Live data from Hacker News

Printers are spontaneously printing odd "SQL" strings

discussions.apple.com

41–50 of 150 posts

Re: Printers are spontaneously printing odd "SQL" strings

#41
Many, perhaps most network-connected printers, NAS units, and other devices (e.g., home-automation hardware) simply assume that the local network they connect to will be securely protected from external attack, so they're not configured to withstand even the simplest of attacks.

This is exactly the opposite of what many security experts recommend: ideally all devices should be secure regardless of whether the network they're on is secure or not. With more and more devices offering remote-Internet-access functionality every day, this principle of security is becoming ever more fundamental.

Bruce Schneier's personal WiFi network at home is fully open, because -- in his own words: "If I configure my computer to be secure regardless of the network it's on, then it simply doesn't matter. And if my computer isn't secure on a public network, securing my own network isn't going to reduce my risk very much."[1]

Like rachelbythebay, I'm also waiting for the great network printer security apocalypse.[2]

--

[1] http://www.schneier.com/blog/archives/2008/01/my_open_wirele...

[2] http://news.ycombinator.com/item?id=4412522

--

UPDATE: Just for the heck of it, I ran a fairly fast scan (nmap -T4 -A -v -PE [IP address]) on an HP all-in-one printer accessible over my LAN, and there were a LOT of open ports -- see pasted results below. I then pointed my browser to port 9100 on the printer, which instantly printed the HTTP headers without complaint. The printer's configuration page reports that it is "secured" by an administrative password.

  PORT     STATE SERVICE      VERSION
  80/tcp   open  http         HP PhotoSmart/Deskjet printer http config (Virata embedded httpd 6_0_1)
  139/tcp  open  netbios-ssn?
  6839/tcp open  tcpwrapped
  7435/tcp open  tcpwrapped
  8089/tcp open  tcpwrapped
  9100/tcp open  jetdirect?
  9101/tcp open  jetdirect?
  9102/tcp open  jetdirect?
  9110/tcp open  unknown
  9220/tcp open  hp-gsg       HP Generic Scan Gateway 1.0
  9290/tcp open  hp-gsg       IEEE 1284.4 scan peripheral gateway
  9500/tcp open  unknown

Re: Printers are spontaneously printing odd "SQL" strings

#42
I get that this just looks like a scan but it's strange that half a dozen people reported it at the same time (so the problem is likely more widespread). How long would it take to send these packets to all public ips in the world (real question, I have no sense of the scale of ip addresses)? I guess it could be that the ips are known to be running printers by a previous scan. Maybe the printers contact home and the HP accidentally sent them a bad message?

Re: Printers are spontaneously printing odd "SQL" strings

#44
post #41

Many, perhaps most network-connected printers, NAS units, and other devices (e.g., home-automation hardware) simply assume that the local network they connect to will be securely protected from external attack, so they're not configured to withstand even the simplest of attacks. This is exactly the opposite of what many security experts recommend: ideally all devices should be secure regardless of whether the network…

Especially with the development of IPv6, internal routing becomes transparent and the appearance of protection offered by NAT is gone. Possibly these printers all have been assigned a public-reachable IPv6 addresses.

Re: Printers are spontaneously printing odd "SQL" strings

#45
post #41

Many, perhaps most network-connected printers, NAS units, and other devices (e.g., home-automation hardware) simply assume that the local network they connect to will be securely protected from external attack, so they're not configured to withstand even the simplest of attacks. This is exactly the opposite of what many security experts recommend: ideally all devices should be secure regardless of whether the network…

Unfortunately, trying to secure your hardware is a lesson in frustration and ruins the whole experience.

This is because every device acts confused, hangs or produces cryptic errors when facing denied access; restricted resources prevent you from understanding why the access was denied and how to open it; changes in network topology lead to problems that only stumbled over much later; and it's extremelly hostile on guests who spend half a hour trying to configure.

It's untractable.

Most of user crypto has same set of problems btw.

Re: Printers are spontaneously printing odd "SQL" strings

#46
post #37
post #2

> "[...] we're all forwarding port 9100 or 631 to our printer to allow ourselves to print from outside the network, which sets up an HTTP server at that address open to the internet. All it takes is for somebody to put the appropriate GET request in [...]" > "Both of our printers have public IP addresses" It looks like the printer are publicly accessible, and some automated tool (nmap?) is just scanning them for vuln…

It is not surprising that printers just accept (possibly malformed) requests just from anywhere?

If I remember the presentation I saw on this, some don't even verify firmware updates.

http://ids.cs.columbia.edu/sites/default/files/CuiPrintMeIfY...

http://engineering.columbia.edu/can-you-trust-your-printer

Re: Printers are spontaneously printing odd "SQL" strings

#47
Pretty typical behavior when running vulnerability scanning against a printer target.

Many printers will simply print whatever data comes into certain ports. Have seen similar behavior many times when running web scanning against a printer accidentally instead of a webserver.

Re: Printers are spontaneously printing odd "SQL" strings

#48
No need to worry, all Mac's are virus, malware and attack proof and so (by the law of distortion of reality) are any devices or networks attached to a Mac. Go about your business and forget about that pesky "security" thing everyone else likes to talk about. Just etch a picture of Steve striking a thoughtful pose on the lid of your laptop and all your problems will be forgotten.

Re: Printers are spontaneously printing odd "SQL" strings

#49
post #16

Earlier quoted context omitted.

This is almost an understatement. My home servers get SLAMMED on a daily basis by a whole wonderful plethora of bots. Most recently has been Muieblackcat. Going on the whole salary analogy: I'd make my current salary plus a bit if I had a penny for ever scan on the box in my living room. I keep the Ukrainian IP's off my blacklist just for fun. Nothing sensitive on the server, just my web playpen. I kind of hope that…

It's not a scan, it's free surprise pen testing!

The only difference between pen testing and hacking is permission.

Re: Printers are spontaneously printing odd "SQL" strings

#50
post #22
post #18

I've got a HP printer pretty similar to the one mentioned in the thread. In the course of trying to set it up, I by chance pointed my browser to the printer's network printing port. Interestingly enough it printed out all my browser headers. It seems like these printers just spit out anything that hits that port.

Yes, I used to do a netcat on printers to print for free in college.

Tip for networked computers in colleges, schools, workplaces, and similar environments: You can upload postscript files to them via FTP, this lets you bypass the printer queue running on a server somewhere. Why would you want to do this? Various nefarious reasons, but the reason I did it was because in 90+% printer outages at university, it was the queue server and not the printer itself experiencing a fault.

If you don't know the IP address of the printer, you can normally get them to print out a diagnostics page by fiddling with the buttons, and this page will contain that information. So far I have always succeeded at logging in with guest credentials.

To network admins who don't want people bypassing their queues: vlan your printers!

Post reply on HN