Printers are spontaneously printing odd "SQL" strings

https://discussions.apple.com/thread/4220060

by jpswade • 14 years ago

398 142 14 years ago

discussions.apple.com

stordoff2• 14 years ago

> "[...] we're all forwarding port 9100 or 631 to our printer to allow ourselves to print from outside the network, which sets up an HTTP server at that address open to the internet. All it takes is for somebody to put the appropriate GET request in [...]"

> "Both of our printers have public IP addresses"

It looks like the printer are publicly accessible, and some automated tool (nmap?) is just scanning them for vulnerabilities, open ports, or similar. Not too surprising really.

oelmekki• 14 years ago

That would definitely not be a stealthy scan :)

freehunter3• 14 years ago

The printed page even says NMap on it. nmapol=tlitcp is Transport Layer Interface and TCP. I'm not positive, but NMap OL could be NMap openvas-library, which is a vulnerability scanner. Sounds to me like someone scanning with NMap over TLI and TCP and it's hitting these printers.

Don't expose your printers to the web without a strict firewall or VPN/reverse proxy!

windexh8er• 14 years ago

Agreed, I've seen this before as well. I doubt it really has anything to do with Apple and likely the HP printer server software instead - being directly related to an nmap scan.

bcl2• 14 years ago

When nmap scans port 9100 it doesn't send anything (at least as of nmap 6.00 using -sV). It is probably a higher level vulnerability scanner, possibly metasploit, using nmap to discover open ports and then probe deeper on its own.

dfc3• 14 years ago

Nmap avoids sending to 9100 specifically to avoid sending data that the printer may misinterpret as data to be written to a page. You need to give it the --allports option.

   --allports (Don't exclude any ports from version detection) .
       By default, Nmap version detection skips TCP port 9100 because some
       printers simply print anything sent to that port, leading to dozens
       of pages of HTTP GET requests, binary SSL session requests, etc.
       This behavior can be changed by modifying or removing the Exclude
       directive in nmap-service-probes, or you can specify --allports to
       scan all ports regardless of any Exclude directive.

jvdh• 14 years ago

It is not surprising that printers just accept (possibly malformed) requests just from anywhere?

lucb1e• 14 years ago

Not if the owners don't password protect anything. Without a valid login it shouldn't print anything, unless that login were exploited, but I don't see any mention of a password being bypassed.

kd0amg• 14 years ago

If I remember the presentation I saw on this, some don't even verify firmware updates.

http://ids.cs.columbia.edu/sites/default/files/CuiPrintMeIfY...

http://engineering.columbia.edu/can-you-trust-your-printer

adrinavarro• 14 years ago

From the comments it seems that it's people sharing their printer, apparently some form of access over the internet (or local network).

microtonal• 14 years ago

Given that these are connected to Airports, they are probably using Back to my Mac:

http://en.wikipedia.org/wiki/Back_to_My_Mac

grapefruit• 14 years ago

Services shared via Back to My Mac aren't directly accessible from the internet at large. Services shared using Wide-Area Bonjour are publicly exposed.

cantankerous5• 14 years ago

The strings contain "sqli" which some of the posters inferred to mean they were experiencing a SQL injection. I doubt this is actually the case. I will say, though, that I have a Brother printer like the one described where I work and have seen similar odd strings on papers that come out of it. At least one time, it's just printed gibberish. I think the common denominator is that these printers are openly shared on a network with a public IP (at least mine is...it's at a big University with public IPs fore everybody). I don't know if this is related or not, though.

alexchamberlain• 14 years ago

I'm in the sqlite camp.

cantankerous5• 14 years ago

That would make sense, especially if it was just some kind of debugging message mentioning the sqlite version.

CWuestefeld2• 14 years ago

The strings contain "sqli" which some of the posters inferred to mean they were experiencing a SQL injection. I doubt this is actually the case.

I'm certain you're correct. I've seen many SQL injection attacks, and not one of them has ever labelled itself as such.

mmetzger• 14 years ago

Maybe it's time for something similar to the IPv4 Evil Bit - http://www.ietf.org/rfc/rfc3514.txt

CWuestefeld2• 14 years ago

Seven hours after posting, I've racked up 21 points for this comment.

