31–40 of 150 posts
http://www.symantec.com/connect/blogs/trojanmilicenso-paper-... http://www.symantec.com/docs/TECH190982 http://isc.sans.edu/diary.html?storyid=13519
I did a project in college where I scanned networks for IPP ports and would print agit prop to them The printer panopticon. Oh art school.
Oh "BBrother" what an ironic comment this is .. /takes off paranoid hat
Earlier quoted context omitted.
You could have, you know, printed out that the printer was publicly accessible on the printer itself.
Yeah, that was part of the lolcats image. I can't quite remember what I did but it wasn't malicious.
The strings contain "sqli" which some of the posters inferred to mean they were experiencing a SQL injection. I doubt this is actually the case. I will say, though, that I have a Brother printer like the one described where I work and have seen similar odd strings on papers that come out of it. At least one time, it's just printed gibberish. I think the common denominator is that these printers are openly shared on a…
The strings contain "sqli" which some of the posters inferred to mean they were experiencing a SQL injection. I doubt this is actually the case. I'm certain you're correct. I've seen many SQL injection attacks, and not one of them has ever labelled itself as such.
> "[...] we're all forwarding port 9100 or 631 to our printer to allow ourselves to print from outside the network, which sets up an HTTP server at that address open to the internet. All it takes is for somebody to put the appropriate GET request in [...]" > "Both of our printers have public IP addresses" It looks like the printer are publicly accessible, and some automated tool (nmap?) is just scanning them for vuln…
> "[...] we're all forwarding port 9100 or 631 to our printer to allow ourselves to print from outside the network, which sets up an HTTP server at that address open to the internet. All it takes is for somebody to put the appropriate GET request in [...]" > "Both of our printers have public IP addresses" It looks like the printer are publicly accessible, and some automated tool (nmap?) is just scanning them for vuln…
Earlier quoted context omitted.
You're always being scanned for everything. If I got a penny for every time my company was swept by a scanner, I'd be making more than my salary.
This is almost an understatement. My home servers get SLAMMED on a daily basis by a whole wonderful plethora of bots. Most recently has been Muieblackcat. Going on the whole salary analogy: I'd make my current salary plus a bit if I had a penny for ever scan on the box in my living room. I keep the Ukrainian IP's off my blacklist just for fun. Nothing sensitive on the server, just my web playpen. I kind of hope that…
> "[...] we're all forwarding port 9100 or 631 to our printer to allow ourselves to print from outside the network, which sets up an HTTP server at that address open to the internet. All it takes is for somebody to put the appropriate GET request in [...]" > "Both of our printers have public IP addresses" It looks like the printer are publicly accessible, and some automated tool (nmap?) is just scanning them for vuln…
It is not surprising that printers just accept (possibly malformed) requests just from anywhere?
One poster said his/her printer did it on a machine not connected to the network, so it may not be a print server scanning thing.