Printers are spontaneously printing odd "SQL" strings • Hacker News Board

Re: Printers are spontaneously printing odd "SQL" strings

#81

Post by mindslight » Tue, Aug 21, 2012, 4:05 PM UTC

ZoFreX wrote: post #50

igrekel wrote: post #22

Earlier quoted context omitted.

Yes, I used to do a netcat on printers to print for free in college.

Tip for networked computers in colleges, schools, workplaces, and similar environments: You can upload postscript files to them via FTP, this lets you bypass the printer queue running on a server somewhere. Why would you want to do this? Various nefarious reasons, but the reason I did it was because in 90+% printer outages at university, it was the queue server and not the printer itself experiencing a fault. If you…

I added several strategically-located university printers to my /etc/printcap such that I could just-in-time print homework from my dorm and pick it up on my way to class. True cloud printing ftw!

Re: Printers are spontaneously printing odd "SQL" strings

#82

Post by jen_h » Tue, Aug 21, 2012, 4:07 PM UTC

ahi wrote: post #53

fein wrote: post #16

Earlier quoted context omitted.

This is almost an understatement. My home servers get SLAMMED on a daily basis by a whole wonderful plethora of bots. Most recently has been Muieblackcat. Going on the whole salary analogy: I'd make my current salary plus a bit if I had a penny for ever scan on the box in my living room. I keep the Ukrainian IP's off my blacklist just for fun. Nothing sensitive on the server, just my web playpen. I kind of hope that…

I vaguely recall that unpatched XP averages just a couple minutes on a network before being owned. If you didn't have the SP on a disc it was a race between the updates and the bots. That might have been old linux propaganda though.

Not propaganda, I saw a great example of this once bringing up a Windows system on a residential line shared with other apartments. Seconds after the box's "Hey, there, Windows Update, got something for me?", the network slowed to a crawl and our router's (rejected) incoming connection log grew hot and heavy. Would be lovely if the massive influx of attempted incoming connections were just eager WindowsUpdate systems, but unless Microsoft moved their infrastructure to China and Romania...

Anyway, there's a reason to travel with your own locked-down router and to never connect through anyone else's connection directly, especially if you're running Windows. Even that's not foolproof, but at least you've got an Angry Bouncer protecting the Windows Club. Windows Update connections totally feel like spotlights and booming bass.

Re: Printers are spontaneously printing odd "SQL" strings

#83

Post by tonyedgecombe » Tue, Aug 21, 2012, 4:08 PM UTC

jorts wrote: post #60

corin_ wrote: post #56

Earlier quoted context omitted.

I've actually found it useful in the past to be able to print stuff when I'm not in the office - not useful enough that I really care about the feature, just that since it's there it saves a small step in the alternative of emailing then having them open and print it.

Why not setup a VPN to your home?

Isn't this the purpose of Google Cloud Print http://www.google.com/cloudprint/learn/

Re: Printers are spontaneously printing odd "SQL" strings

#84

Post by sixothree » Tue, Aug 21, 2012, 4:08 PM UTC

lftl wrote: post #18

I've got a HP printer pretty similar to the one mentioned in the thread. In the course of trying to set it up, I by chance pointed my browser to the printer's network printing port. Interestingly enough it printed out all my browser headers. It seems like these printers just spit out anything that hits that port.

I never would have expected that, but it would certainly explain what we're seeing.

Re: Printers are spontaneously printing odd "SQL" strings

#85

Post by samstave » Tue, Aug 21, 2012, 4:09 PM UTC

tantalor wrote: post #79

samstave wrote: post #59

Earlier quoted context omitted.

Semi off topic anecdote: when I was at Lockheed the head of HR came to me with a Manila envelope and said "I need to know who printed this and when! And I need to know now!" I took the envelope and looked at it... It was a bunch of prints of gay porn and gay porn websites. After a few minutes of digging, it was revealed to be one of the directors in the company had printed them late the night before. Checking the bad…

> He was previously thought to be a married straight guy. Not sure why this is relevant. Are you saying Lockheed has/had a don't-ask-don't-tell policy?

Maybe that was worded inadequately; he was a married straight guy, with kids... But his printing spree was kind of a shock.

Re: Printers are spontaneously printing odd "SQL" strings

#86

Post by ArbitraryLimits » Tue, Aug 21, 2012, 4:13 PM UTC

cs702 wrote: post #41

Many, perhaps most network-connected printers, NAS units, and other devices (e.g., home-automation hardware) simply assume that the local network they connect to will be securely protected from external attack, so they're not configured to withstand even the simplest of attacks. This is exactly the opposite of what many security experts recommend: ideally all devices should be secure regardless of whether the network…

It's not 1994, no one "points" a browser at anything any more.

Re: Printers are spontaneously printing odd "SQL" strings

#87

Post by thisisblurry » Tue, Aug 21, 2012, 4:14 PM UTC

ArbitraryLimits wrote: post #86

cs702 wrote: post #41

Many, perhaps most network-connected printers, NAS units, and other devices (e.g., home-automation hardware) simply assume that the local network they connect to will be securely protected from external attack, so they're not configured to withstand even the simplest of attacks. This is exactly the opposite of what many security experts recommend: ideally all devices should be secure regardless of whether the network…

It's not 1994, no one "points" a browser at anything any more.

Look for the good in that post, don't nitpick the phrasing that was chosen.

Re: Printers are spontaneously printing odd "SQL" strings

#88

Post by lamebrain » Tue, Aug 21, 2012, 4:15 PM UTC

cantankerous wrote: post #4

The strings contain "sqli" which some of the posters inferred to mean they were experiencing a SQL injection. I doubt this is actually the case. I will say, though, that I have a Brother printer like the one described where I work and have seen similar odd strings on papers that come out of it. At least one time, it's just printed gibberish. I think the common denominator is that these printers are openly shared on a…

Yeah. The person freaking out about SQL injections is funny because it's not as if an attack consists of explicitly telling the server you're going to do SQL injection to it. You don't say "OK, call the SQL injection routine now please!" It's... slightly more complicated than that.

Re: Printers are spontaneously printing odd "SQL" strings

#89

Post by cantankerous » Tue, Aug 21, 2012, 4:18 PM UTC

After playing around with it. I think that what is causing this to happen is that the JetDirect port on the printer (usually 9100) is getting written to by a port scanner. This will cause a printer using JetDirect to print out whatever gets sent to it on that port. Try it yourself if you have a printer that implements it. For me it was a Brother HD-5370DW.

1. telnet 9100

2. Type a hello world message.

3. Close the connection

4. The printer will print out whatever you typed. At least it did for me.

Re: Printers are spontaneously printing odd "SQL" strings

#90

Post by graywh » Tue, Aug 21, 2012, 4:20 PM UTC

ahi wrote: post #53

fein wrote: post #16

Earlier quoted context omitted.

This is almost an understatement. My home servers get SLAMMED on a daily basis by a whole wonderful plethora of bots. Most recently has been Muieblackcat. Going on the whole salary analogy: I'd make my current salary plus a bit if I had a penny for ever scan on the box in my living room. I keep the Ukrainian IP's off my blacklist just for fun. Nothing sensitive on the server, just my web playpen. I kind of hope that…

I vaguely recall that unpatched XP averages just a couple minutes on a network before being owned. If you didn't have the SP on a disc it was a race between the updates and the bots. That might have been old linux propaganda though.

When I showed up for my first day of work 8 years ago, a newly installed WinXP system awaited me. I had to patch the system that morning because it had been powered on and connected to the network for several days already.