Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Printers are spontaneously printing odd "SQL" strings

discussions.apple.com

Post reply on HN
Print view View original

131–140 of 150 posts

Re: Printers are spontaneously printing odd "SQL" strings

#131

Post by hrrsn »

ZoFreX wrote: post #50
igrekel wrote: post #22

Earlier quoted context omitted.

Yes, I used to do a netcat on printers to print for free in college.

Tip for networked computers in colleges, schools, workplaces, and similar environments: You can upload postscript files to them via FTP, this lets you bypass the printer queue running on a server somewhere. Why would you want to do this? Various nefarious reasons, but the reason I did it was because in 90+% printer outages at university, it was the queue server and not the printer itself experiencing a fault. If you…

We had this problem when I was still at high school. It worked for the most part, but when us photography students started printing to the photo printer all hell broke loose. Things would frequently take 30+ minutes to go through the Pharos print server. At the time they had just hired a new IT guy so we asked him if he could set the printer up on our personal laptops (we only had 3 workstations in the room). After much frustration he managed to get it running, except he accidentally set them up to print directly to the printer, not via the print server. Magically things started popping out after a minute or two, which got the teacher inquisitive. Eventually they realised that we weren't being charged for printing anymore when the print information had our personal computer usernames rather than ID numbers but couldn't blame us as they had set it up themselves. After being told not to do that anymore, we all just set up secondary users with our ID numbers so it all looked legit.

Re: Printers are spontaneously printing odd "SQL" strings

#132

Post by tedunangst »

a_bonobo wrote: post #129
b_emery wrote: post #123

Earlier quoted context omitted.

Wow, this works on my HP printer. That would explain the reams of pages I get that look like this: GET http://www.baidu.com/ HTTP/1.1 Host: www.baidu.com Accept: / Pragma: no-cache User-Agent:

I sometimes get the same ones at work! It's the crawler from the Baidu-search-engine checking if the printer is a web-server. I contacted ITS about it (obviously, you shouldn't be able to print from outside the university) but they haven't really given it any work. It surely is a security hole, and a minor waste of ink & paper.

Actually, it's somebody searching for an open proxy, note the inclusion of http and hostname in the GET. The baidu crawler wouldn't be so ridiculous as to request its own homepage from your server. Somebody is testing to see if they can get your server to proxy to baidu for them.

Re: Printers are spontaneously printing odd "SQL" strings

#133

Post by ethank »

dfranke wrote: post #116
ethank wrote: post #9

I did a project in college where I scanned networks for IPP ports and would print agit prop to them The printer panopticon. Oh art school.

Heh... a similar "project" when I was in high school got me sent to the principal's office once :-)

Yeah, I got a nice visit from campus security.

Re: Printers are spontaneously printing odd "SQL" strings

#134

Post by a_bonobo »

tedunangst wrote: post #132
a_bonobo wrote: post #129

Earlier quoted context omitted.

I sometimes get the same ones at work! It's the crawler from the Baidu-search-engine checking if the printer is a web-server. I contacted ITS about it (obviously, you shouldn't be able to print from outside the university) but they haven't really given it any work. It surely is a security hole, and a minor waste of ink & paper.

Actually, it's somebody searching for an open proxy, note the inclusion of http and hostname in the GET. The baidu crawler wouldn't be so ridiculous as to request its own homepage from your server. Somebody is testing to see if they can get your server to proxy to baidu for them.

But why so often then? Surely at some point you'd know there's an open port there and stop querying it.

Re: Printers are spontaneously printing odd "SQL" strings

#135

Post by tedunangst »

a_bonobo wrote: post #134
tedunangst wrote: post #132

Earlier quoted context omitted.

Actually, it's somebody searching for an open proxy, note the inclusion of http and hostname in the GET. The baidu crawler wouldn't be so ridiculous as to request its own homepage from your server. Somebody is testing to see if they can get your server to proxy to baidu for them.

But why so often then? Surely at some point you'd know there's an open port there and stop querying it.

Surely at some point these same people would realize there's no admin.php on my web server, but there they are, still looking for it...

Re: Printers are spontaneously printing odd "SQL" strings

#136

Post by k6b »

tedunangst wrote: post #135
a_bonobo wrote: post #134

Earlier quoted context omitted.

But why so often then? Surely at some point you'd know there's an open port there and stop querying it.

