Hackers Attack Businesses' Printers, Make Them Print "Antiwork" Messages Instead Of Receipts

Some people are taking the Great Resignation really seriously and are fighting for its ideas even outside of their own workplace.

Employees across the United States are finding that their store receipt printers are spamming pro-labor and pro-union messages as hackers exploit them through wireless networks.

Trying to reach those who need it the most—the underpaid, undervalued, and overworked—these messages encourage workers to discuss their wages, demand better conditions, and value their time and selves outside of their career, often directing the readers to the subreddit r/AntiWork, which has exploded in popularity in recent months.

One of the people who received such a receipt is Redditor Kiwi_Koalla.

"My coworkers and I returned to work after being closed for Thanksgiving and nearly all of our Grubhub receipt printers (we work in a campus food court) had long sheets printed out with the same 4-5 messages on them," Kiwi_Koalla told Bored Panda. "It was a slow day with minimal staff so not many people saw the message but it's continued to print a few times a day so I'm sure by now they all have seen it."

That includes their shift supervisor. "They checked the [subreddit] and deemed it 'boring' so I don't think my bosses feel threatened," Kiwi_Koalla said, laughing.

"We're already unionized at my place of work and wages are pretty clearly defined (we have different ranges for different positions, depending on experience and length of time worked, and our union keeps those moving together), so there isn't much anyone in my workplace can take away from it except maybe to talk to the union about raising wages again, but that's a pretty much constant negotiation anyway."

Kiwi_Koalla thinks this whole receipt thing is "ridiculous" and lacks coordination to be taken seriously. "It's clearly not a concentrated effort from the community or the mods at r/AntiWork. If someone who had never used Reddit before saw that and went to the site, they would get nothing of value," they explained. "The receipts all say 'Learn more on r/AntiWork but what are they supposed to learn?"

"When you visit the site, there are no pinned posts like 'Interested in starting a union? Check out these sources' or 'Mysterious receipt bring you here? Get started by clicking this post.' It's all people complaining about their bosses and working on holidays and having vacations denied. The mods aren't in on this. It's one loner or maybe a small group sort of trying to be part of the labor movement but they're on the wrong track. r/unions has a more helpful message, and better guidance on how one should move forward if they're interested."

MunificentDance is another Redditor who was surprised by a batch of these receipts. "They just showed up at the printer which prints the orders," they told Bored Panda.

"I think [parts of their message are] somewhat misleading but I overall agree with the sentiment."

MunificentDance said their higher-ups also saw the receipts by they chose to ignore the whole thing.

"I knew about r/AntiWork before this, I like the subreddit and it's nice to see people fighting against the system."

As journalists from Motherboard have pointed out, there are countless similar posts on r/Antiwork and some Redditors have suggested that the messages are fake (i.e. produced by people who have access to a receipt printer and posted for online clout or as part of a conspiracy to make it seem like the subreddit is doing something illegal).

But Andrew Morris, the founder of GreyNoise, a cybersecurity firm that monitors the internet, told Motherboard that his firm has seen actual network traffic going to insecure receipt printers, and that it looks like someone or even multiple people are sending these printing jobs all over the internet indiscriminately, as if spraying or blasting them all over. Morris has a history of catching hackers exploiting insecure printers.

"Someone is using a similar technique as 'mass scanning' to massively blast raw TCP data directly to printer services across the internet," Morris said. "Basically to every single device that has port TCP 9100 open and print a pre-written document that references r/AntiWork with some workers rights/counter capitalist messaging."

Whoever is behind this, Morris said, they're doing it "in an intelligent way."

"The person or people behind this are distributing the mass-print from 25 separate servers so blocking one IP isn't enough," he explained.

"A technical person is broadcasting print requests for a document containing workers rights messaging to all printers that are misconfigured to be exposed to the internet and we've confirmed that it is printing successfully in some number of places the exact number would be difficult to confirm but Shodan suggests that thousands of printers are exposed," he said, referring to Shodan, a tool that scans the internet for insecure computers, servers, and other devices.

The history of hackers exploiting insecure printers is pretty rich. A few years ago, for example, one of them made printers spit out promotions for YouTuber PewDiePie. In 2017, another hacker made printers spread a message where they were bragging and calling themselves "the hacker god."