Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Printers are spontaneously printing odd "SQL" strings

discussions.apple.com

Post reply on HN
Print view View original

61–70 of 150 posts

Re: Printers are spontaneously printing odd "SQL" strings

#61

Post by corin_ »

jorts wrote: post #60
corin_ wrote: post #56

Earlier quoted context omitted.

I've actually found it useful in the past to be able to print stuff when I'm not in the office - not useful enough that I really care about the feature, just that since it's there it saves a small step in the alternative of emailing then having them open and print it.

Why not setup a VPN to your home?

Would be to my office, and why not because I've never needed to. Our current printer can't do printing from over the internet and I don't care enough to bother setting it up.

Re: Printers are spontaneously printing odd "SQL" strings

#62

Post by munin »

cs702 wrote: post #41

Many, perhaps most network-connected printers, NAS units, and other devices (e.g., home-automation hardware) simply assume that the local network they connect to will be securely protected from external attack, so they're not configured to withstand even the simplest of attacks. This is exactly the opposite of what many security experts recommend: ideally all devices should be secure regardless of whether the network…

it's worth noting, I think, that Schneier is pretty out of touch when it comes to the whole "open wireless" thing, because he leaves himself open to a bunch of local-only attacks. he's correct that your computer should be able to withstand being on the 'open' internet, since it is every time you take it to work or a coffee shop or something, but, don't be an idiot, just turn WPA2 on at your house.

many access points (I think) now provide a feature where they can run multiple SSIDs. so if you're savvy, you can turn on a guest-only open wifi for when you have visitors, and turn it off when they leave. kind of like a guest key for your spare room!

Re: Printers are spontaneously printing odd "SQL" strings

#63

Post by Ixiaus »

cs702 wrote: post #41

Many, perhaps most network-connected printers, NAS units, and other devices (e.g., home-automation hardware) simply assume that the local network they connect to will be securely protected from external attack, so they're not configured to withstand even the simplest of attacks. This is exactly the opposite of what many security experts recommend: ideally all devices should be secure regardless of whether the network…

A friend of mine over here recently discovered that a certain printer manufacturer (very big one) had a complete SNMP service that runs on all the printers - they aren't protected and you can run any command on it. You can even tell the printer to download, load, and reboot with custom firmware. Amongst many other yucky things.

This sounds somewhat similar.

Re: Printers are spontaneously printing odd "SQL" strings

#64

Post by dfc »

cs702 wrote: post #41

Many, perhaps most network-connected printers, NAS units, and other devices (e.g., home-automation hardware) simply assume that the local network they connect to will be securely protected from external attack, so they're not configured to withstand even the simplest of attacks. This is exactly the opposite of what many security experts recommend: ideally all devices should be secure regardless of whether the network…

Rerun with "-sV --allports"

   --allports (Don't exclude any ports from version detection) .
       By default, Nmap version detection skips TCP port 9100 because some
       printers simply print anything sent to that port, leading to dozens
       of pages of HTTP GET requests, binary SSL session requests, etc.
       This behavior can be changed by modifying or removing the Exclude
       directive in nmap-service-probes, or you can specify --allports to
       scan all ports regardless of any Exclude directive.
PS I think the "-A" and "-T4" is redendant. I think aggressive mode sets the timing to 4 among other things.

Re: Printers are spontaneously printing odd "SQL" strings

#65

Post by robbiemitchell »

alanbyrne wrote: post #55

I'm going to guess that the common theme here is that we're all forwarding port 9100 or 631 to our printer to allow ourselves to print from outside the network, which sets up an HTTP server at that address open to the internet. Seriously?! Ignoring the fact that I can't remember when I last print something, who needs to print to their house from the internet? Can't they just print it when they get home?

Can you really not think of any cases?

- They have expensive software on a computer in one place that does not have a printer, and a printer at home without the software - A couple that works from home likes to collaborate while one of them is one the road, with one printing stuff directly to home after meeting with clients - They like to print stuff from work while things are on their mind (itineraries, boarding passes, etc.) so that they don't have to think about logistics once they're home with family - etc.

Beware the sentence that starts with "Can't they just..."

Re: Printers are spontaneously printing odd "SQL" strings

#66

Post by [deleted] »

dfc wrote: post #64
cs702 wrote: post #41

Many, perhaps most network-connected printers, NAS units, and other devices (e.g., home-automation hardware) simply assume that the local network they connect to will be securely protected from external attack, so they're not configured to withstand even the simplest of attacks. This is exactly the opposite of what many security experts recommend: ideally all devices should be secure regardless of whether the network…

Rerun with "-sV --allports" --allports (Don't exclude any ports from version detection) . By default, Nmap version detection skips TCP port 9100 because some printers simply print anything sent to that port, leading to dozens of pages of HTTP GET requests, binary SSL session requests, etc. This behavior can be changed by modifying or removing the Exclude directive in nmap-service-probes, or you can specify --allports…

[deleted]

Re: Printers are spontaneously printing odd "SQL" strings

#67

Post by bad_user »

munin wrote: post #62
cs702 wrote: post #41

Many, perhaps most network-connected printers, NAS units, and other devices (e.g., home-automation hardware) simply assume that the local network they connect to will be securely protected from external attack, so they're not configured to withstand even the simplest of attacks. This is exactly the opposite of what many security experts recommend: ideally all devices should be secure regardless of whether the network…

it's worth noting, I think, that Schneier is pretty out of touch when it comes to the whole "open wireless" thing, because he leaves himself open to a bunch of local-only attacks. he's correct that your computer should be able to withstand being on the 'open' internet, since it is every time you take it to work or a coffee shop or something, but, don't be an idiot, just turn WPA2 on at your house. many access points…

    he leaves himself open to a bunch of local-only attacks
What kind of attacks might those be?

Consider the case of a computer connected to the network with no open ports (other than say, 25 for SSH), with a properly configured firewall, that connects to the Internet through a VPN and with an operating system that auto-updates itself.

What could you do to it from inside the network?

Re: Printers are spontaneously printing odd "SQL" strings

#69

Post by axx »

mjhall wrote: post #23
rachelbythebay wrote: post #15

I'm waiting for the great network printer security apocalypse. A bunch of these things are in a great position to turn around and launch attacks on the "chewy on the inside" networks of so many companies. Maybe this has already happened. My printer has a dumb little print server running an embedded flavor of Linux and a publicly known hard-coded (!) root password. While mine is going to the slag heap sooner or later…

These two 28C3 talks[0,1] discuss the precursor to such an apocalypse. [0]: http://events.ccc.de/congress/2011/Fahrplan/events/4871.en.h... [1]: http://events.ccc.de/congress/2011/Fahrplan/events/4780.en.h...

I was going to submit those. Thanks!

Re: Printers are spontaneously printing odd "SQL" strings

#70

Post by cantankerous »

ch0wn wrote: post #19
cantankerous wrote: post #4

The strings contain "sqli" which some of the posters inferred to mean they were experiencing a SQL injection. I doubt this is actually the case. I will say, though, that I have a Brother printer like the one described where I work and have seen similar odd strings on papers that come out of it. At least one time, it's just printed gibberish. I think the common denominator is that these printers are openly shared on a…

There's also "nmap" in the output, so this could be part of a combined port and vulnerability scan that hit the network printer.

I think this idea is on to something and warrants more investigation.

Edit: That's probably what it is. A port scanner climbed through port 9100 and hit the JetDirect port on the printer, which prints whatever raw data it is given. Cool find!

Post reply on HN