Brother accused of locking down third-party printer ink cartridges
tomshardware.com
tomshardware.com
Since then, I've been edge blocking the rdns of update.brother.co.jp. It usually resolves to 4 IPv4 addys. Depending on the DNS resolver, they should lie in one of these subnets.
3.164.143.0/24 # per asia dns
13.249.98.0/24 # per us dns
18.154.219.0/24 # can't recall
18.155.68.0/24 # per alibaba dns
18.160.225.0/24 # per he.net
Applying updates without user consent is the evil part.
I wonder if this is a way to install custom firmware. Probably not. I would guess that the code that decodes the firmware from the print job probably passes it through the same signature check code as the regular firmware update process.
Still it's an interesting route for exploit exploration.
The complexity is really in constructing the replacement firmware to drive the hardware correctly; developing that is probably easier if you dismantle the printer and find debug leads on the motherboard. Getting the common chips like networking going sounds doable, but for the actual printing there's lots of trade secrets around driving the actual printing hardware.
A more likely route: a Chinese factory should be able to make a smallish batch of cheap monochrome laser printers with good-enough print quality, publish badly-written but usable specs for it, and make it easy to replace the firmware.
I don't know if I'd be surprised or not to find out that you actually can't print from ios. It seems crazy to me, especially considering ipads, but the entire Apple ecosystem seems crazy to me and yet it exists despite my incredulity.
I could even print from webos and palm but I guess that doesn't matter now. 50/50 toss up if the current webos on lg tvs still has any printer drivers. But if there was still any webos printer drivers, they will not be open source and so you can not trust them not to do unwanted things to your printer some day.
I could never understand why my Windows Explorer (back in the ZoneAlarm days) were speaking to Microsoft when I was searching for my FileName.doc inside my C: Drive.
I could understand the Word or Excel accessing when I need "Help" (I assume online help file was more frequently updated).
No! Naughty developers and naughty businesses. My machines should leave my 127.0.01 when I want for MY uses and MY needs and MY convenience.
For vast majority of home users the only app that needs to 'get out' is their browser and their "windows udpate". Everything else is just tracking.
Yes.
But every now and then consumers get a tempting offer and trade a bit of their freedom for lower price, more comfort, more prestige, or something else. I.e. in practice buyers don’t mind that much and likely also don’t understand the difference and the consequences that well.
this could be a very good argument to explain why so many have become skeptical of companies.
we have example after example where companies take advantage of people.
hearing my grandfathers generation go on about “the days when you could trust a company to be fair” i used to think they were seeing with rose-tinted glasses, but more and more im convinced we’re dealing something much more nefarious than that generation.
People want security issues patched, preferrably without them having to do any work or even know about it (because they won't do the work and get annoyed at popups they don't feel like they need). People want bugs fixed (and crash reports do actually help with that, despite what some say). People want companies to prioritize the features that they're using and fix places where users get "stuck", and that's much easier with telemetry. People will almost always choose free shit over products they have to pay for, and for many products, free only works if you know what ads the user should see.
most apps fall into the latter, into the network blackhole they go. You give them an inch, they take everything.
You cant even get away from this by paying (and i'm willing to to so!) because people who actually are willing to pay are the most valuable ones to advertisers - so the incentives are there to extract even more value in such case.
In case of products from outside of software domain there's this consumer assumption that product does the thing and just the thing - food doesn't try to poison you, toys are just toys and so on.
they are aware of tradeoffs - something's cheaper, it might be less safe, less featured or maybe made a bit worse.
99% of modern software is user hostile first - data extraction and maximizing value for adverts and then it might do a bad job of actually fulfilling its purpose, with updates usually making it worse over time, or jacking up prices in form of monthly subscription instead of license sale.
The only way it could have security issues is if it's connected directly to the internet (not behind NAT) or a device on my LAN is actively attacking it. The former case is difficult to accomplish without enough expertise to know better; the latter is plausible, but mitigated by a printer too simple to easily harbor a persistent threat.
And the vast majority of people hate ads like me.
- Tech Enthusiasts: Everything in my house is wired to the Internet of Things! I control it all from my smartphone! My smart-house is bluetooth enabled and I can give it voice commands via Alexa! I love the future!
- Programmers / Engineers: The most recent piece of technology I own is a printer from 2004 and I keep a loaded gun ready to shoot it if it ever makes an unexpected noise.
P.S. More seriously I agree, we witnessed multiple times over the enshitification that inevitably follows.
Could some rogue javascript establish a connection from your browser to your printer?
I'm actually worried that some newer smart devices might be set up to use well known public wifi services that are available from consumer routers.
Just sitting here I have public "EE Wifi X" and "BT Internet" which it could connect to if configured at the factory to do that.
Then I am boned.
If it can, it's a vulnerability that has to be fixed.
Brother printers can scan to network shares without Internet access. Local networking is plenty.
I have a home office laser combo - it has a touch display on it and is bulky next to - when I need to scan in receipts I just upload it to a share folder where my accountant can pick it up.
Who's going to be sender of that email?
I went to my home router (a Fritzbox) and just blocked the printer from accessing the internet (it's under Internet -> Filter, and the printer is named BRW90....). Fairly straightforward - that should be a good enough fix, no?
Now the color cartridges keep draining although we never print in color. So of course I do not fit Brother color cartridges! For that reason and others (very average quality when printing from Linux, takes only high quality 90g paper, heads regularly clogged even with Brother ink, color prints ugly even with Brother ink), I am not satisfied with this product. Unfortunately I still have a few years of black ink to consume before getting rid of it.
