Keeping Receipts: GreyNoise Observes Coordinated PrintJacking Campaign Impacting Receipt Printers

On November 24, 2021, GreyNoise’s passive sensor network observed a single IP address mass transmitting a message in plaintext to port 9100, a common port for printer connections. The text is related to Reddit’s /r/antiwork, a subreddit dedicated to discussing and seeking an end to exploitative work. Since the initial observation, we’ve seen a significant increase in transmissions.

Printers, when exposed to the Internet over port 9100, will print any plaintext received. As seen in Figure 1, this message was formatted with the proper dimensions specifically for receipt printers. This appears to be corroborated by a dozen individuals posting printed receipts from their place of work with variations of the messages observed by GreyNoise, Figure 1. GreyNoise has seen 29 variations of the same few messages, which have been provided at the end of this blog.

TIMELINE OF EVENTS

The observed activity began with reconnaissance. GreyNoise saw several actors performing network scans using Nmap, ZMap, and masscan to verify that port 9100 is open before relaying r/antiwork messages. Figure 2 shows the timeline of activity, with activity coming from over 60+ unique IPs over the span of the week.

The bulk of activity originates from IPs belonging to “BL Networks," a hosting provider based out of the Netherlands (view it on GreyNoise).  Figure 3 shows the geographical breakdown of IPs transmitting the messages.

While the messages are not specific to the United States, the majority of the traffic was largely directed at North American IPs.

The GreyNoise Research team was able to identify at least one concerted effort behind the recent activity. Figure 4 shows individual IP activity observed by GreyNoise sensors over time. IPs are colored by their numerical adjacency. For example, 192.168.1.1 and 192.168.1.2 would be colored similarly since they are numerically adjacent, but 10.0.0.1 and 192.168.1.1 are not.

Researchers observed a diverse set of uncoordinated IP addresses responsible for the activity around Thursday, November 25 (U.S. Thanksgiving) and Friday, November 26 (Black Friday). Prior to November 26, activity was scattered amongst different source IPs and ASN ranges. However, in the following week, we noted two additional sets of coordinated IPs on November 29th and December 2.

WHOAMI

Researchers determined that, as of December 2nd, all servers used to transmit the messages had port 80 open and were running Python 3.9.2 SimpleHTTPServer. The servers exposed a directory with the text files, presumably the content being transmitted by the server:

Based on associated SSL Certificates and domain information, the team was able to make contact with the current owner of one of the IPs. The owner responded with the following:

GreyNoise researchers were unable to determine  whether or not the current owner is responsible for the activity, though they did respond letting us know they took down one of the servers (which GreyNoise has corroborated).

FINAL THOUGHTS

This is not the first time printjacking has occurred. GreyNoise has previously observed coordinated activity on port 9100 in 2018 related to an incident involving YouTube superstar PewDiePie.

When asked for recommendations on best practices, GreyNoise  IT & Security Director responded: “In order to avoid printjacking, we recommend ensuring port 9100 on your device remains closed to the Internet. If your printer vendor requires connection to an open port, it’s a good time to consider a different provider."

Learn more about GreyNoise and follow us on LinkedIn and Twitter.

APPENDIX: MESSAGES

GreyNoise has seen 29 variations of the same few messages, which you can read below or access via this Gist.

RIDDLE ME THIS


How can the McDonald's in Denmark manage
to pay their staff $22 an hour and still
sell a Big Mac for less than in America?

Answer: UNIONS!


Did you know that it is a rather
simple task to organize a UNION?


Learn More:
=====================
reddit.com/r/antiwork
=====================

----------------------------------------------------------

ARE YOU BEING UNDERPAID?


You have a legal, protected right to discuss your pay with your coworkers.

This should be done on a regular basis to ensure that everyone is being paid fairly.

It is ILLEGAL for your employer to punish you for doing this.

If you learn that you are being paid less than someone else who is doing the same job,
you should demand a raise or consider quitting and finding a different job.

SLAVE WAGES only exist because people are willing to work for them.


Learn More:
=====================
reddit.com/r/antiwork
=====================

----------------------------------------------------------

======================
NEW YEAR'S RESOLUTIONS
======================

1. Hit the Gym
2. Delete Facebook
3. ORGANIZE A UNION


Learn More:
=====================
reddit.com/r/antiwork
=====================

----------------------------------------------------------
=========================
WHAT TO DO ON BREAK TODAY
=========================

1. Talk about your PAY
2. Talk about your RIGHTS
3. Begin ORGANIZING A UNION

GOOD employers are not afraid
of these, but ABUSIVE ones are.


