HP Ink Printers Remote Code Execution | Hacker News Reader

HP Ink Printers Remote Code Execution

support.hp.com

71 pointsYhippa49 comments

Best printer decision I've ever made was to buy a Brother laser printer. It's like going from a flip phone to a smart phone. I rarely print anything, but when I do it's reliable, fast, and very easy to use. I buy toner maybe once every few years.

I think it's like going from a smart phone to a flip phone (reverse of what you said). I don't need your big-ass driver package, your HP ColarSmartz Fotoz app, your constant pop ups about ink being low, yes, again. I want to not think about you.

Whereas with our Brother laser printer, I couldn't tell you the last time I bought toner, or gave that printer much thought at all other than grabbing a sheet off the print tray.

Why are printer drivers still a thing in 2018 in the Windows world?

I make sure the printer supports AirPrint and "it just works" with Macs, and my IOS devices -- including my ancient circa 2010 iPad that hasn't seen an update in 7 years (yeah I got a newer iPad also).

My job currently is mostly programming, but until about a year ago, it was mostly sysadmin and helpdesk monkey for a small-ish company (~75 users).

In this time I have had enough inexplicable printer-related problems, that my views on printing are no longer fit for a public forum. If I could, I would go Office Space on each and every one of those hellish machines.

But I need to remember, it's not the printer's fault, it's Windows - on GNU/Linux, printing has Just Worked(tm) for me for the last ... about ten years. Once upon a time I was reduced to converting my print jobs to the printer's native language with Ghostscript and then cat(1) the resulting files (one per page) to the printer's device file. But then came CUPS, and while some people still complain that GNU/Linux is not suitable for desktop use, when it comes to printing the experience is lightyears ahead of Windows.

I think that's where the parent was coming from. If you're used to using Macs (plug printer in, OS says, "a Brother L12B4, amirite? Cool, gimme a minute..."), and you go hook a new printer to a Windows box, the experience is going to make you go "'dafuq?" Why it has to be the way it is on Windows is a mystery to me. I'm sure there's a reason, and it's probably a completely understandable one ("decisions made in 1989, and backcompat"), but it drives me nuts when I have to deal with it.

Btw, Apple has owned CUPS since 2002 - 3 years after it was released in beta.

It is the printer manufacturers fault, Windows has had class based drivers since Vista (they could even be back ported to XP although that didn't wok very well). There is nothing in Windows that forces them to ship all the crap that sits in your notify area and bungs up your system.

If I understand what you’re saying - that still requires printer manufacturers to write and users to install printers.

I have three printers at home (long story). I bring a Mac home, connect it to my network and it finds all three and I can immediately start printing. I bring home a Windows PC, I have to install printer drivers for three printers.

Well, I figure with CUPS (the printer system currently used by macOS and GNU/Linux and other open source Un_x systems), it is the responsibility of CUPS to support printers, while on Windows, it is the responsibility of printer manufacturers to supply drivers for their printers.

Well, guess what - vendor-supplied drivers suck donkey-balls, while third-party drivers (as supplied by CUPS or GhostScript) focus on supporting the functionality the printer in question provides and nothing else.

It's the same as with GPUs, except that printers are (AFAICT) less complicated than GPUs.

In theory, Windows can do some things you can not replicate on GNU/Linux and/or macOS without major pain - e.g. that client submit their print jobs in b/w unless specifically requested otherwise (because on our support contract, color printing costs ~10x as much per page as b/w). In practice, though, it works about as reliably as trying to photograph a specific star in the sky while blindfolded and with - at best - a fuzzy idea what day it is.

People keep telling me that Windows is a superior OS for desktop systems because it "just works", but clearly those people do not do a lot of printing. ;-)

Windows has what Microsoft calls inbox drivers, these come with Windows/Windows Update. Stick with those drivers and it all looks a lot easier.

In general though I agree, it's a mess and as a developer of output management software it causes me no end of problems.

It feels like we majorly lost the ball with PostScript (or something similar). Move the smarts to the printer, and then you don't really need a model-specific driver any more.

I suspect the real story is that per-device drivers allow you to patch around a lot of stupid or wrong behavior on the hardware side, and on the low end, let the host do most of the image processing so the printer itself can be little more than a bag of dumb stepper motors and servos.

