Secure your printers!!!

[#1]

Not a tech article or news piece, just general advice...

Last night I was looking up info on the web interface on my HP CP2025dn printer, and using terms I'd seen in its web interface I googled them to try and translate them into human english, only, what I discovered were page results that were other people's printers!!! With fully open web interfaces!!! So you could happily change settings, apply passwords, and even send print jobs to them!!!

I was utterly astounded to find printers that were just not secured, and just as a quick test, I sent a .txt file to one (with a polite message telling them their printer was open to the web and they should consult a networking professional to lock everything down properly), and it worked...

So, if you have a networked printer that has a built-in web server to access its settings, set a username and password, just so you don't end up with people doing random (and potentially malicious) junk from around the world via a simple google search!!!

[#2]

Unsecured webcams are more fun

[#3]

Thankfully I wasn't looking for webcam settings, I don't even own one...

[#4]

This is yet another example of why you should NEVER enable UPnP on your router ! 

[#5]

You think printers are bad... back in 2010 I discovered a google search query that brings back results for phpmyadmin that is installed on websites - with no login credentials needed. One website was for an alloy wheel shop up north - it's entire database was sat there completely open to the public. I gave them a phone call to tip them off and the woman wasn't even bothered and asked why it was important - I said to her "well if I change the delivery address on a set of £2k alloy wheels that someone has just ordered, you send it there and then I change the address back, where are you going to look for the wheels that just cost you £2k?"

The realisation and shock was enough to change her tone of voice instantly and suddenly she wanted to know how to get it fixed. Not much I could say to that other than "call your web developers, have them remove it and then use someone else who has a clue about security".

phpmyadmin was gone within the hour. That search term still works though and brings up fresh results every week / month depending on which idiots have uploaded a copy to their sites.

[#6]

Ah the phpmyadmin, been a while since I last thought about that one, and there's the installation folders for forum software where anyone can access the critical behind-the-scenes stuff where inexperienced people have left it in place and in its default folder structure form...

But still, the printer thing can be problematic, after all, that printer I sent a .txt file to, there were a lot of instances of other people sending print jobs to it, so goodness knows what they were printing, could have been anything from unpleasant messages, to strong pornography...

Of course, the best printer security is just to switch it off when not needed, like mine is right now, can't access what isn't powered up...

[#7]

If people are worried, they can go here, 

Run the upnp scanner, as well as the open port scanner to check for issues.

Carl.