I think this shows a defect in the blind voting we've had here for the last year or so. There's no way this off-hand comment is worth that much karma, but nobody can see that I'm being overcompensated for it.

(Sorry for the OT meta-post)

ch0wn• 14 years ago

There's also "nmap" in the output, so this could be part of a combined port and vulnerability scan that hit the network printer.

cantankerous5• 14 years ago

I think this idea is on to something and warrants more investigation.

Edit: That's probably what it is. A port scanner climbed through port 9100 and hit the JetDirect port on the printer, which prints whatever raw data it is given. Cool find!

ioquatix2• 14 years ago

I once found a public printer which I don't think was supposed to be public. There wasn't any way to contact the owner since it appeared to be in a different country based on IP address.

...so I set it up as a printer and printed a bunch of lolcats to it.. A few days later it wasn't accessible any more =)

Achshar2• 14 years ago

You could have, you know, printed out that the printer was publicly accessible on the printer itself.

ioquatix2• 14 years ago

Yeah, that was part of the lolcats image. I can't quite remember what I did but it wasn't malicious.

stevencorona2• 14 years ago

This reminds me when I was in college- I used to have VNC running on a public IP without any authentication (on purpose). Randomly, bots would connect, take over control of the screen, and print a bunch of test characters out in Notepad before disconnecting.

I don't know if they just hit it by luck or if they were actively looking for/testing/saving open VNC servers.

jonknee• 14 years ago

Why would you have it set it up that way, especially after witnessing bots connecting?

stevencorona2• 14 years ago

It was an old PC that I didn't care about and only used for testing. I was into security stuff, so it was interesting to see the bots connect (which it why I left it open).

freehunter3• 14 years ago

You're always being scanned for everything. If I got a penny for every time my company was swept by a scanner, I'd be making more than my salary.

fein• 14 years ago

This is almost an understatement.

My home servers get SLAMMED on a daily basis by a whole wonderful plethora of bots. Most recently has been Muieblackcat. Going on the whole salary analogy: I'd make my current salary plus a bit if I had a penny for ever scan on the box in my living room. I keep the Ukrainian IP's off my blacklist just for fun. Nothing sensitive on the server, just my web playpen. I kind of hope that one of these exploits works one day so I can see where I've slipped up.

ethank2• 14 years ago

I did a project in college where I scanned networks for IPP ports and would print agit prop to them

The printer panopticon. Oh art school.

eternalban• 14 years ago

> ... printer panopticon ...

Oh "BBrother" what an ironic comment this is .. /takes off paranoid hat

dfranke• 14 years ago

Heh... a similar "project" when I was in high school got me sent to the principal's office once :-)

ethank2• 14 years ago

Yeah, I got a nice visit from campus security.

rachelbythebay• 14 years ago

I'm waiting for the great network printer security apocalypse. A bunch of these things are in a great position to turn around and launch attacks on the "chewy on the inside" networks of so many companies. Maybe this has already happened.

My printer has a dumb little print server running an embedded flavor of Linux and a publicly known hard-coded (!) root password. While mine is going to the slag heap sooner or later for that and several other fundamental problems, you can guess that many many more of them are out there just waiting to be taken for a ride.

These dumb little boxes may be underpowered, but once you get inside and set them up to forward packets for you, their raw CPU speed becomes less of an issue. You can run all of the fun attacks from a "real" machine and just let it bounce you to the inside world.

Hypothetically speaking, of course.

mjhall• 14 years ago

These two 28C3 talks[0,1] discuss the precursor to such an apocalypse.

[0] http://events.ccc.de/congress/2011/Fahrplan/events/4871.en.h...

[1] http://events.ccc.de/congress/2011/Fahrplan/events/4780.en.h...

axx2• 14 years ago

I was going to submit those. Thanks!

INTPenis• 14 years ago

My very first criminal act of hacking as a teenager was gaining access to a printer somewhere in Spain, by which I had limited access to the rest of the network but I was too dumb to understand what to do.

