A Hacker Just Pwned Over 150,000 Printers Left Exposed Online

[Disassembled 249]

A Hacker Just Pwned Over 150,000 Printers Left Exposed Online

A grey-hat hacker going by the name of Stackoverflowin says he's pwned over 150,000 printers that have been left accessible online.

Speaking to Bleeping Computer, the hacker says he wanted to raise everyone's awareness towards the dangers of leaving printers exposed online without a firewall or other security settings enabled.

Automated script behind the "attacks"

For the past 24 hours, Stackoverflowin has been running an automated script that he wrote himself, which searches for open printer ports and sends a rogue print job to the target's device.

From high-end multi-functional printers at corporate headquarters to lowly receipt printers in small town restaurants, all have been affected.

A first version of the message included ASCII art depicting a robot, and also listed the hacker's email address. The second (latest) version of the message includes ASCII art depicting a computer and a nearby printer.

Stackoverflowin's actions haven't gone unnoticed, and many people went online to ask for details, such as HP's official support forum, StackExchange, Spiceworks, local forums, Reddit, YouTube, and Twitter.

Multiple printer brands affected

Users reported multiple printer models as affected. The list includes brands such as Afico, Brother, Canon, Epson, HP, Lexmark, Konica Minolta, Oki, and Samsung.

Stackoverflowin told Bleeping Computer that his script targets printing devices that have IPP (Internet Printing Protocol) ports, LPD (Line Printer Daemon) ports, and port 9100 left open to external connections.

The script also includes an exploit that uses a remote code execution vulnerability to target Dell Xeon printers. "This allowed me to inject PostScript and invoke rouge jobs," Stackoverflowin told Bleeping about the RCE vulnerability's role.

It was only a joke

The hacker, who says he's done his share of security work, claims his intentions were all good.

"Obviously there's no botnet," he says. "People have done this in the past and sent racist flyers etc.. I'm not about that, I'm about helping people to fix their problem, but having a bit of fun at the same time ; ) Everyone's been cool about it and thanked me to be honest."

The incident Stackoverflowin is referring to happened in March 2016, when famous hacker Weev has made thousands of Internet-connected printers spew out anti-Semitic messages.

A report released last week reveals the overall sorry state of printer security. Researchers argued that printers could be used as entry and pivot points when attacking corporate networks.
 

 

 

This is not a new problem. Nor is it isolated to just printers. In the last year, IoT connected hardware has been used to create ever larger bot nets for the purpose of DDoS attacks on scales not previously reached. Large enough that small countries have had their internet access knocked off line.

The big problem here is lack of security written into software at the start. Companies and corporations see security as something with a cost and no visible payback. In the end there is a payback in customer loyality but it's not one that can be counted and totalled as a benefit. They see it more as how little can we get by with.

Until a corporation or company has their nose rubbed in it by bad press or an on line attack, there is no payback for including better security. You see this all the time with hacking releases of members/customers and their personal data as well as financial info released for sale on darkweb sites. The internet news is full of these, showing that security through obscurity doesn't work. Worse that many companies will sue an individual for reporting lax security issues rather than spend the time to fix it.

This appears to be an ethical hacker and not a malicious one. He's at least giving notice and warning of exposure.