Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Printers are spontaneously printing odd "SQL" strings

discussions.apple.com

Post reply on HN
Print view View original

121–130 of 150 posts

Re: Printers are spontaneously printing odd "SQL" strings

#121

Post by CWuestefeld »

CWuestefeld wrote: post #17
cantankerous wrote: post #4

The strings contain "sqli" which some of the posters inferred to mean they were experiencing a SQL injection. I doubt this is actually the case. I will say, though, that I have a Brother printer like the one described where I work and have seen similar odd strings on papers that come out of it. At least one time, it's just printed gibberish. I think the common denominator is that these printers are openly shared on a…

The strings contain "sqli" which some of the posters inferred to mean they were experiencing a SQL injection. I doubt this is actually the case. I'm certain you're correct. I've seen many SQL injection attacks, and not one of them has ever labelled itself as such.

Seven hours after posting, I've racked up 21 points for this comment.

I think this shows a defect in the blind voting we've had here for the last year or so. There's no way this off-hand comment is worth that much karma, but nobody can see that I'm being overcompensated for it.

(Sorry for the OT meta-post)

Re: Printers are spontaneously printing odd "SQL" strings

#122

Post by 0x0 »

munin wrote: post #106
bad_user wrote: post #67

Earlier quoted context omitted.

he leaves himself open to a bunch of local-only attacks What kind of attacks might those be? Consider the case of a computer connected to the network with no open ports (other than say, 25 for SSH), with a properly configured firewall, that connects to the Internet through a VPN and with an operating system that auto-updates itself. What could you do to it from inside the network?

man-in-the middle the windows update channel (see: flame) man-in-the-middle the VPN man-in-the-middle administration of the router / wireless access point, which frequently is done without ssl

dhcp exploits, too, both against clients and any existing server.

Re: Printers are spontaneously printing odd "SQL" strings

#123

Post by b_emery »

cantankerous wrote: post #89

After playing around with it. I think that what is causing this to happen is that the JetDirect port on the printer (usually 9100) is getting written to by a port scanner. This will cause a printer using JetDirect to print out whatever gets sent to it on that port. Try it yourself if you have a printer that implements it. For me it was a Brother HD-5370DW. 1. telnet 9100 2. Type a hello world message. 3. Close the co…

Wow, this works on my HP printer. That would explain the reams of pages I get that look like this:

GET http://www.baidu.com/ HTTP/1.1

Host: www.baidu.com

Accept: /

Pragma: no-cache

User-Agent:

Re: Printers are spontaneously printing odd "SQL" strings

#124

Post by eli »

brokenparser wrote: post #108
da_n wrote: post #105

Earlier quoted context omitted.

Can confirm this works on my Epson printer (SX535WD).

@PJL RDYMSG DISPLAY="Tray 1 Load Plain Letter" Confuses the heck out of your coworkers.

A while back I hacked a cronjob to update mine with the current weather forecast.

Re: Printers are spontaneously printing odd "SQL" strings

#125

Post by bcl »

dfc wrote: post #51
bcl wrote: post #36

Earlier quoted context omitted.

When nmap scans port 9100 it doesn't send anything (at least as of nmap 6.00 using -sV). It is probably a higher level vulnerability scanner, possibly metasploit, using nmap to discover open ports and then probe deeper on its own.

Nmap avoids sending to 9100 specifically to avoid sending data that the printer may misinterpret as data to be written to a page. You need to give it the --allports option. --allports (Don't exclude any ports from version detection) . By default, Nmap version detection skips TCP port 9100 because some printers simply print anything sent to that port, leading to dozens of pages of HTTP GET requests, binary SSL session…

Thanks!

Re: Printers are spontaneously printing odd "SQL" strings

#127

Post by eli »

eli wrote: post #124
brokenparser wrote: post #108

Earlier quoted context omitted.

@PJL RDYMSG DISPLAY="Tray 1 Load Plain Letter" Confuses the heck out of your coworkers.

A while back I hacked a cronjob to update mine with the current weather forecast.

In fact, it's here http://www.elidickinson.com/story/weather-updates-your-hp-pr...

I think it was the first python script I wrote.

Re: Printers are spontaneously printing odd "SQL" strings

#128

Post by mikeash »

pasbesoin wrote: post #75
bad_user wrote: post #67

Earlier quoted context omitted.

he leaves himself open to a bunch of local-only attacks What kind of attacks might those be? Consider the case of a computer connected to the network with no open ports (other than say, 25 for SSH), with a properly configured firewall, that connects to the Internet through a VPN and with an operating system that auto-updates itself. What could you do to it from inside the network?

Well, if his Internet connection is open, then he's open to being prosecuted for what other people might download on it. As a celebrity, he probably has some substantial de facto immunity against this. (One blog post, and "the Internet" will show up on his side.) The rest of us... not so much.

That assumes that his network allows anyone to connect to the internet from it, which is not implied here. Open wifi usually lets anyone who hops on the network talk to the world, but I'd bet someone like Schneier is more sophisticated about that sort of thing.

Re: Printers are spontaneously printing odd "SQL" strings

#129

Post by a_bonobo »

b_emery wrote: post #123
cantankerous wrote: post #89

After playing around with it. I think that what is causing this to happen is that the JetDirect port on the printer (usually 9100) is getting written to by a port scanner. This will cause a printer using JetDirect to print out whatever gets sent to it on that port. Try it yourself if you have a printer that implements it. For me it was a Brother HD-5370DW. 1. telnet 9100 2. Type a hello world message. 3. Close the co…

Wow, this works on my HP printer. That would explain the reams of pages I get that look like this: GET http://www.baidu.com/ HTTP/1.1 Host: www.baidu.com Accept: / Pragma: no-cache User-Agent:

I sometimes get the same ones at work! It's the crawler from the Baidu-search-engine checking if the printer is a web-server.

I contacted ITS about it (obviously, you shouldn't be able to print from outside the university) but they haven't really given it any work. It surely is a security hole, and a minor waste of ink & paper.

Re: Printers are spontaneously printing odd "SQL" strings

#130

Post by grapefruit »

microtonal wrote: post #21
adrinavarro wrote: post #3

From the comments it seems that it's people sharing their printer, apparently some form of access over the internet (or local network).

Given that these are connected to Airports, they are probably using Back to my Mac: http://en.wikipedia.org/wiki/Back_to_My_Mac

Services shared via Back to My Mac aren't directly accessible from the internet at large. Services shared using Wide-Area Bonjour are publicly exposed.
Post reply on HN