Slashdot Mirror
Exposed HP LaserJet Printers Offer Anonymous FTP To the Public (csoonline.com)
itwbennett writes: In a blog post on Monday, security researcher Chris Vickery outlined the risks associated with networked HP LaserJet printers, which have been made available to the public by the organizations hosting them. 'There are a few free, open source pieces of software that can be used to upload and interact with HP printer hard drives over port 9100. After uploading to a printer, the file can be accessed by ... any web browser... It doesn't take much creativity to realize that even highly illegal materials could be stored this way,' Vickery wrote. CSO's Steve Ragan picked up the thread: A quick search on Shodan to confirm Vickery's findings returned thousands of results.
They want there bugs back. This issue has been haunting HP printers for decades.
ftp://ftp.hp.com/pub/networkin...
https://www.google.com/search?...
People have been doing this shit for years. People doing shit like printing out all sorts of crap etc to run the printers out of toner, paper etc. I wouldn't be surprised with some crappy printers out there that you wouldn't be able to start a fire with some.
Printer related bullshit like this was the IoT hacking of the 1990s :P
This is just another "look at what i found with [product][signup]" marketing bullshit, i'am not signing up for anything at shodan, a "search" behind a paywall/freemium says everything about the operation.
You have no excuse to have a printer exposed to the greater web.
Root cause my friend...HP has no excuse for running an FTP server on a printer.
(*sarcasm*) No. Everything must be internet enabled! We are in the age of the Internet of Things. You probably don't even use "apps," do you? I bet you compile your own code, too. You are a Luddite. Get off my lawn! (*sarcasm*)
Wow, who know HP was the original cloud storage provider for pornography?
'Nuff said.
Does it also serve up a RIPterm bbs?
But then how are they going to send copies of everything you print to the mothership/NSA/etc?
Seven puppies were harmed during the making of this post.
Does anyone seriously have an IP protocol printer that isn't behind a NAT and a firewall to boot? Is this really a thing? Listening printer IP ports sitting out in the DMZ? (*boggle*)
(I guess, or he wouldn't have written the blog.) :/
You have no excuse to have a printer exposed to the greater web.
As a UMN (note how high they are on the list counting the exposed printers) alumni, I probably know more about their network setup than most. The default stance there has always been that every device on the network is given an IP (either dynamically or statically) that is fully resolvable to the world. They started with all of 128.101.*.* and then added 134.84.*.* and something else as well. It didn't seem like they would run out of addresses any time soon so they just kept handing them out; students, staff, faculty, janitors, etc.
Now networked printers are cheap and easy to use. Cubicle dwellers who don't want to share can buy their own without much difficulty and put it on the network ... because they can. I would bet half the printers on there are connected to the wireless, which also hands out fully resolvable IP addresses. How are you going to talk Fred in accounting into not doing it when not doing it is so much more difficult than doing it? He's going to bring his MacBook to work and back every day, he wants his wireless color laserjet when he gets there. Good luck convincing him to spend the extra 1.6 seconds every day disconnecting and reconnecting a USB cable instead of printing over the network ... he could be using those 1.6 seconds to read more facebook.
In summary, you won't get the printers off the exposed part of the network, not when the network is configured the way it is and the employees can add devices to it so easily.
HP printers used to also have a built-in web-server. You could access printer functions from the page. I used to use Alta-Vista (which shows you how far back this goes) to search for the welcome text of the page -- and found hundreds of exposed printers.
I'd open the webpage and instruct the printer to print 1000 copies of a page that says "you've been hacked!" in 50-point typeface. It was an amusing prank, but now that printers have storage, yep, it's a bigger problem that HP, all these years later, has never addressed.
If telephones are outlawed, then only outlaws will have telephones.
Get out of jail free card and IP6 will just make it even easier to clam by ISP modem just auto put it on the net.
There was a research paper from Singapore last summer that explained this much better. The guy even created a drone for finding exposed printers.
The quote implies that the link would go to Shodan, but instead it points to another article.
More to the point, in an IPv6 world and in an IPv4 world that didn't run out of addresses, this is actually how it's supposed to work. Every device is supposed to have a valid routable address, and it's up to firewalling, not non-routable networks, to create security.
It's been quite some time since I played heavily with the settings on network printers, but there were a lot of options for how the network configuration could be set up. There were multiple protocols and options within each protocol including for things like management, web, and the like.
Makes me wonder if this current scare is simply a case of technical staff not doing their jobs and setting up the printers correctly, just leaving everything default. Who needs IPX or NetBEUI on their printers now anyway?
Do not look into laser with remaining eye.
It isn't just the LaserJets, the OfficeJets, etc all have this issue, and there is one right now within range of my home wi-fi network (and of course my other wireless devices) that helpfully tells me that it is offering an open wi-fi network (while every single wireless router within signal range is password protected). Yes, I have seriously been considering sending the owners a message over their own printer.
@Mindless Drivel: 100% of Twitter posts ever Tweeted.
The reported "thousands of results" are thousands of exposed printers, not necessarily thousands of files so hosted.
-Styopa
It's called FTP printing. It was a thing. It can only be accomplished by having the service running and the port open on the printer. Presumably you want your fucking printer to work as advertised. So, HP enabled the service and port, so you can fucking print and FTP print if you want to.
That you plugged these old printers into the internet, rather than behind a firewall is not HP's problem. It is an ID10T or PEBCAK issue.
Now, if you want to blame HP et al for stupid lack of security then look no further than WebPrint and AirPrint. These two features willfully encourage the printer's connection to the internet, even tunneling through firewalls. These two feature are moronic security holes manufactured and encouraged by the manufacturers while still making printing a pain in the ass.
Well, this is very, very, very old hat. I have been sending files to HP printers using FTP for 20 years. It is the easiest way to print from an unconfigured Linux/UNIX machine - without installing CUPS. However, the company IT should not make the FTP port available outside the LAN and that has nothing to do with HP.
Oh, the horror. Fax machines are on the public net too. In fact, I think are required to be that way in order to be of any use whatsoever...
If you are thinking of storing illegal things this way, remember that the FBI can take over the server, keep it running, and then track it back to you.
"First they came for the slanderers and i said nothing."
TL;DR - NAT can suck it. :P
Well, at least it's anonymous.
What is this useless advice doing on slashdot. Now if he only told us how this free, open source software got onto the printer in the first place and why only HP network printers.
But how could they improve their customers experience if they could not harvest their data and as a side track, monetize it? Doesn't anyone think about the experience?
This is really old news. No current model for sale has these issues. Oddly, people don't expect their decade-old router to be secure these days. But for some reason people think old printers should be. Oh well.
Your HP printers are my cloudserver. I back up all my data in PAR files to them. All your printers are belong to us.
Fuck that.
I'll put my internal devices like printers on a 10. or 192.168. subnet and never have to give a rat's ass about firewall configs or bad firewall software as far as those devices are concerned. I don't have to care if the door's locked if there's no doorway.
NAT FTW!
from the article:
software that can be used to upload and interact with HP printer hard drives over port 9100. After uploading to a printer, the file can be accessed by visiting http://[Printer_IP_Address]/hp/device/[File_Name] with any web browser...
Wouldn't this require port 80 to be forwarded? I don't see them specifying an alternate port in that request.
Part of the 192.168 address range is routeable (class b) in case you didn't know.