Coordinated Print Jacking Campaign Impacting Receipt Printers | Cybersecurity Blog | Grey Noise

Summary: On November 24, 2021, GreyNoise's passive sensor network observed a single IP address mass transmitting plaintext to port 9100, a common printer port, with messages tied to Reddit's /r/antiwork subreddit, and transmissions increased significantly afterward. GreyNoise counted 29 message variations sent from over 60 unique IPs across a week, mostly from a Netherlands hosting provider called BL Networks and largely directed at North American IPs, with coordinated sets of IPs appearing on November 29 and December 2.
Bottom line: Any printer exposed to the internet on port 9100 will print whatever plaintext it receives, so the same open port that carried labor-organizing flyers can carry anything else - and GreyNoise's own IT and Security Director says the fix is keeping port 9100 closed to the internet.

Read the original at GreyNoise Blog ↗