Slashdot Mirror
A Hacker Just Pwned Over 150,000 Printers Exposed Online (bleepingcomputer.com)
Last year an attacker forced thousands of unsecured printers to spew racist and anti-semitic messages. But this year's attack is even bigger. An anonymous reader writes: A grey-hat hacker going by the name of Stackoverflowin has pwned over 150,000 printers that have been left accessible online. For the past 24 hours, Stackoverflowin has been running an automated script that searches for open printer ports and sends a rogue print job to the target's device. The script targets IPP (Internet Printing Protocol) ports, LPD (Line Printer Daemon) ports, and port 9100 left open to external connections. From high-end multi-functional printers at corporate headquarters to lowly receipt printers in small town restaurants, all have been affected. The list includes brands such as Afico, Brother, Canon, Epson, HP, Lexmark, Konica Minolta, Oki, and Samsung.
The printed out message included recommendations for printer owners to secure their device. The hacker said that people who reached out were very nice and thanked him.
The printers apparently spew out an ASCII drawing of a robot, along with the words "stackoverflowin the hacker god has returned. your printer is part of a flaming botnet... For the love of God, please close this port." The messages sometimes also include a link to a Twitter feed named LMAOstack.
The printed out message included recommendations for printer owners to secure their device. The hacker said that people who reached out were very nice and thanked him.
The printers apparently spew out an ASCII drawing of a robot, along with the words "stackoverflowin the hacker god has returned. your printer is part of a flaming botnet... For the love of God, please close this port." The messages sometimes also include a link to a Twitter feed named LMAOstack.
Of all the bad outcomes of a printer being hacked, that it "spews" racist printouts (everything racist, I guess, is spewed) until you switch off the printer or fix your security doesn't seem to be the worst thing?
Does your printer keep spewing pages that you find offensive until you make a Bitcoin payment to a racial supremacist group?
Are a bunch of printers on the Internet with public IPs (a thought that previously has never crossed my mind, as it's not even a criminal offense...we'd need to invent a new category for it)?
CmdrTaco is that you?
I've been giving some thought to this whole botnet epidemic. It occurs to be that there is a very straightforward solution:
Every manufacturer, software vendor, etc., should ship their hardware, software, device, etc., in a mode in which all remote/external access is completely disabled. Then the user would be required to at least take a positive action to enable the remote or network capability.
However, I am relatively certain this won't happen, for these reasons:
Given that manufacturers are in no rush to do anything that costs them more money (hardware margins are razor thin for just about every hardware company not named "Apple"), I really don't see this changing anytime soon, which is sad because this sort of mentality is making the Internet a worse place for everyone all around.
Having port 9100 open doesn't make my printer part of a botnet. It just allows me to print from anywhere. I often set the printer as the DMZ address on my network, because I'd rather have people sending crap at a printer than at my actual computers. This kind is crap is really annoying, not helpful. We COULD turn off external printer ports, but in some cases they are needed or desired. Wasting paper tellling me the port is open? Stupid. Pressuring printer companies to implement a way to only allow authenticated users to print to external ports? Knock yourself out.
(If your printer has the web configuration/admin page unsecured, or telnet config open - that's a different story.)
I'll throw it out because I don't use that thing anymore. I can't even imagine what I would need with hardcopies anymore.
“Common sense is not so common.” — Voltaire
Printers were probably the first devices to be connected to the Internet in vast amounts without any consideration of security. Things do not seem to have changed.
https://www.youtube.com/watch?...
A bunch of printers publicly available on the internet. And that's the manufacturer's problem? This has noting to do with anything other than some people setting up their printers for public access, intentionally of accidentally. Noting to see here...
At work we have open wifi to date the most interesting thing I've seen connected to it was an HP printer.
Why is that interesting?
Because as best as I can tell the printer is somewhere the next city block over we only noticed because stuff here started offering to print to it.
The public wifi also shuts of at 6PM so maybe it's a business? IDK.
Haven't had any problems with people printing stuff to our printer however due to the network size and having more than one printer of the same model we have had issues with accidentally printing to a printer in the wrong building.
Minimum threshold fixed. Thanks!
Funny story, third hand but from a source I 100% believe.
Walking back from a bar to his car in the downtown of a mid-size American city a friend of my friend notices open WiFi. *Score!* He connects to the network and gets a list of connected devices. He sees the usual stuff, but also something he'd never seen before. He does a quick search and finds out it's a commercial banner printer. It does 600dpi prints up to 30" wide off of rolls that can be 250' long. *SCORE!*
At this point WiFi is pretty new to most people, and security is barely on anyone's mind. He does a relatively nice thing - he finds a standard HP Laserjet and prints off a letter explaining that their WiFi is open, their 5-figure printer is exposed to the world, and it would be a really good idea to fix that. He even gives them a link to their AP's documentation showing how to set up password access.
