Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So at my business our receipt printer randomly printed some questionable looking data.

I looked into scanproxy.net and it's clearly not something legitimate.

Can anyone give me a better idea of what's happening here?

GET http://www.scanproxy.net:80/p-900.htm
1 HTTP/1.0
Content-Type: text/html
Proxy-Connection: keep-alive
Host: www.scanproxy.net
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, application/x-shockwave-flash */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; KuKu 0.65)
Authorization: Basic 0g==

All but one computer in the network are machines running OS:X - 1 Windows XP machine.

Customers sometimes connect to the network when they visit, so this might be such a situation.

What should be my next step?

Thanks so much!

share|improve this question
3  
Did you miss a step here? How did you get from "my printer did something weird", to scanproxy.net? –  Polynomial Jul 21 '13 at 16:28
    
Wait, you allow customers to connect to the internet from your business computer? –  Casey Jul 21 '13 at 16:35
    
Allow me to clarify. Customers have their own 'guest' network they connect to. I didn't skip a step - the above is what the printer printed out. –  Joe Jul 21 '13 at 16:52
1  
Open proxy probing? That would be pretty random and on all your public IPs. One of these proxy scanners found your printer's IP, that would be my guess. What's its IP doing outside your firewall? –  TildalWave Jul 21 '13 at 17:05
    
Your guess is as good as mine. its just a basic printer setup, it was not intentionally outside the network. –  Joe Jul 21 '13 at 18:42
add comment

1 Answer

up vote 7 down vote accepted

Anyone able to use your printer is a vulnerability. This is a resource that should not be exposed to public networks. I suspect that "scanproxy.net" is well... scanning for proxies. Its likely that they connected to an open port and tried to proxy a GET request for http://www.scanproxy.net:80/p-900.htm, but instead this was interpreted as data to be printed.

Conduct a full port scan (0-65535) of your network range from an external node. Close any unnecessary ports.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.