Learn More:
=====================
reddit.com/r/antiwork
=====================

----------------------------------------------------------
=====================
INFLATION WAGE NOTICE
=====================

Due to the 6.2% inflation rate,
all US workers are entitled to
at least a 6.2% pay adjustment.

We have received reports of
some ABUSIVE EMPLOYERS not
providing these adjustments.

If you have not received such a
raise, please ask your employer
why your PAY WAS CUT.


Learn More:
=====================
reddit.com/r/antiwork
=====================
----------------------------------------------------------

=========================
WHAT TO DO ON BREAK TODAY
=========================

1. Talk about your PAY
2. Talk about your RIGHTS
3. Begin ORGANIZING A UNION

GOOD employers are not afraid
of these, but ABUSIVE ones are.


Learn More:
=====================
reddit.com/r/antiwork
=====================
----------------------------------------------------------

TIME IS YOUR MOST VALUABLE ASSET.

Not only can you never obtain any
more of it, you do not even know
how much you have to begin with.

Why are you selling YOUR TIME
for SO LITTLE?

Join the "25 OR WALK" movement!

Tell your employer that YOUR TIME
is worth no less than $25 per hour,
and for them to call you when
they are ready to pay up.

But don't quit!

Make them fire you!
... and spend YOUR TIME with family
... and spend YOUR TIME with friends
... and rediscover YOUR favorite hobby
... and RECLAIM YOUR LIFE

SLAVE WAGES only existed because
people were willing to work for them.

BUT NOT ANYMORE.

THIS. ENDS. NOW.


Learn More:
=====================
reddit.com/r/antiwork
=====================
----------------------------------------------------------
HOW TO SCARE A SLAVE OWNER:

1. Talk about your PAY
2. Talk about your RIGHTS
3. Talk about FORMING A UNION

Employers are not scared of
these, but SLAVE OWNERS are.


Learn More:
=====================
reddit.com/r/antiwork
=====================
----------------------------------------------------------
==========================
ABUSIVE EMPLOYER CHECKLIST
==========================

[ ] Can't talk about PAY
[ ] Can't talk about RIGHTS
[ ] Can't talk about UNIONS
[ ] Punished for getting SICK
[ ] Punished for taking VACATION

If your employer checks ANY of
these, please contact support:

reddit.com/r/antiwork
----------------------------------------------------------
:::::::::::::::::::::::::::::::
::::: TIME IS :::::::::::::::::
::::::: YOUR MOST :::::::::::::
:::::::::: VALUABLE ASSET :::::
:::::::::::::::::::::::::::::::

Not only can you never
obtain any more of it,
you do not even know how
much you have to begin with.

LIFE IS SHORT!

Why are you selling YOUR TIME
for SO LITTLE?

Join the "25 OR WALK" movement!

Tell your employer that YOUR
TIME is worth no less than
$25 per hour, and for them
to call you when they are
ready to pay up.

But DON'T QUIT!

MAKE THEM FIRE YOU!

... and spend YOUR TIME
...... with FAMILY

... and spend YOUR TIME
...... with FRIENDS

... and rediscover YOUR
...... FAVORITE HOBBY

... AND RECLAIM YOUR LIFE

POVERTY WAGES only existed
because people were "willing"
to work for them.

BUT NOT ANYMORE.

THIS. ENDS. NOW.


Learn More:
=====================
reddit.com/r/antiwork
=====================

----------------------------------------------------------

ARE YOU BEING UNDERPAID?


You have a legal, protected right to
discuss your pay with your coworkers.

This should be done on a regular basis to
ensure that everyone is being paid fairly.

It is ILLEGAL for your employer to punish
you for doing this.

If you learn that you are being paid less
than someone else who is doing the same
job, you should demand a raise or consider
getting fired and finding a better job.

SLAVE WAGES only exist because people are
willing to work for them.


Learn More:
=====================
reddit.com/r/antiwork
=====================
----------------------------------------------------------

==============
RIDDLE ME THIS
==============

How can the McDonald's
in Denmark pay their staff
$22 an hour and still manage
to sell a Big Mac for
less than in America?