So yeah, printers at least were a big gaping hole in the late 90s and early 00s.

lftl• 14 years ago

I've got a HP printer pretty similar to the one mentioned in the thread. In the course of trying to set it up, I by chance pointed my browser to the printer's network printing port. Interestingly enough it printed out all my browser headers. It seems like these printers just spit out anything that hits that port.

igrekel• 14 years ago

Yes, I used to do a netcat on printers to print for free in college.

ZoFreX2• 14 years ago

Tip for networked computers in colleges, schools, workplaces, and similar environments: You can upload postscript files to them via FTP, this lets you bypass the printer queue running on a server somewhere. Why would you want to do this? Various nefarious reasons, but the reason I did it was because in 90+% printer outages at university, it was the queue server and not the printer itself experiencing a fault.

If you don't know the IP address of the printer, you can normally get them to print out a diagnostics page by fiddling with the buttons, and this page will contain that information. So far I have always succeeded at logging in with guest credentials.

To network admins who don't want people bypassing their queues: vlan your printers!

sixothree• 14 years ago

I never would have expected that, but it would certainly explain what we're seeing.

fest• 14 years ago

It seems to me that someone was scanning their network for specific services- probably, some DBMS. Printer received the initial communications packet(s) and happily printed whatever was received.

justincormack• 14 years ago

There are known attacks on printers eg via firmware upload https://lwn.net/Articles/469865/

Although this mostly looks like scans.

dagw• 14 years ago

Spoke with a a security guy years ago who got called to a company after they'd been accused of running a warez server. After a bit of digging around he finally found the server on a printer that was running some ancient un-patched version Solaris.

borplk• 14 years ago

In the printed stuff it also says 'nmap'

Most probably it comes from someone running penetration testing tools against the printer on the network

jpcosta• 14 years ago

Could this be related with Trojan.Milicenso or Trojan.Eorezo? This is the latest (although its from June/July) threat I know of that prints random stuff

http://www.symantec.com/connect/blogs/trojanmilicenso-paper-... http://www.symantec.com/docs/TECH190982 http://isc.sans.edu/diary.html?storyid=13519

SoftwareMaven• 14 years ago

One poster said his/her printer did it on a machine not connected to the network, so it may not be a print server scanning thing.

sanderjd• 14 years ago

Yeah that was the outlier. It seems more likely to me that the poster who said that failed to properly disconnect the printer from the network.

cityhall• 14 years ago

I think he meant that his printer was still connected but he unplugged his Mac.

cs7022• 14 years ago

Many, perhaps most network-connected printers, NAS units, and other devices (e.g., home-automation hardware) simply assume that the local network they connect to will be securely protected from external attack, so they're not configured to withstand even the simplest of attacks.

This is exactly the opposite of what many security experts recommend: ideally all devices should be secure regardless of whether the network they're on is secure or not. With more and more devices offering remote-Internet-access functionality every day, this principle of security is becoming ever more fundamental.

Bruce Schneier's personal WiFi network at home is fully open, because -- in his own words: "If I configure my computer to be secure regardless of the network it's on, then it simply doesn't matter. And if my computer isn't secure on a public network, securing my own network isn't going to reduce my risk very much."[1]

Like rachelbythebay, I'm also waiting for the great network printer security apocalypse.[2]

[1] http://www.schneier.com/blog/archives/2008/01/my_open_wirele...

[2] http://news.ycombinator.com/item?id=4412522

UPDATE: Just for the heck of it, I ran a fairly fast scan (nmap -T4 -A -v -PE [IP address]) on an HP all-in-one printer accessible over my LAN, and there were a LOT of open ports -- see pasted results below. I then pointed my browser to port 9100 on the printer, which instantly printed the HTTP headers without complaint. The printer's configuration page reports that it is "secured" by an administrative password.

