Message on printer...is this some sort of hack?

Question

This message was on my printer this morning...anyone know what this means?
&nbsp;
I have a Nighthawk R7000P with Armor activated.
&nbsp;
# GET / HTTP/1.1
Host: Internet address
Accept: */*
User-Agent: python-requests/2.9.1
Connection: keep-alive
Accept-Encoding: gzip, deflate

schumaku · Answer

TIRESIAS&nbsp;wrote:I have two printers attached to the router and since the "trial version" of the NETGEAR's ARMOR was installed, about 40 pages of copier paper have been trashed! Each "cycle" uses five pages. The first page is a six lines message that starts with the GET / HTTP/1.1 line. By the fifth page, it is a one liner of a few ASCII characters?! "Nice" feature NETGEAR!Typical behavior when doing fingerprinting and security tests on open ports trying for a Web server. Depending on the vulnerability checks run, e.g. some CGI and/or overflow tests, some "specific" code is sent to these ports, what can lead to random output - or worst case it can make the printer port hang or lock up.&nbsp;That's the "fun" when dealing with automated and scheduled vulnerability testing. Netgear resp. Bitdefender has to find way to exclude some devices (by IP, by MAC) from the regular "attacks".&nbsp;Christian_R&nbsp; please push this forward to the Armor and Bitdefender teams.

DexterJB · Answer

Hi Lionkill, this has been reported to engineering and is currently being worked on. We will provide an update once available.

&nbsp;

Dexter

schumaku · Answer

Of course, the Armor (Bitdefender) does run some vulnerability tests over all network devices discovered - so this is most likley an IP address of a machine where you have installed it.
&nbsp;
And again, you can post these 192.168.x/24 addresses - we're all using the same (except those which are on the 10/8 prefix or in the&nbsp;172.16/12 prefixes.

TIRESIAS · Answer

I have two printers attached to the router and since the "trial version" of the NETGEAR's ARMOR was installed, about 40 pages of copier paper have been trashed! Each "cycle" uses five pages. The first page is a six lines message that starts with the GET / HTTP/1.1 line. By the fifth page, it is a one liner of a few ASCII characters?! "Nice" feature NETGEAR!

schumaku · Answer

Could be any vulnerable&nbsp;scanner testing the printer port for the presence of a Web server service. However, good scanner don't hide behind a generic "User-Agent: python-requests/2.9.1" ...
&nbsp;
# GET / HTTP/1.1
Host: Internet address
Accept: */*...
&nbsp;
What is the Internet address is shown (printed) here?

Forum Discussion

Message on printer...is this some sort of hack?

10 Replies