Answer: UNIONS!


A GOOD UNION can easily
align everyone's goals.

Did you know that it
is a rather simple task
to organize a UNION?


Learn More:
=====================
reddit.com/r/antiwork
=====================
----------------------------------------------------------

========================
ARE YOU BEING UNDERPAID?
========================

You have a protected LEGAL
RIGHT to discuss your pay
with your coworkers.

This should be done on a
regular basis to ensure that
everyone is being paid fairly.

It is ILLEGAL for your employer
to punish you for doing this.

If you learn that you are being
paid less than someone else who
is doing the same job, you
should demand a raise or
consider getting fired and
finding a better employer.

POVERTY WAGES only exist
because people are "willing"
to work for them.


Learn More:
=====================
reddit.com/r/antiwork
=====================
----------------------------------------------------------
RIDDLE ME THIS


How can the McDonald's in Denmark manage
to pay their staff $22 an hour and still
sell a Big Mac for less than in America?

Answer: UNIONS!


Did you know that it is a rather
simple task to organize a UNION?


Learn More:
=====================
reddit.com/r/antiwork
=====================
----------------------------------------------------------
=====================
INFLATION WAGE NOTICE
=====================

Due to the 6.2% inflation rate,
all US workers are entitled to
at least a 6.2% pay adjustment.

We have received reports of
some ABUSIVE EMPLOYERS not
providing these adjustments.

If you have not received such a
raise, please ask your employer
why your PAY WAS CUT.


Learn More:
=====================
reddit.com/r/antiwork
=====================
----------------------------------------------------------
RIDDLE ME THIS


How can the McDonald's in Denmark manage
to pay their staff $22 an hour and still
sell a Big Mac for less than in America?

Answer: UNIONS!


Did you know that it is a rather
simple task to organize a UNION?


Learn More:
=====================
reddit.com/r/antiwork
=====================

----------------------------------------------------------
========================
ARE YOU BEING UNDERPAID?
========================

You have a protected LEGAL
RIGHT to discuss your pay
with your coworkers.

This should be done on a
regular basis to ensure that
everyone is being paid fairly.

It is ILLEGAL for your employer
to punish you for doing this.

If you learn that you are being
paid less than someone else who
is doing the same job, you
should demand a raise or
consider getting fired and
finding a better employer.

POVERTY WAGES only exist
because people are "willing"
to work for them.


Learn More:
=====================
reddit.com/r/antiwork
=====================

----------------------------------------------------------
==========================
ABUSIVE EMPLOYER CHECKLIST
==========================

[ ] Can't talk about PAY
[ ] Can't talk about RIGHTS
[ ] Can't talk about UNIONS
[ ] Punished for getting SICK
[ ] Punished for taking VACATION

If your employer checks ANY of these,
please contact support at:

reddit.com/r/antiwork

----------------------------------------------------------

TIME IS YOUR MOST VALUABLE ASSET.

Not only can you never obtain any
more of it, you do not even know
how much you have to begin with.

Why are you selling YOUR TIME
for SO LITTLE?

Join the "25 OR WALK" movement!

Tell your employer that YOUR TIME
is worth no less than $25 per hour,
and for them to call you when
they are ready to pay up.

But don’t quit!

Make them fire you!
... and spend YOUR TIME with family
... and spend YOUR TIME with friends
... and rediscover YOUR favorite hobby
... and RECLAIM YOUR LIFE

SLAVE WAGES only existed because
people were willing to work for them.

BUT NOT ANYMORE.

THIS. ENDS. NOW.


Learn More:
=====================
reddit.com/r/antiwork
=====================

----------------------------------------------------------

TIME IS YOUR MOST VALUABLE ASSET.

Not only can you never obtain any
more of it, you do not even know
how much you have to begin with.

Why are you selling YOUR TIME
for SO LITTLE?

Join the "25 OR WALK" movement!

Tell your employer that YOUR TIME
is worth no less than $25 per hour,
and for them to call you when
they are ready to pay up.

But don’t quit!

Make them fire you!
... and spend YOUR TIME with family
... and spend YOUR TIME with friends
... and rediscover YOUR favorite hobby
... and RECLAIM YOUR LIFE

SLAVE WAGES only existed because
people were willing to work for them.

BUT NOT ANYMORE.

THIS. ENDS. NOW.


