About 28,000 printers "hacked" on the Internet: what to Do

About 28,000 printers "hacked" on the Internet: what to Do

Cybernews, a security news website, announced today that it has "hacked" approximately 28,000 printers worldwide in a stunt to "raise awareness of printer security issues."

This is a big deal, since many owners and administrators of networked printers do not properly secure their printers. However, the CyberNews "hack" was not really a hack. On the contrary, CyberNews used common print commands to print documents to the remote printer, just as the printer was designed to do.

This was possible because these networked printers were set up to receive print jobs over the Internet without any authorization. So CyberNews ordered the printers to print a five-page document instructing printer owners and operators on the basics of printer security.

If this sounds familiar, that's because the same thing has been done before: in 2016, notorious internet troll Andrew Auernheimer, a.k.a. "Weave," had 20,000 printers (his number) print a one-page racist He used a similar method to make them spit out a manifesto.

In 2017, a pseudonymous hacker called "Stackoverflowin" did the same thing, but instead of a racist screed, he simply sent a simple message to close open Internet ports.

Like Cybernews and Stackoverflowin, Auernheimer scanned the Internet for printers that were open to the Internet and receiving remote commands. However, he told Vice Motherboard that he "did not hack the printers," but instead "sent a message, which was that the printers were not hacked.

Now, despite the warnings in the Cybernews blog post, just because a printer can receive print jobs via the Internet does not mean it can be hacked completely. However, exposing the printer to the Internet does make it easier.

To prevent the printer from being accessible online, tweak the firewall settings on your home (or office) router to block port 9100, the port most commonly used for Internet printing. If the printer's management interface has a similar setting, block the port there as well.

Cybernews has two more tips to protect your printer from prowlers, whether or not it is connected to the Internet.

First, make sure your printer has the latest firmware. You may have to scour the manufacturer's website to find new updates. Next, see if you can change the default admin password for the router.

Categories