As you might imagine, he was a pretty frequent visitor to the bar - so he watched and waited for a while. Seeing no change in their openness, he repeated the warning letter and made it pretty clear they should take the potential for damage seriously. He ended up traveling away for work reasons, and when he returned over two full weeks later he was eager to return to his local spot.
Of course there was still no change in the open network, and the printer was still available. After some thought, he got pretty well inebriated, and knew exactly what to do. He downloaded the printer's driver software to his laptop, found a good high resolution picture and printed a 30' long veiny erect penis on their big buck banner printer. The next week, the WiFi was password protected at that location.
At least it wasn't as offensive as racist slogans?
It seems that these days it is hard to find a laser printer that can connect directly to a computer via USB. They all seem to be made to be network only printers. I don't want my printer to connect to my home network via Ethernet cable. A Wi-Fi connection for a printer is definitely NOT happening! I don't print much, and only print from my desktop computer.
People are catching on that ink for inkjet printers is a huge ripoff! An inkjet cartridge with a few millilitres of ink can cost as much or more than a laser toner cartridge that will print 2000 or more pages. So more people are buying laser printers to use at home. Most home users will probably only ever want to print from one computer, so a networked printer is not needed. Even if a family wants to be able for all its members in the house to print to one laser printer, a connection to the local network (but not to the internet) is all that is needed.
Not everything in the home needs to connect to the internet! Most of this IoT crap is nothing but devices that can spy on their purchasers and send data to their real owners, the companies that made them.
this in a printer being printed to not a hack! It's just that some people have them with PUB IP's now with IPV6 and an ISP router it may be giving out pub IPv6 ip's with DHCP.
anyone who opens their printer to the internet deserves it.
In 1998 I was in university during what i like to call the internet middle-ages. The unwashed masses were already flooding and the bubble was inflating. Anyway, security and IT practices were sloppy at my uni. They had big HP printers in a few of the labs for students to print their work for submission. So l find that the printers were all on a public IP's and no passwords on the jet direct console. They didn't throw out prints right away, just put them aside or in a bin. So that night I go home and setup one of the printers on my PC and printed a page that someone wouldn't think twice about. I go in the next day and had to the lab and soft through the discarded pile. Bingo, my print. Oh joy. I found the IP of as many printers on campus as I could and proceeded to terrorize them with hundreds of prints of goatse and other extremely unpleasant things. Within a week they closed the ports on the router. I also took the liberty of changing the admin passwords on some of the printers and then changed their IP so they couldn't print. Took them a week to sort it out. Also didn't help them that I worked in the IT Dept for the engineering Dept and knew all their IP address and the head of IT was lazy and let his alcoholic subordinate do all the work. Fun times.
Your comment's title is hilarious
Back in the early 2Ks, I worked for a certain networking gear manufacturer who gets confused with a food service company. Two or three times, a particular virus popped up that looked for open Windows file shares and would drop a copy of itself on said file share, naively hoping that a moron would later see it and click on it. Well, some bright spark had decided that for some reason, printers needed to be set up as a pseudo file share. This would then dump raw ASCII to the printer. (I suppose it might have been possible to get into some HP graphics mode with the right escape characters)
The problem was that in this mode, a form feed character would cause a page eject. Now imagine what happens when a binary file is thrown at this. We had at least one printer (I think it was an LJ4 series) wear out from all the pages it was quickly spewing if its paper tray was particularly well filled.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
Using a public printer to "print" is the least evil thing you can do. Read this weeks research on printer security: http://hacking-printers.net/ https://github.com/RUB-NDS/PRE... Whenever you can print a document on a printer (for example, using port 9100 or cross-site-printing from a malicious website) you can do much worse stuff like: - Capture print jobs (all PostScript printers since 32 years are vulnerable!) - Access the file system (most PostScript printers allow this, some PJL devices do) - Dump the printer's NVRAM or memory ("feature" of all Brother laser printers and some Xerox devices) - Obtain credentials for Scan-to-Mail, Active Directory etc. stored on the device (Brother, OKI, some HPs, ...)
- Install new firmware on the device (modification however is difficult as many vendors use code-signing)
- Destroy the printer's NVRAM using legitimate PJL commands (various HP, Brother, Lexmark, Dell, Konica Minolta, ...)
EditorDavid's home page.
So the issue at hand is that the printer hacking used up printer supplies and that the hacked pages were racist, misogynist, homophobic, homoerotic, xenophobic, jingoistic, pornographic, plain disgusting, or simply annoying are peripheral concerns?
He just caused printers to use about 18 trees worth of paper.