Google has indexed thousands of publicly accessible HP printers

1. write a script to scrap google links to HP admin panel

2. filter out the IPs that are from US (given you want to work on US market)

3. assemble the list of printer types and current toner levels.

4. write a script that will print to each of those printers a one single page, stating your company "Cheapo Suppliers Inc" was notified that "your printer is low on toner. Call xxxxxx to re-fill. Lowest prices quaranteed within one day delivery!". You can add link to your shop page that already redirects user to specific type of printer they have, some type of one-click order (based on which toners are low).

5. daily rinse repeat.

6. sell your business to HP (at least try to).

Bruce Schneier's personal WiFi network at home is fully open, because -- in his own words: "If I configure my computer to be secure regardless of the network it's on, then it simply doesn't matter. And if my computer isn't secure on a public network, securing my own network isn't going to reduce my risk very much."[2]

I'm waiting for the great network printer security apocalypse...

--

I ran a quick nmap command (nmap -T4 -A -v -PE [IP address]) on a few of the many printers indexed by Google, and here's a typical result, showing tons of open ports and passwordless login options (I've deleted the hostname and IP address to protect the innocent):

  Starting Nmap 5.21 ( http://nmap.org ) at 2013-01-25 12:15 EST
  NSE: Loaded 36 scripts for scanning.
  Initiating Ping Scan at 12:15
  Scanning XXX.XXX.XXX.XXX [1 port]
  Completed Ping Scan at 12:15, 0.10s elapsed (1 total hosts)
  Initiating Parallel DNS resolution of 1 host. at 12:15
  Completed Parallel DNS resolution of 1 host. at 12:15, 0.14s elapsed
  Initiating Connect Scan at 12:15
  Scanning [HOSTNAME] (XXX.XXX.XXX.XXX) [1000 ports]
  Discovered open port 23/tcp on XXX.XXX.XXX.XXX
  Discovered open port 21/tcp on XXX.XXX.XXX.XXX
  Discovered open port 443/tcp on XXX.XXX.XXX.XXX
  Discovered open port 80/tcp on XXX.XXX.XXX.XXX
  Increasing send delay for XXX.XXX.XXX.XXX from 0 to 5 due to max_successful_tryno increase to 5
  Increasing send delay for XXX.XXX.XXX.XXX from 5 to 10 due to max_successful_tryno increase to 6
  Warning: XXX.XXX.XXX.XXX giving up on port because retransmission cap hit (6).
  Discovered open port 14000/tcp on XXX.XXX.XXX.XXX
  Discovered open port 631/tcp on XXX.XXX.XXX.XXX
  Discovered open port 280/tcp on XXX.XXX.XXX.XXX
  Completed Connect Scan at 12:15, 37.26s elapsed (1000 total ports)
  Initiating Service scan at 12:15
  Scanning 7 services on [HOSTNAME] (XXX.XXX.XXX.XXX)
  Completed Service scan at 12:16, 13.09s elapsed (7 services on 1 host)
  NSE: Script scanning XXX.XXX.XXX.XXX.
  NSE: Starting runlevel 1 (of 1) scan.
  Initiating NSE at 12:16
  Completed NSE at 12:16, 3.57s elapsed
  NSE: Script Scanning completed.
  Nmap scan report for [HOSTNAME] (XXX.XXX.XXX.XXX)
  Host is up (0.11s latency).
  Not shown: 978 closed ports
  PORT      STATE    SERVICE      VERSION
  21/tcp    open     ftp          HP LaserJet P4014 printer ftpd
  |_ftp-anon: Anonymous FTP login allowed
  23/tcp    open     telnet       HP JetDirect telnetd
  25/tcp    filtered smtp
  80/tcp    open     http         HP-ChaiSOE 1.0 (HP LaserJet http config)
  | html-title: hp LaserJet 9050
  |_Requested resource was http://XXX.XXX.XXX.XXX/hp/device/this.LCDispatcher
  111/tcp   filtered rpcbind
  135/tcp   filtered msrpc
  139/tcp   filtered netbios-ssn
  280/tcp   open     http         HP-ChaiSOE 1.0 (HP LaserJet http config)
  | html-title: hp LaserJet 9050
  |_Requested resource was http://XXX.XXX.XXX.XXX/hp/device/this.LCDispatcher
  443/tcp   open     ssl/http     HP-ChaiSOE 1.0 (HP LaserJet http config)
  | html-title: hp LaserJet 9050
  |_Requested resource was http://XXX.XXX.XXX.XXX/hp/device/this.LCDispatcher
  445/tcp   filtered microsoft-ds
  515/tcp   filtered printer
  631/tcp   open     http         HP-ChaiSOE 1.0 (HP LaserJet http config)
  | html-title: hp LaserJet 9050
  |_Requested resource was http://XXX.XXX.XXX.XXX/hp/device/this.LCDispatcher
  1433/tcp  filtered ms-sql-s
  1720/tcp  filtered H.323/Q.931
  3168/tcp  filtered unknown
  4550/tcp  filtered unknown
  6000/tcp  filtered X11
  6112/tcp  filtered dtspc
  8654/tcp  filtered unknown
  9100/tcp  filtered jetdirect
  14000/tcp open     tcpwrapped
  19315/tcp filtered unknown
  Service Info: Device: printer

[1] http://news.ycombinator.com/item?id=4412714

[2] http://www.schneier.com/blog/archives/2008/01/my_open_wirele...

I wouldn't be terribly surprised to find out my MFD has more persisted and recoverable in it than my first guess of how much it has (nothing), but it certainly doesn't have every page that's ever gone in or out of it.

And for those that haven't seen it.. do yourself a favour and sit through the entire hour-long video; you won't regret it.

http://arstechnica.com/security/2013/01/hack-turns-the-cisco...