Surely at some point these same people would realize there's no admin.php on my web server, but there they are, still looking for it...

because they are automated bots...

Re: Printers are spontaneously printing odd "SQL" strings

#137

Post by ZoFreX »

hrrsn wrote: post #131
ZoFreX wrote: post #50

Earlier quoted context omitted.

Tip for networked computers in colleges, schools, workplaces, and similar environments: You can upload postscript files to them via FTP, this lets you bypass the printer queue running on a server somewhere. Why would you want to do this? Various nefarious reasons, but the reason I did it was because in 90+% printer outages at university, it was the queue server and not the printer itself experiencing a fault. If you…

We had this problem when I was still at high school. It worked for the most part, but when us photography students started printing to the photo printer all hell broke loose. Things would frequently take 30+ minutes to go through the Pharos print server. At the time they had just hired a new IT guy so we asked him if he could set the printer up on our personal laptops (we only had 3 workstations in the room). After m…

Ah, yes - I forgot to mention that side effect, bypassing the print queue will also mean you don't get charged (assuming your institution has a print credits system set up).

Re: Printers are spontaneously printing odd "SQL" strings

#138

Post by csense »

VLM wrote: post #117
zhoutong wrote: post #44

Earlier quoted context omitted.

Especially with the development of IPv6, internal routing becomes transparent and the appearance of protection offered by NAT is gone. Possibly these printers all have been assigned a public-reachable IPv6 addresses.

You can't be seriously claiming that someone is port scanning my /48 that I've had since the early 00s? Over a typical slow internet connection that would take rather a long time to find my printer. Lets say you slammed my couple megabit cablemodem with a million address probes per second (yes I'm well aware thats impossibly high). It would only take you 38 billion years of continuous scanning to find my printer. I'l…

As soon as some random website's PHP script publishes your IPv6 address, there goes your security.

Assuming your IP address will remain secret seems naive.

Also, this assumes your IP address within your /48 is randomly chosen. Common user choices (or router implementations) might not default to random choices, or the randomness might not actually be very random.

Re: Printers are spontaneously printing odd "SQL" strings

#139

Post by csense »

agwa wrote: post #104
gergles wrote: post #101

Earlier quoted context omitted.

It isn't an "appearance" of protection. NAT is the best thing to happen to security for home networks since their inception. The push to remove it with IPv6 and to force home users who don't care about these things to put their entire home network directly on the Internet is going to wreak havoc.

The security comes from the stateful firewall, not from the NAT. In all likelihood, IPv6-supporting home routers will ship with a stateful firewall enabled by default.

> In all likelihood, IPv6-supporting home routers will ship with a stateful firewall enabled by default.

My thinking is router manufacturers will probably not do this. Because if you don't have a firewall and expose all your computers to the Internet via IPv6, Everything Just Works (assuming the rest of the world uses IPv6, which will be a close approximation to the truth in the future world we're talking about). Which means those insecure routers will have a better user experience for the vast majority people in the market, who don't have a clue about networking and would rather gouge their eyes out than learn about it.

Routers currently don't do this for IPv4 for a good and simple reason: When you're assigned a single public IP by your ISP, there's no way to automagically tell which host is supposed to receive an inbound connection.

The "good" news (from a security standpoint) is that the most clueless will probably be using IPv4 for a long time to come, helped along in their foot-dragging by the eventual release of IPv4 space by early adopters of IPv6-only.

Re: Printers are spontaneously printing odd "SQL" strings

#140

Post by nickzoic »

csense wrote: post #138
VLM wrote: post #117

Earlier quoted context omitted.

You can't be seriously claiming that someone is port scanning my /48 that I've had since the early 00s? Over a typical slow internet connection that would take rather a long time to find my printer. Lets say you slammed my couple megabit cablemodem with a million address probes per second (yes I'm well aware thats impossibly high). It would only take you 38 billion years of continuous scanning to find my printer. I'l…

As soon as some random website's PHP script publishes your IPv6 address, there goes your security. Assuming your IP address will remain secret seems naive. Also, this assumes your IP address within your /48 is randomly chosen. Common user choices (or router implementations) might not default to random choices, or the randomness might not actually be very random.

... for example if the IPv6 address is autoconfed from the MAC address, then you can exploit the structure of the MAC address to target a much smaller range of address suffixes, specific to the manufacturer of your target device(s).
Post reply on HN