Microsoft has been able to guide other aspects of PC hardware since at least 1995. I don’t need drivers for most other hardware. You can even get basic functionality from graphics cards without drivers.

When Apple convinced printer manufacturers to support AirPrint in 2010, iOS wasn’t nearly as ubiquitous. You can find a fair amount of printers that support Google Cloud Print natively.

EDIT:

After reading a little bit more. It really is the fault of the vendors. MS tried to simplify it.

https://blog.thinprint.com/the-new-microsoft-v4-printer-driv...

One advantage Apple had was that printers had to be compatible with AirPrint without drivers for them to work on iOS, the Mac was able to piggyback off of that.

Also have a Brother laser printer. I got one on sale a few years ago for about the same price as an inkjet cartridge. Haven't had to replace the toner since I purchased it. It was definitely the best office investment I've ever made.

Worst printer decision I've ever made was to buy a Brother laser printer. The fusing roller deteriorated within a year and the warranty replacement process was more trouble than it was worth. I gave up after several back-and-forth interactions with their customer support that weren't going anywhere.

The best printer decision I've ever made is my current printer, an HP OfficeJet 8620 with an ink subscription program. This HP has printed 9620 trouble-free pages since I purchased it a bit over two years ago (May, 2016). Yes, the per-page cost is relatively expensive, but it's the least hassle I've ever had with a printer. New ink just magically shows up in the mail shortly before I need it and I mail the old cartridges back for recycling. I haven't heard "honey/dad, the printer is broken/jammed/out-of-ink/won't-print again" since I purchased it.

My first printer was an Apple thermal printer, my second an Epson MX 100, so I've dealt with _a lot_ of printers over the years, from Apple, Epson, Canon, Brother, HP, and maybe other brands I'm forgetting.

I previously tried things like bulk ink tanks and refilling toner cartridges. Not worth the hassle.

I'm glad you're happy with your Brother. Mine had great initial reviews, but then when I checked back on Amazon a year later other folks has the same fuser roller issue:

https://www.amazon.com/gp/customer-reviews/R16HGOAIYLS1IJ/re...

Maybe it was specific to that model (HL-3170CDW). I don't know.

Wow that's weird, I have two and many of my friends have them and none of us have ever had an issue. We might have different models though.

I second this. My company went through a dozen brothers before switching to HP and Xerox. Brother printers are fine for occasional use but they don't hold up for daily office use.

Unfortunately, your experience with the HL-3170CDW is extremely common. We had it happen and it is very well documented on Amazon. We found an Australian company that detailed the issue in their "fault of the week" page:

http://fixitfastelectronics.com/mfc9330cdw-9140cdn-emboss.ht...

The TLDR there is that the HL-3170CDW has a sharper-than-normal lift off angle from the fuser roller (the part that fails). Inexpensive toner is more sticky than the Brother-brand toner, so it causes undue fatigue on the part.

We had this same issue happen to us about 1000 pages after switching to an ultra-cheap, pour-in toner option. We first replaced the roller with a cheap one from Ebay that ended up causing the printer to overheat. Then we bought a custom manufactured roller from the aforementioned Australian company. That one has lasted us more than 3000 page so far, even with the cheap toner.

Note: if you elect to change the roller yourself, don't touch the heating element / bulb inside of the roller with your fingers!

My best printer decision is to just not have a printer. Once a year when I need to print something at home I go to a print shop.

Obviously some people need to print a lot of stuff but I'd wager half the people with home printers would be better off without.

I like the brothers but i don't appreciate how they declare they are out of toner when they still have a couple of hundred pages left when you “reset” the toners.

This reminds me of this [1] talk at 28c3 (Ang Cui on how to exploit HP printers by sending a modified PDF to them). Which lead to one of the most hilarious IT-Sec headlines [2]

[1] https://www.youtube.com/watch?v=njVv7J2azY8 [2] http://gawker.com/5863388/hackers-could-turn-your-printer-in...

Luckily, there's an error code for that: https://en.wikipedia.org/wiki/Lp0_on_fire

There is IMHO some form of "disconnection" between using "certain":

>Two security vulnerabilities have been identified with certain HP Inkjet printers.

and then list more than 200 (two hundred) printer models.

