Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has indexed thousands of publicly accessible HP printers

port3000.co.uk

Post reply on HN
Print view View original

91–100 of 149 posts

Re: Google has indexed thousands of publicly accessible HP printers

#91

Post by rayiner »

csense wrote: post #71
plumeria wrote: post #64

Earlier quoted context omitted.

Why would anyone go to jail for this?

The nail that sticks up gets hammered. If someone else later does something bad with the publicly accessible printer and there's a witch hunt for the responsible party, and the only lead they have is that you emailed them about the possibility in advance...then they'll go after you, even though you were just trying to do a good thing. And if you're expecting the victim / police / legal system to understand that, tech…

I should note that this isn't unique to computers, by the way. You should also never leave a note on an unlocked car saying "hey, noticed your car was unlocked --signed XYZ".

Re: Google has indexed thousands of publicly accessible HP printers

#92

Post by sandycheeks »

The first thing I thought of was a course that I took decades ago that discussed using printers for covert channels to get data out of secure networks.

I wonder if any of those are honeypots. It may be interesting to see if any visitors do something clever or unexpected.

Re: Google has indexed thousands of publicly accessible HP printers

#93

Post by 0x0 »

pbhjpbhj wrote: post #88
bmm6o wrote: post #78

Earlier quoted context omitted.

Can you really argue in good faith that you are legally authorized to print something on their printer?

Yes, I think you can. There have been case(s) I think (in USA) concerning websites where it was argued successfully that placing an non-password protected page available on the public internet was implied consent to access/use that service. That seems the right way to do it. You can't then, for example, put up a website which enables printing and then claim that people who use it are financially liable for using that…

Do you really believe that? That the owners of the printers on this public wire would appreciate, in fact deliberately encourage, anonymous users accessing them like that?

Re: Google has indexed thousands of publicly accessible HP printers

#94

Post by samstave »

doktrin wrote: post #80
samstave wrote: post #28

Earlier quoted context omitted.

Nostalgia Scam Time: Back in the late 90s there was a common scam run against big-ish offices. A caller would call asking to talk to the person in charge of printers, typically either IT or Facilities. Once connected they would say that they are sending out the recipients free gift, which was some lame piece of electronics - often a small television. They would get the work address and confirmation to ship the free g…

I'm a little unclear as to how how exactly they planned to enforce payment for un-solicited toner. What am I missing?

They're scam is that when they invoice - they hope that the company is big enough to the point where A/P just pays it when they say "Yeah so-and-so in IT confirmed this order" -- they are hoping that the initial contact and the AP departments dont talk.

Re: Google has indexed thousands of publicly accessible HP printers

#95

Post by samstave »

illuminate wrote: post #86
doktrin wrote: post #80

Earlier quoted context omitted.

I'm a little unclear as to how how exactly they planned to enforce payment for un-solicited toner. What am I missing?

http://business.ftc.gov/documents/bus24-avoiding-office-supp... They threaten, talk to A/P directly and demand payment (skipping over the original agent), all sorts of ways.

Exactly.

Re: Google has indexed thousands of publicly accessible HP printers

#97

Post by andreasvc »

feefie wrote: post #51

How can I tell if my home printer is securely protected? Is there a good web page or text book anyone can recommend that will teach me more details about this? Thanks.

In a home network you typically have a router that separates your LAN (local area network) from the internet and shares one public IP among the devices in your network; in that case you have little to worry about. You can tell by the kinds of IP addresses your devices have: if it starts with 192.168.x.y, 172.x.y.z, or 10.x.y.z, then it's not reachable from the internet. The problem with these printers is that on their network there's no such separation and they are listening on a publicly routed IP address, but they've been designed with the tacit assumption that they will be used on a secured network.

Re: Google has indexed thousands of publicly accessible HP printers

#98

Post by cs702 »

mattkirman wrote: post #89
cs702 wrote: post #13

I've written about this before.[1] Many network-connected printers simply assume that the local network they connect to will be securely protected from external threats, so they're not configured to withstand even the simplest of attacks. This is exactly the opposite of what many security experts recommend: devices should be secure regardless of whether the network they're on is secure or not. Bruce Schneier's person…

A few months ago I erroneously port scanned our office HP networked printers (I meant to scan our internal servers but a typo meant I selected the wrong IP range). As soon as nmap encountered the JetDirect ports every single printer spewed out a dozen pages of total gibberish. Put it this way - I bet the owners of the printers you just scanned are slightly puzzled why their printer kicked into life. More worryingly i…

mattkirman: nothing happened to the owners of those printers, because I didn't run nmap with the "--allports" option. As the man page explains, by default nmap doesn't send anything to port 9100 precisely to avoid running into this issue:

  --allports (Don't exclude any ports from version detection).
      By default, Nmap version detection skips TCP port 9100 because some
      printers simply print anything sent to that port, leading to dozens
      of pages of HTTP GET requests, binary SSL session requests, etc.
      This behavior can be changed by modifying or removing the Exclude
      directive in nmap-service-probes, or you can specify --allports to
      scan all ports regardless of any Exclude directive.

Re: Google has indexed thousands of publicly accessible HP printers

#99

Post by X-Istence »

pbhjpbhj wrote: post #88
bmm6o wrote: post #78

Earlier quoted context omitted.

Can you really argue in good faith that you are legally authorized to print something on their printer?

Yes, I think you can. There have been case(s) I think (in USA) concerning websites where it was argued successfully that placing an non-password protected page available on the public internet was implied consent to access/use that service. That seems the right way to do it. You can't then, for example, put up a website which enables printing and then claim that people who use it are financially liable for using that…

Yeah, and there is a guy currently fighting in court because he changed some numbers in a URL and was able to get information on other customers from AT&T ... CFAA.

Re: Google has indexed thousands of publicly accessible HP printers

#100

Post by X-Istence »

jQueryIsAwesome wrote: post #70
X-Istence wrote: post #62

Earlier quoted context omitted.

But you are not AUTHORISED to access said resources, so you would be in violation of the Computer Fraud and Abuse Act.

Who says I am not authorised? I can claim that public access is an implicit authorization, like any website! And there is no warning or message in the public control panels.

http://en.wikipedia.org/wiki/Weev is getting sued for inputting information on a public website which at that point gave him details about users...
Post reply on HN