Learn More:
=====================
reddit.com/r/antiwork
=====================
----------------------------------------------------------


HOW TO SCARE A SLAVE OWNER:

1. Talk about your PAY
2. Talk about your RIGHTS
3. Talk about FORMING A UNION

Employers are not scared of
these, but SLAVE OWNERS are.


Learn More:
=====================
reddit.com/r/antiwork
=====================

----------------------------------------------------------
======================
NEW YEAR'S RESOLUTIONS
======================

1. Hit the Gym
2. Delete Facebook
3. ORGANIZE A UNION


Learn More:
=====================
reddit.com/r/antiwork
=====================
----------------------------------------------------------

HOW TO SCARE A SLAVE OWNER:

1. Talk about your PAY
2. Talk about your RIGHTS
3. Talk about FORMING A UNION

Employers are not scared of
these, but SLAVE OWNERS are.


Learn More:
=====================
reddit.com/r/antiwork
=====================
----------------------------------------------------------

ARE YOU BEING UNDERPAID?


You have a legal, protected right to
discuss your pay with your coworkers.

This should be done on a regular basis to
ensure that everyone is being paid fairly.

It is ILLEGAL for your employer to punish
you for doing this.

If you learn that you are being paid less
than someone else who is doing the same
job, you should demand a raise or consider
quitting and finding a different job.

SLAVE WAGES only exist because people are
willing to work for them.


Learn More:
=====================
reddit.com/r/antiwork
=====================
----------------------------------------------------------
:::::::::::::::::::::::::::::::
::::: TIME IS :::::::::::::::::
::::::: YOUR MOST :::::::::::::
:::::::::: VALUABLE ASSET :::::
:::::::::::::::::::::::::::::::

Not only can you never
obtain any more of it,
you do not even know how
much you have to begin with.

LIFE IS SHORT!

Why are you selling YOUR TIME
for SO LITTLE?

Join the "25 OR WALK" movement!

Tell your employer that YOUR
TIME is worth no less than
$25 per hour, and for them
to call you when they are
ready to pay up.

But DON'T QUIT!

MAKE THEM FIRE YOU!

... and spend YOUR TIME
...... with FAMILY

... and spend YOUR TIME
...... with FRIENDS

... and rediscover YOUR
...... FAVORITE HOBBY

... AND RECLAIM YOUR LIFE

POVERTY WAGES only existed
because people were "willing"
to work for them.

BUT NOT ANYMORE.

THIS. ENDS. NOW.


Learn More:
=====================
reddit.com/r/antiwork
=====================

----------------------------------------------------------
ARE YOU BEING UNDERPAID?


You have a legal, protected right to
discuss your pay with your coworkers.

This should be done on a regular basis to
ensure that everyone is being paid fairly.

It is ILLEGAL for your employer to punish
you for doing this.

If you learn that you are being paid less
than someone else who is doing the same
job, you should demand a raise or consider
getting fired and finding a better job.

SLAVE WAGES only exist because people are
willing to work for them.


Learn More:
=====================
reddit.com/r/antiwork
=====================
----------------------------------------------------------

==========================
ABUSIVE EMPLOYER CHECKLIST
==========================

[ ] Can't talk about PAY
[ ] Can't talk about RIGHTS
[ ] Can't talk about UNIONS
[ ] Punished for getting SICK
[ ] Punished for taking VACATION

If your employer checks ANY of
these, please contact support:

reddit.com/r/antiwork
----------------------------------------------------------



ARE YOU BEING UNDERPAID?


You have a legal, protected right to
discuss your pay with your coworkers.

This should be done on a regular basis to
ensure that everyone is being paid fairly.

It is ILLEGAL for your employer to punish
you for doing this.

If you learn that you are being paid less
than someone else who is doing the same
job, you should demand a raise or consider
getting fired and finding a better job.

SLAVE WAGES only exist because people are
willing to work for them.


Learn More:
=====================
reddit.com/r/antiwork
====================

----------------------------------------------------------



==============
RIDDLE ME THIS
==============

How can the McDonald's
in Denmark pay their staff
$22 an hour and still manage
to sell a Big Mac for
less than in America?

Answer: UNIONS!


A GOOD UNION can easily
align everyone's goals.

Did you know that it
is a rather simple task
to organize a UNION?


Learn More:
=====================
reddit.com/r/antiwork
=====================