Maybe so, but "certain", from a grammatical standpoint, implies that they know exactly which models are affected, which in turn implies that it is not the entirety of their printers that are affected. Maybe that's not the case, and every single printer they make is affected, but that's just my thought on it ¯\_(ツ)_/¯

I don't know, by reading "certain HP Inkjet printers" I imagined that it would imply a small number of "known" affected models (all belonging to the Inkjet family, of course).

It seems to me that the given list could be better summed up with something like:

"All HP Inkjet printers manufactured in the last n years, with the exception of models A, B and C"."

>entirety of their printers that are affected

Some were too old for this vulnerability?

To be fair, that list doesn't seem to include any of their LaserJet range, which I've always thought was their "business class" printers...

Laserjets wouldn't be in the set of "certain HP Inkjet printers" because they are Laserjets, not Inkjets. :P

Is there an open source method to upgrade the firmware? The HP website lists two methods: first using their “eprint” web service where you have to accept some BS terms of service (no thanks) or opaque binary blobs for Windows or Mac.

Random fact: Richard Stallman may have been spurred to start the GNU Project due to the fact that he could not easily modify the source code of a printer.

Which makes it ironic that there are still no open source printers. There are even open source 3D printers, but putting ink on paper is still annoyingly out of reach.

Just 3D print movable type and call it a day.

I did once consider just 3D printing a single very thin layer :-)

More practically, a 3D printer is probably only a half step removed from a decent plotter if you just replace the head with a pen or something.

For whatever reason my printer (8610) provides an automatic update via the webinterface, but it can't find any update. Also the HP firmware updater for macOS isn't signed. Oh well.

Where do you find a firmware updater for macOS? Only instructions I see require connecting the printer to the public internet, which I'd rather not do.

Tried reading the information, but can't understand if RCE is on the printer fimrware or the PC host. Anyone know?

Firmware. From Resolution section:

> HP has provided firmware updates for impacted printers as set forth in the table below.

There isn't any information, the CVEs aren't yet public.

> HP has provided firmware updates for impacted printers as set forth in the table below.

Fortunately, my trusty old LaserJet 1010 does not have a network interface. But I suspect that outside of organizations dealing with classified data, printer security is fairly terrible, anyway.

Too many organisations put printers on their internal networks.

Printers should be on a seperate subnet, firewalled off to oncy accept incoming connections (and maybe outbound to specific radius and SMTP servers), and not given internet access.

Then they can’t automatically order supplies.

The printer I work with these days will phone for supplies that tend to arrive the day before the toner runs out.

Although I imagine the network connection could be replaced with a phone line, but there’s only one landline in this company of 500+ people and I’m using it for something else.

At work, we have an Agent running on one of our servers that queries the printers via SNMP (Well, I think it uses SNMP) and then sends the results to the mothership. When toner runs low, new toner arrives.

But yeah, we keep our printers on the same network segment as the clients. Maybe we should change that. Then again, I have enough on my plate as it is.

But I suspect that outside of organizations dealing with classified data, printer security is fairly terrible, anyway.

You’d be surprised. One org I worked for had a Kyocera all kitted our for HIPAA compliance.

I looked through the manual for it once and it glossed over a number of very interesting data handling techniques. The only one I remember off the top of my head is that after a print job, the internal hard drive would scrub itself and repeatedly write garbage data over the location of the previous print job.

To the user it was seamless, except for the occasional tiny “Purging hard drive data” notice at the bottom of the printer’s screen.

Well, in a way, companies that need to be HIPAA-compliant deal with kind-of classified data. I should have chosen my wording more carefully.

Hmmm ... I'm curious why this article is getting any traction on HN. Is it the novelty of remote code execution on a printer? This isn't news:

Defcon presentation from Defcon 19 (I swear I remember something earlier than this, but this is just from a quick search) https://www.defcon.org/images/defcon-19/dc-19-presentations/...

Also: https://github.com/RUB-NDS/PRET

Because this is a new vulnerability.

Does PRET even still work? I'd be surprised if the vulnerabilities that allow PRET to work haven't been patched.

I wonder if anyone actually writes to them to ask for a pgp signed version of the security bulletin...

Is anyone going to develop custom firmware / jailbreak for the vulnerable printers?

HP's "The Wolf" commercials (feat. Mr. Robot^WChristian Slater) totes up their printers as "the world's most secure printing": https://www.youtube.com/watch?v=DkajtSOAyec :)

I think it has something to do with their recently announced bounty.

Reply on news.ycombinator.com