Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has indexed thousands of publicly accessible HP printers

port3000.co.uk

Post reply on HN
Print view View original

101–110 of 149 posts

Re: Google has indexed thousands of publicly accessible HP printers

#101

Post by X-Istence »

andreasvc wrote: post #97
feefie wrote: post #51

How can I tell if my home printer is securely protected? Is there a good web page or text book anyone can recommend that will teach me more details about this? Thanks.

In a home network you typically have a router that separates your LAN (local area network) from the internet and shares one public IP among the devices in your network; in that case you have little to worry about. You can tell by the kinds of IP addresses your devices have: if it starts with 192.168.x.y, 172.x.y.z, or 10.x.y.z, then it's not reachable from the internet. The problem with these printers is that on thei…

Unless you have IPv6 turned on ... in which case many of these printers will automatically grab an IPv6 and be publicly accessible.

Re: Google has indexed thousands of publicly accessible HP printers

#102

Post by Mahn »

doktrin wrote: post #80
samstave wrote: post #28

Earlier quoted context omitted.

Nostalgia Scam Time: Back in the late 90s there was a common scam run against big-ish offices. A caller would call asking to talk to the person in charge of printers, typically either IT or Facilities. Once connected they would say that they are sending out the recipients free gift, which was some lame piece of electronics - often a small television. They would get the work address and confirmation to ship the free g…

I'm a little unclear as to how how exactly they planned to enforce payment for un-solicited toner. What am I missing?

Sending random invoices to companies hoping they'll just pay without thinking about it is a pretty common scam actually. Here in Germany for instance you start getting dozens of fake invoices via ordinary mail the exact second you register a new company, and I guess it's not very different in other countries.

Re: Google has indexed thousands of publicly accessible HP printers

#103

Post by jQueryIsAwesome »

X-Istence wrote: post #99
pbhjpbhj wrote: post #88

Earlier quoted context omitted.

Yes, I think you can. There have been case(s) I think (in USA) concerning websites where it was argued successfully that placing an non-password protected page available on the public internet was implied consent to access/use that service. That seems the right way to do it. You can't then, for example, put up a website which enables printing and then claim that people who use it are financially liable for using that…

Yeah, and there is a guy currently fighting in court because he changed some numbers in a URL and was able to get information on other customers from AT&T ... CFAA.

But we didn't change anything here; is just a website that says: "Select the file you want to print" and that's it.

Re: Google has indexed thousands of publicly accessible HP printers

#104

Post by 0x0 »

jQueryIsAwesome wrote: post #103
X-Istence wrote: post #99

Earlier quoted context omitted.

Yeah, and there is a guy currently fighting in court because he changed some numbers in a URL and was able to get information on other customers from AT&T ... CFAA.

But we didn't change anything here; is just a website that says: "Select the file you want to print" and that's it.

And you think the owners of the printers really enjoy others using them like that? That all those IPs are set up like this on purpose?

Re: Google has indexed thousands of publicly accessible HP printers

#105

Post by jrochkind1 »

eli wrote: post #49
KwanEsq wrote: post #14

Interestingly, if you try to browse far into the results, Google decided it actually only has 73 to display (after telling it to include ommitted similar results).

Google makes only a rough estimate of the total number of results. Try it on any query that returns a relatively small number of results.

86000 is certainly a _rough_ estimate of, um, 17.

Re: Google has indexed thousands of publicly accessible HP printers

#106

Post by njharman »

samstave wrote: post #94
doktrin wrote: post #80

Earlier quoted context omitted.

I'm a little unclear as to how how exactly they planned to enforce payment for un-solicited toner. What am I missing?

They're scam is that when they invoice - they hope that the company is big enough to the point where A/P just pays it when they say "Yeah so-and-so in IT confirmed this order" -- they are hoping that the initial contact and the AP departments dont talk.

Then why even bother sending a pallet of toner? Lots of other invoicing scams "invoice" for non-existent stuff.

Re: Google has indexed thousands of publicly accessible HP printers

#107

Post by njharman »

jQueryIsAwesome wrote: post #70
X-Istence wrote: post #62

Earlier quoted context omitted.

But you are not AUTHORISED to access said resources, so you would be in violation of the Computer Fraud and Abuse Act.

Who says I am not authorised? I can claim that public access is an implicit authorization, like any website! And there is no warning or message in the public control panels.

> Who says I am not authorised?

The Federal Prosecutor threatening with 50years of jail time Or you can accept this no-brainer plea bargain for only 1year.

See also, 50 million posts on this subject last couple weeks since prominent software engineer suicided himself.

Re: Google has indexed thousands of publicly accessible HP printers

#108

Post by pbhjpbhj »

X-Istence wrote: post #99
pbhjpbhj wrote: post #88

Earlier quoted context omitted.

Yes, I think you can. There have been case(s) I think (in USA) concerning websites where it was argued successfully that placing an non-password protected page available on the public internet was implied consent to access/use that service. That seems the right way to do it. You can't then, for example, put up a website which enables printing and then claim that people who use it are financially liable for using that…

Yeah, and there is a guy currently fighting in court because he changed some numbers in a URL and was able to get information on other customers from AT&T ... CFAA.

This is different in essential details. Google are indexing these pages. That means the pages are advertised as part of the public internet.

Now not every layman knows how to properly hook things up to the internet, but there is a definite implied consent in doing so. If the pages were restricted by password and we were bypassing it, or they were locked to an IP and we could spoof it, then there wouldn't be an implied consent to access the service being provided; but that's not the case here.

If you want to look at intent then it's notable that many listed are University addresses - people setting up those printers absolutely know what they're doing.

If you purposefully used excessive paper/ink or you kill the hardware with a broken firmware update then those things are definitely not authorised by the implied consent and would constitute vandalism.

Re: Google has indexed thousands of publicly accessible HP printers

#109

Post by pbhjpbhj »

mrj wrote: post #50
ihsw wrote: post #38

Earlier quoted context omitted.

That's a very bad idea, you should call your lawyer/a law firm to prepare for the impending deluge of threatening letters and lawsuits filed against you.

I only pointed out that there is more danger for people with publicly available printers than just getting random junk printed. You are jumping to conclusions.

These sorts of interfaces are often connected to fileshares, so there's probably a route in there for a cracker. Also it may be possible to upload firmware - either corrupted firmware that bricks the printer or firmware that sends copies of all printed docs to a file store.

Re: Google has indexed thousands of publicly accessible HP printers

#110

Post by pbhjpbhj »

X-Istence wrote: post #100
jQueryIsAwesome wrote: post #70

Earlier quoted context omitted.

Who says I am not authorised? I can claim that public access is an implicit authorization, like any website! And there is no warning or message in the public control panels.

http://en.wikipedia.org/wiki/Weev is getting sued for inputting information on a public website which at that point gave him details about users...

I don't see where the implied consent is unless they were advertising the availability of those addresses on the public internet, eg they were listed in Google. It's a small but crucial difference to the legal position IMO.
Post reply on HN