always being scanned for everything. If I got a penny for every time my company was swept by a scanner, I'd be making more than my salary.

This is almost an understatement.

My home servers get SLAMMED on a daily basis by a whole wonderful plethora of bots. Most recently has been Muieblackcat. Going on the whole salary analogy: I'd make my current salary plus a bit if I had a penny for ever scan on the box in my living room. I keep the Ukrainian IP's off my blacklist just for fun. Nothing sensitive on the server, just my web playpen. I kind of hope that one of these exploits works one day so I can see where I've slipped up.

Re: Printers are spontaneously printing odd "SQL" strings

#17

The strings contain "sqli" which some of the posters inferred to mean they were experiencing a SQL injection. I doubt this is actually the case. I will say, though, that I have a Brother printer like the one described where I work and have seen similar odd strings on papers that come out of it. At least one time, it's just printed gibberish. I think the common denominator is that these printers are openly shared on a…

The strings contain "sqli" which some of the posters inferred to mean they were experiencing a SQL injection. I doubt this is actually the case.

I'm certain you're correct. I've seen many SQL injection attacks, and not one of them has ever labelled itself as such.

Re: Printers are spontaneously printing odd "SQL" strings

#18
I've got a HP printer pretty similar to the one mentioned in the thread. In the course of trying to set it up, I by chance pointed my browser to the printer's network printing port. Interestingly enough it printed out all my browser headers. It seems like these printers just spit out anything that hits that port.

Re: Printers are spontaneously printing odd "SQL" strings

#19

The strings contain "sqli" which some of the posters inferred to mean they were experiencing a SQL injection. I doubt this is actually the case. I will say, though, that I have a Brother printer like the one described where I work and have seen similar odd strings on papers that come out of it. At least one time, it's just printed gibberish. I think the common denominator is that these printers are openly shared on a…

There's also "nmap" in the output, so this could be part of a combined port and vulnerability scan that hit the network printer.
Post reply on HN