  PORT     STATE SERVICE      VERSION
  80/tcp   open  http         HP PhotoSmart/Deskjet printer http config (Virata embedded httpd 6_0_1)
  139/tcp  open  netbios-ssn?
  6839/tcp open  tcpwrapped
  7435/tcp open  tcpwrapped
  8089/tcp open  tcpwrapped
  9100/tcp open  jetdirect?
  9101/tcp open  jetdirect?
  9102/tcp open  jetdirect?
  9110/tcp open  unknown
  9220/tcp open  hp-gsg       HP Generic Scan Gateway 1.0
  9290/tcp open  hp-gsg       IEEE 1284.4 scan peripheral gateway
  9500/tcp open  unknown

zhoutong• 14 years ago

Especially with the development of IPv6, internal routing becomes transparent and the appearance of protection offered by NAT is gone. Possibly these printers all have been assigned a public-reachable IPv6 addresses.

gergles• 14 years ago

It isn't an "appearance" of protection. NAT is the best thing to happen to security for home networks since their inception. The push to remove it with IPv6 and to force home users who don't care about these things to put their entire home network directly on the Internet is going to wreak havoc.

VLM• 14 years ago

You can't be seriously claiming that someone is port scanning my /48 that I've had since the early 00s? Over a typical slow internet connection that would take rather a long time to find my printer. Lets say you slammed my couple megabit cablemodem with a million address probes per second (yes I'm well aware thats impossibly high). It would only take you 38 billion years of continuous scanning to find my printer. I'll even give you credit that most people are using just a couple (obvious) /64 inside their /48. Assuming my math is correct it would take a mere half a million years per /64, so figure a couple million years and you'll own my home lan...

guard-of-terra• 14 years ago

Unfortunately, trying to secure your hardware is a lesson in frustration and ruins the whole experience.

This is because every device acts confused, hangs or produces cryptic errors when facing denied access; restricted resources prevent you from understanding why the access was denied and how to open it; changes in network topology lead to problems that only stumbled over much later; and it's extremelly hostile on guests who spend half a hour trying to configure.

It's untractable.

Most of user crypto has same set of problems btw.

munin2• 14 years ago

it's worth noting, I think, that Schneier is pretty out of touch when it comes to the whole "open wireless" thing, because he leaves himself open to a bunch of local-only attacks. he's correct that your computer should be able to withstand being on the 'open' internet, since it is every time you take it to work or a coffee shop or something, but, don't be an idiot, just turn WPA2 on at your house.

many access points (I think) now provide a feature where they can run multiple SSIDs. so if you're savvy, you can turn on a guest-only open wifi for when you have visitors, and turn it off when they leave. kind of like a guest key for your spare room!

bad_user2• 14 years ago

    he leaves himself open to a bunch of local-only attacks

What kind of attacks might those be?

Consider the case of a computer connected to the network with no open ports (other than say, 25 for SSH), with a properly configured firewall, that connects to the Internet through a VPN and with an operating system that auto-updates itself.

What could you do to it from inside the network?

pasbesoin3• 14 years ago

If they're decent, the guest ID/config can have its own password. Approved guests get wireless without having to put it up and take it down. Unapproved "guests" remain unapproved.

Ixiaus• 14 years ago

A friend of mine over here recently discovered that a certain printer manufacturer (very big one) had a complete SNMP service that runs on all the printers - they aren't protected and you can run any command on it. You can even tell the printer to download, load, and reboot with custom firmware. Amongst many other yucky things.

This sounds somewhat similar.

nodata• 14 years ago

Which printer manufacturer?

dfc3• 14 years ago

Rerun with "-sV --allports"

   --allports (Don't exclude any ports from version detection) .
       By default, Nmap version detection skips TCP port 9100 because some
       printers simply print anything sent to that port, leading to dozens
       of pages of HTTP GET requests, binary SSL session requests, etc.
       This behavior can be changed by modifying or removing the Exclude
       directive in nmap-service-probes, or you can specify --allports to
       scan all ports regardless of any Exclude directive.

PS I think the "-A" and "-T4" is redendant. I think aggressive mode sets the timing to 4 among other things.

cs7022• 14 years ago

dfc: running nmap with "--allports" could make the printer waste a lot of paper, so I won't do it. (FWIW, by pointing my browser to the jetdirect port, I was able to control the timing of the http request with more precision and cancel printing immediately after the first page came out.)

