111–120 of 149 posts
Earlier quoted context omitted.
They're scam is that when they invoice - they hope that the company is big enough to the point where A/P just pays it when they say "Yeah so-and-so in IT confirmed this order" -- they are hoping that the initial contact and the AP departments dont talk.
Then why even bother sending a pallet of toner? Lots of other invoicing scams "invoice" for non-existent stuff.
So within 24 hours, lots of people are going to find out what a goatse is I reckon. Even better, a lot of people in the UK have Thomson routers which have an easily calculable WPA default password. Most of these also have smart tvs these days too which will allow anything to be pushed to them.
That rather looks to oversteps the legal line.
A friendly thing to do would be develop a script that took the google results, checked with whois for abuse address and sent emails. Of course that could also end up with one being sent to jail for a long time.
Should we now all print documents to those printers with warnings saying that they are publicly accessible?
And risk five years in prison for unauthorized access of a computer? I think not.
The other question, which would be fascinating to see raised in court I feel, is whether a printer is a "computer" within the terms of the law (CFAA, CMA(UK) or whatever).
You'd probably be able to question the meaning of access too - for example if you find an IP on Google and simply send data to port 9100 that's not really access, accessing a computer is 2 ways. If the law judged spamming port 91 as "access" then sending faxes or texting someone would come under the such legal acts .. that can't be within the intent of the law surely.
If other laws are used - "you sent them a message they didn't want" - then that's the end of [legal] unsolicited mail [yay!].
I've written about this before.[1] Many network-connected printers simply assume that the local network they connect to will be securely protected from external threats, so they're not configured to withstand even the simplest of attacks. This is exactly the opposite of what many security experts recommend: devices should be secure regardless of whether the network they're on is secure or not. Bruce Schneier's person…
I'd hate to be at the top of that google search result!!
Earlier quoted context omitted.
Lets not overreact here. The printers are on public wire. You had not done any crime by using Google to find them. You obtained access to their open HP admin panel via public link with no password or credentials you had to pass. You haven't stole any information and, furthermore, there is NO confidential information even to be stolen to start with. On the top of that, you cannot even determine who they are (name, com…
But you are not AUTHORISED to access said resources, so you would be in violation of the Computer Fraud and Abuse Act.
Am I the only one with this problem, or did Google really not index "thousands of publicly accessible HP printers"?
And again - so many wasted IPv4s...
Earlier quoted context omitted.
In a home network you typically have a router that separates your LAN (local area network) from the internet and shares one public IP among the devices in your network; in that case you have little to worry about. You can tell by the kinds of IP addresses your devices have: if it starts with 192.168.x.y, 172.x.y.z, or 10.x.y.z, then it's not reachable from the internet. The problem with these printers is that on thei…
Unless you have IPv6 turned on ... in which case many of these printers will automatically grab an IPv6 and be publicly accessible.
ip6tables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -A FORWARD -i eth0 -o br0 -p all -j DROP
ip6tables -A FORWARD -i br0 -j ACCEPT
ip6tables -A FORWARD -o br0 -j ACCEPT
ip6tables -A FORWARD -j DROP