Printer prints from its own

[Tommy1506]

Hi it happens not frequently bu my printer print some times on it's own strange caracters. Today it happens again an this time there was only one line printed "stackoverflowin/sthack the hacker god has returned - sthack@protomail.com"

I searched on the different words on this but no result.

Can anybody advice me what I need to do.. or is there somewhere a setting in my printer which I need to disaeble ?

Kr

Tommy

[WyreNut]

Hello, and Welcome to the HP Support Community!

How is the printer configured?  Wired or wireless?  Do you have it connected to ePrint?

If your printer has Wifi Direct turned on, then it's broadcasting a wifi signal that neighbors can connect to, especially if you have not password protected it.  Most HP printers come with the option defaulted to ON.

Check the Network Setup or Wireless Settings on the printer itself, and look for Wireless Direct.  Some printers have a Wifi Direct button on them.  Either way, disable the feature.

If the pages are coming from ePrint, check your settings on hpconnected.com.  You may need to change the option for "Anyone can print to this printer" to "Only specific email addresses" and then add the email addresses you are using.

WyreNut

[Tommy1506]

Printer is wireless, but I need to check all the settings you asked.

When this is done, I'll add my feedback

[heyfrank]

Same exact issue. My ePrint settings only allowed from certain emails as well. If you google the message left on the paper it brings up a pastebin with the longer message that looks like it should of printed in landscape mode. Any input HP?

[MikeClayton]

The exact same thing happened to me today - got in to the office this morning and noticed a single sheet of paper in the output tray.  Printed in a single line of text was "stackoverflowin/sthack the hacker god has returned - sthack@protonmail.com - htt"  I looked at the pastebin mentioned by the prior commenter and he's right, apparently our printers are "part of a flaming botnet".  What does this even mean?  Can this affect the data on my computer?  Can these hackers use this security flaw with the printer (I'm assuming that's what we're dealing with here) as a backdoor way to gain unauthoirzed acess to the trusted computers on my local network?  Any information from someone who actually understands what has happened and what it means, would be enormously appreciated......

[heyfrank]

If you look at the pastebin and then look at his twitter he linked. it appears to be a teen of some sort, perhaps with an obsession with finding security flaws. I'm not sure that the "flaming botnet" could even be possible through a printer. I assume it might be with it having a webserver and such.  He used abbreviations such as "s/o" meaning Shoutout and then followed it with BTI, which in urban dictionary terms means "Ban this idiot". I'm curious if anyone could do a trace on the email in the pastebin and find the owner without emailing them and compromising their account by this "hacker god".

I wonder if HP will report this to the authorities at some point because of how many were effected. It looks like it's based on HP printers. I would suggest leaving what model printer you have, if the printer had any ports forwarded as well as eprint on or off, so HP can hopefully narrow down the effected. 

I was hoping maybe my printers firware was outdated but, it was not, and there does not look to be a way to flash the firware with force. 

Since the printed paper I've turned off ePrint, added an admin secure password to the printer and taken away any privileges the printer has had to the outside world for printing. I would advise the same until we hear from HP. Which I have not heard back yet from HP, and even have considered approaching the media about this lack of response and widespread effected.

Model: 8600

ePrint: On but only restrcited to a email of 1 user (now turned off)

IPP: On, but now turned off.

Web Apps: On, but now turned off.

Wireless Direct: Never turned on

[WyreNut]

FYI, I am reporting this thread to our HP internal contacts.

WyreNut

[heyfrank]

Thank you! I really want someone to issue out a firmware update with a vulnarbility patch at the very least. Your QA team needs to start digging and try to find what happend. 

Also my attack was at around 6am central time.

[danny-r]

@Tommy1506

I have brought your issue to the attention of an appropriate team within HP. They will likely request information from you in order to look up your case details or product serial number. Please look for a private message from an identified HP contact. Additionally, keep in mind not to publicly post personal information (serial numbers and case details).

If you are unfamiliar with how the Forum's private message capability works, you can learn about that here.

Thank you for visiting the HP Support Forum.

[danny-r]

@heyfrank

I have brought your issue to the attention of an appropriate team within HP. They will likely request information from you in order to look up your case details or product serial number. Please look for a private message from an identified HP contact. Additionally, keep in mind not to publicly post personal information (serial numbers and case details).

If you are unfamiliar with how the Forum's private message capability works, you can learn about that here.

Thank you for visiting the HP Support Forum.