PS. No, I was not trying to replicate what happened -- just trying to get a quick sense of how many ports are open. Sorry for the misunderstanding.

ArbitraryLimits2• 14 years ago

It's not 1994, no one "points" a browser at anything any more.

thisisblurry• 14 years ago

Look for the good in that post, don't nitpick the phrasing that was chosen.

aidos• 14 years ago

I get that this just looks like a scan but it's strange that half a dozen people reported it at the same time (so the problem is likely more widespread). How long would it take to send these packets to all public ips in the world (real question, I have no sense of the scale of ip addresses)? I guess it could be that the ips are known to be running printers by a previous scan. Maybe the printers contact home and the HP accidentally sent them a bad message?

PaulHoule• 14 years ago

this would be a great attack if you could get the printers to print ads!

ahi2• 14 years ago

Those are called fax machines.

drone• 14 years ago

Pretty typical behavior when running vulnerability scanning against a printer target.

Many printers will simply print whatever data comes into certain ports. Have seen similar behavior many times when running web scanning against a printer accidentally instead of a webserver.

doctorwho2• 14 years ago

No need to worry, all Mac's are virus, malware and attack proof and so (by the law of distortion of reality) are any devices or networks attached to a Mac. Go about your business and forget about that pesky "security" thing everyone else likes to talk about. Just etch a picture of Steve striking a thoughtful pose on the lid of your laptop and all your problems will be forgotten.

podperson3• 14 years ago

Thanks for injecting helpful -- not to mention hilariously witty -- points into this conversation. You left out the following points:

* Apple's stuff is incredibly overpriced

* Apple never invented anything, it's just good at marketing

* Apple's lawsuits are all based on rounded rectangles

* Xerox invented the GUI from scratch and it was perfect

* Anyone who uses an Apple device is a hipster fanboi cultist

gonzo• 14 years ago

I am not a hipster.

MarvinYork• 14 years ago

Welcome to hecklernews.

doctorwho2• 14 years ago

If Apple's stuff wasn't incredibly overpriced they wouldn't have $100B in the bank. Steve's ghost would be sad and they wouldn't be able to bankroll all their lawsuits (which would also make Steve's ghost sad).

Apple USED to be good at marketing. Have you seen those new ads? The ghost of Steve just barfed in his mouth a little bit. Quick! Someone call Justin Long and John Hodgman, that was working okay...

Rounded rectangles are the new lucite, and therefor not relevant in any way. Apple's lawsuits were based on Steve Jobs being a big baby about how well Android was selling. Now? Who knows how the Apple lawsuit of the day gets kicked off, but you can bet it involves Androids (and not the Star Trek variety).

Now you're just being thick, the first GUI was done by Doug Engelbart (Stanford Research) in '68. It was perfect. Any CS student who took an HCI knows that. Extra points if you know what HCI stands for and don't have to google Engelbart to verify, but I bet you do :)

Some people who use Apple devices just want some of the discretionary income that hipster, fanboi (and fangrl, you sexist) and cultists seem quite happy to part with. Will that be cash or credit?

alanbyrne• 14 years ago

<snip> I'm going to guess that the common theme here is that we're all forwarding port 9100 or 631 to our printer to allow ourselves to print from outside the network, which sets up an HTTP server at that address open to the internet. </snip>

Seriously?! Ignoring the fact that I can't remember when I last print something, who needs to print to their house from the internet? Can't they just print it when they get home?

corin_2• 14 years ago

I've actually found it useful in the past to be able to print stuff when I'm not in the office - not useful enough that I really care about the feature, just that since it's there it saves a small step in the alternative of emailing then having them open and print it.

jorts• 14 years ago

Why not setup a VPN to your home?

samstave2• 14 years ago

Semi off topic anecdote: when I was at Lockheed the head of HR came to me with a Manila envelope and said "I need to know who printed this and when! And I need to know now!"

I took the envelope and looked at it... It was a bunch of prints of gay porn and gay porn websites.

