A grey-hat hacker going by the name of Stackoverflowin says he's pwned over 150,000 printers that have been left accessible online.

Speaking to Bleeping Computer, the hacker says he wanted to raise everyone's awareness towards the dangers of leaving printers exposed online without a firewall or other security settings enabled.

Automated script behind the "attacks"

For the past 24 hours, Stackoverflowin has been running an automated script that he wrote himself, which searches for open printer ports and sends a rogue print job to the target's device.

From high-end multi-functional printers at corporate headquarters to lowly receipt printers in small town restaurants, all have been affected.

This is the latest version of the message spewed out via people's printers:

stackoverflowin the hacker god has returned, your printer is part of a flaming botnet, operating on putin's forehead utilising BTI's (break the internet) complex infrastructure.
For the love of God, please close this port, skid.
Twitter: https://twitter.com/lmaostack

A first version of the message included ASCII art depicting a robot, and also listed the hacker's email address. The second (latest) version of the message includes ASCII art depicting a computer and a nearby printer, as depicted below.

Stackoverflowin's message
Stackoverflowin's message (via @ElSob09)

Stackoverflowin's actions haven't gone unnoticed, and many people went online to ask for details, such as HP's official support forum, StackExchange, Spiceworks, local forums, Reddit, YouTube, and Twitter (tweets available at the end of this article).

Multiple printer brands affected

Users reported multiple printer models as affected. The list includes brands such as Afico, Brother, Canon, Epson, HP, Lexmark, Konica Minolta, Oki, and Samsung.

Stackoverflowin told Bleeping Computer that his script targets printing devices that have IPP (Internet Printing Protocol) ports, LPD (Line Printer Daemon) ports, and port 9100 left open to external connections.

The script also includes an exploit that uses a remote code execution vulnerability to target Dell Xeon printers. "This allowed me to inject PostScript and invoke rouge jobs," Stackoverflowin told Bleeping about the RCE vulnerability's role.

It was only a joke

The hacker, who says he's done his share of security work, claims his intentions were all good.

"Obviously there's no botnet," he says. "People have done this in the past and sent racist flyers etc.. I'm not about that, I'm about helping people to fix their problem, but having a bit of fun at the same time ; ) Everyone's been cool about it and thanked me to be honest."

The incident Stackoverflowin is referring to happened in March 2016, when famous hacker Weev has made thousands of Internet-connected printers spew out anti-Semitic messages.

Anti-semitic message sent out by Weev
Anti-semitic message sent out by Weev (via Andrew Auernheimer)

A report released last week reveals the overall sorry state of printer security. Researchers argued that printers could be used as entry and pivot points when attacking corporate networks.

Below is a collection of tweets and images from the people that had printers spew out Stackoverflowin's message.

Related Articles:

Spectre and Meltdown Hardware Protection Added to Intel's 9th Gen CPUs

Andromeda Botnet Operator Released With a Slap on the Wrist