Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has indexed thousands of publicly accessible HP printers

port3000.co.uk

Post reply on HN
Print view View original

71–80 of 149 posts

Re: Google has indexed thousands of publicly accessible HP printers

#71

Post by csense »

plumeria wrote: post #64
mentat wrote: post #58

A friendly thing to do would be develop a script that took the google results, checked with whois for abuse address and sent emails. Of course that could also end up with one being sent to jail for a long time.

Why would anyone go to jail for this?

The nail that sticks up gets hammered.

If someone else later does something bad with the publicly accessible printer and there's a witch hunt for the responsible party, and the only lead they have is that you emailed them about the possibility in advance...then they'll go after you, even though you were just trying to do a good thing.

And if you're expecting the victim / police / legal system to understand that, technically speaking, it could have literally been anyone with an Internet connection...Or if you think that your good intentions and lack of criminal record mean that the most you'll get is a slap on the wrist even if they think your email "proves" that you did it...you're quite naive, especially given all the recent coverage of Aaron Swartz.

Re: Google has indexed thousands of publicly accessible HP printers

#72

Post by flxmglrb »

modernerd wrote: post #23

Some of the IPs are registered to large US universities, who list abuse/tech support email addresses in their records. I've already emailed several with a headsup and had a couple of "thank you!"s in reply.

You're lucky you haven't gotten accused of "hacking" yet.

Re: Google has indexed thousands of publicly accessible HP printers

#74

Post by TranceMan »

csense wrote: post #71
plumeria wrote: post #64

Earlier quoted context omitted.

Why would anyone go to jail for this?

The nail that sticks up gets hammered. If someone else later does something bad with the publicly accessible printer and there's a witch hunt for the responsible party, and the only lead they have is that you emailed them about the possibility in advance...then they'll go after you, even though you were just trying to do a good thing. And if you're expecting the victim / police / legal system to understand that, tech…

> The nail that sticks up gets hammered.

Thank you.

Re: Google has indexed thousands of publicly accessible HP printers

#75

Post by JoblessWonder »

X-Istence wrote: post #59
samstave wrote: post #28

Earlier quoted context omitted.

Nostalgia Scam Time: Back in the late 90s there was a common scam run against big-ish offices. A caller would call asking to talk to the person in charge of printers, typically either IT or Facilities. Once connected they would say that they are sending out the recipients free gift, which was some lame piece of electronics - often a small television. They would get the work address and confirmation to ship the free g…

No nostalgia required ... they still call, even the small business I work for gets at least one or two calls for toner cartridges and we work for your printing company a month.

Yup. They are still around and pretty ruthless. They get the printer models on the first call from a receptionist or someone "I'm calling about fixing the printer... that's a... HP... right? No? Konica, yeah, that's right we have that change in our forms."

Then they call back again and ask for the person in charge of ordering toner and reference the exact model. Sigh. Almost as bad as the "yellow page" people.

Re: Google has indexed thousands of publicly accessible HP printers

#77

Post by meaty »

So within 24 hours, lots of people are going to find out what a goatse is I reckon.

Even better, a lot of people in the UK have Thomson routers which have an easily calculable WPA default password. Most of these also have smart tvs these days too which will allow anything to be pushed to them.

Re: Google has indexed thousands of publicly accessible HP printers

#78

Post by bmm6o »

jQueryIsAwesome wrote: post #70
X-Istence wrote: post #62

Earlier quoted context omitted.

But you are not AUTHORISED to access said resources, so you would be in violation of the Computer Fraud and Abuse Act.

Who says I am not authorised? I can claim that public access is an implicit authorization, like any website! And there is no warning or message in the public control panels.

Can you really argue in good faith that you are legally authorized to print something on their printer?

Re: Google has indexed thousands of publicly accessible HP printers

#79

Post by meaty »

cs702 wrote: post #13

I've written about this before.[1] Many network-connected printers simply assume that the local network they connect to will be securely protected from external threats, so they're not configured to withstand even the simplest of attacks. This is exactly the opposite of what many security experts recommend: devices should be secure regardless of whether the network they're on is secure or not. Bruce Schneier's person…

The same goes for smart tvs. Most of them you can push stuff to via dnla without a password. Much amusement to be had.

Re: Google has indexed thousands of publicly accessible HP printers

#80

Post by doktrin »

samstave wrote: post #28
joering2 wrote: post #11

Idea for startup. 1. write a script to scrap google links to HP admin panel 2. filter out the IPs that are from US (given you want to work on US market) 3. assemble the list of printer types and current toner levels. 4. write a script that will print to each of those printers a one single page, stating your company "Cheapo Suppliers Inc" was notified that "your printer is low on toner. Call xxxxxx to re-fill. Lowest…

Nostalgia Scam Time: Back in the late 90s there was a common scam run against big-ish offices. A caller would call asking to talk to the person in charge of printers, typically either IT or Facilities. Once connected they would say that they are sending out the recipients free gift, which was some lame piece of electronics - often a small television. They would get the work address and confirmation to ship the free g…

I'm a little unclear as to how how exactly they planned to enforce payment for un-solicited toner. What am I missing?
Post reply on HN