After a few minutes of digging, it was revealed to be one of the directors in the company had printed them late the night before. Checking the badge system he wasn't in the building. Checked VPN logs and he was logged in at the time.

He was mistakenly on VPN from his house and printed stuff that went to his default printer which happened to be the one in the office.

He was previously thought to be a married straight guy.

ANH• 14 years ago

Similar scenario happened where I was working one summer. The printer in the office I was borrowing started printing porn while I was out. "I swear it wasn't me!" Not sure if they identified the guilty party.

tantalor• 14 years ago

> He was previously thought to be a married straight guy.

Not sure why this is relevant. Are you saying Lockheed has/had a don't-ask-don't-tell policy?

robbiemitchell• 14 years ago

Can you really not think of any cases?

- They have expensive software on a computer in one place that does not have a printer, and a printer at home without the software - A couple that works from home likes to collaborate while one of them is one the road, with one printing stuff directly to home after meeting with clients - They like to print stuff from work while things are on their mind (itineraries, boarding passes, etc.) so that they don't have to think about logistics once they're home with family - etc.

Beware the sentence that starts with "Can't they just..."

android_gg• 14 years ago

this is pretty damn scary

axx2• 14 years ago

With IPv6 and public IPs this is going to be so much fun. :)

cantankerous5• 14 years ago

For what it's worth. This issue (or an issue very similar to this issue) has been discussed on the nmap seclist.

From the email:

"....However, I've noticed a problem now that I've put this into production. When it scans a network printer, the printer spews out garbage, I have a couple wads of paper on my desk with one or two lines of garbage at the top of each page."

http://seclists.org/nmap-dev/2006/q3/406

cantankerous5• 14 years ago

After playing around with it. I think that what is causing this to happen is that the JetDirect port on the printer (usually 9100) is getting written to by a port scanner. This will cause a printer using JetDirect to print out whatever gets sent to it on that port. Try it yourself if you have a printer that implements it. For me it was a Brother HD-5370DW.

1. telnet <printer> 9100

2. Type a hello world message.

3. Close the connection

4. The printer will print out whatever you typed. At least it did for me.

da_n• 14 years ago

Can confirm this works on my Epson printer (SX535WD).

brokenparser• 14 years ago

@PJL RDYMSG DISPLAY="Tray 1 Load Plain Letter"

Confuses the heck out of your coworkers.

b_emery2• 14 years ago

Wow, this works on my HP printer. That would explain the reams of pages I get that look like this:

GET http://www.baidu.com/ HTTP/1.1

Host: www.baidu.com

Accept: /

Pragma: no-cache

User-Agent:

a_bonobo2• 14 years ago

I sometimes get the same ones at work! It's the crawler from the Baidu-search-engine checking if the printer is a web-server.

I contacted ITS about it (obviously, you shouldn't be able to print from outside the university) but they haven't really given it any work. It surely is a security hole, and a minor waste of ink & paper.

JonnieCache• 14 years ago

Don't trust your printer! There were a lot of demos of printer hacks at 28c3 and basically I think I might not print anything ever again. A lot of these things have their firmware implemented in postscript. Updating the firmware consists of printing a special document. It's pretty mental tbh. Your jaw will be scraping along the floor at some of the holes these things have.

Print Me If You Dare: http://www.youtube.com/watch?v=njVv7J2azY8

Hacking MFPs: http://www.youtube.com/watch?v=PqL5P46m_zQ

EDIT: Beaten by 4 hours. Oh well.

blhack• 14 years ago

They're getting portscanned. I'm surprised this isn't common knowledge.

If you throw ascii at a jetdirect printer, it will generally just print it out for you. I've used this to debug printers before, as well as to goof around with my coworkers a bit.

colton36• 14 years ago

For slightly more amusing attacks on printers, there is an android app available - HP Printer Fun.

https://play.google.com/store/apps/details?id=com.angryhacke...

jpswade• 14 years ago

I've so far been unable to replicate this problem.

Printers are spontaneously printing odd "SQL" strings

Related Stories