Which model?
My memory is that it was a trial for 2 or 3 similar models. There was backlash and they never pursued it further.
I saw some mentions that indicated the current uproar is old issue being revisited.
Literally these are the only three sources I can find of people claiming this:
1. https://www.reddit.com/r/printers/comments/s9b2eg/brother_mf...
2. https://github.com/sedrubal/brother_printer_fwupd/issues/9
That was the last Brother color printer I'll buy, unless they go back to accepting generic toner.
https://www.reddit.com/r/printers/comments/qcstzv/downgrade_... (in German)
https://github.com/CauldronDevelopmentLLC/oh-brother/issues/...
https://www.reddit.com/r/printers/comments/w60687/comment/ih...
https://www.reddit.com/r/printers/comments/w9bc3g/downdgradi...
What are the alternatives then? Brother is often cited as the brand that is the most tolerant of generic consumables and with the least anti-consumer practices. But now that even Brother plays this game...
Swapping the drm chip from the oem starter cartridge to my 3rd party cartridge resolved the othe problem
I also have HL-3230CDW that I bought few years ago and aftermarket toner works fine.
Seems like they must have done it to the newer printers.
The new printer is completely uneconomical. I had to pay around £150 for Brother set of toners, whereas aftermarket for my older printer is just £35. The quality is the same.
Anyway, it's definitely possible that these newer issues are Brother doing something nefarious, but I could also see a lot of these issues being with finicky sensors.
So ... not HP, not Brother ... anyone left that sells reasonable printers with honest firmware?
It has ink reservoirs rather than cartridges, and small, permanently plumbed tubes that go from the reservoirs to the print head.
Not only does that mean there's no way it can tell what kind of ink I'm putting in it, it also means the tanks are fucking massive. It's so nice being able to go O(years) without refilling.
It cost about twice what a comparable, cartridge-based printer cost at the time. To this day I still consider it one of the best purchases I've ever made.
It was Wikipedia that reminded me Xerox even existed. All my other research led to the usual shitlist: HP, Canon, Brother, etc. No problems on Linux and Mac (printing and scanning), which is seems par these days, but no problems on Windows either: the manufacturer app was completely optional (but was straight to the point, functional, and worth the install).
Xerox color lasers have my glowing recommendation.
Huh, won't users just blame the printer for that?
Came with replacement toner cartridges but I'm still on the set that was installed when I got it!!
Prints are crisp, fast, and it doesn't use very much power when idle. Love it!
I quit buying inkjets 20 years ago in southwest Florida.
My workloads are similarly bursty. I've had no problems so far; the worst I've had to deal with is splotchy printing after it's been sitting for O(months), and a quick print head clean fixes that right up.
Laser printers are great if you're doing all or mostly documents though, I can't argue with that. About half of my printing is stickers and high quality photo prints, both of which benefit from inkjet printing.
(My specific model of printer is an Epson EcoTank ET-8550)
https://epson.com/For-Work/Printers/Inkjet/EcoTank-Photo-ET-...
The difference is that they're purchased separately from the ink, so as long as the original one works you can continue to use it no matter how much ink you go through.
I'd have to print hundreds of pages to even match the cost of a very cheap printer. I may never reach that threshold ever.
Best of all I don't have to worry about storing a crappy printer somewhere or have it dry out or clog up or spend time and effort on it and blocking it from accessing the internet and probably end up throwing it out and having to get a new one when I pull it out once every 4 years.
Also possible to schedule/automate a test print every so often with the low cost of printing on the large tank printers to keep the print heads happy.
I have an HP LaserJet Pro M402dw because I don't have a particular need for color.
It's true that ink tank printers need to be used regularly or else the print heads dry out like a felt tip pen. Since the ink costs next to nothing per page, I print a full page family photo once a week and hang it up somewhere around the house if I haven't used the printer for anything else, which still works out cheaper than any alternatives. The walls look like instagram, but being reminded of loved ones might not be such a bad thing.
In order to bypass the warning, you’ve traditionally needed to use a program like WIC[0], which costs $10 per use(!) - I recommend epson_print_conf[1], which is a little more tailored to the HN crowd, but does not extract a bribe every time you use it.
CIS (https://en.wikipedia.org/wiki/Continuous_ink_system ) were around for a long time, and a popular mod amongst high-volume printers, especially Epsons, after the cartridge chip DRM was defeated[1]. They definitely cost less than the printer. I suppose Epson eventually found it profitable to do it themselves and sell with a warranty, that third-party CIS often didn't have.
They also make one that can only print 8.5x11 but that has a document feeder on the scanner. It's otherwise the same printer.
I'd recommend either one, depending on how useful a document feeder would be for you and whether you need the larger print size of the one I have.
You want inkjet if you print a lot, at least a few pages every two weeks.
If you only need to print once every three months, you are going to hate inkjet, even with refillable tanks. Especially with refillable tanks. Disuse clogs up the head, which takes a lot of ink to clear.
Inkjet is only worth it if you use the hell out of it. You should only get a tank printer if you expect to actually use that much ink in less than a year.
If you want a printer that does nothing other than print your resume and tax returns- and you want it to just work every time- you want laser. You can even refill the toner if you really want. You shouldn't but you can.
I'd prefer laser printers since they handle bursty workloads better (for example I had to print 100 resumes for a career fair after 6 months of nothing), since the ink can't dry out.
This is way more annoying than cookies.
Doesn't matter if HP is an American company, their products would be illegal to sell in the EU. They have to produce a compliant product or just not sell anything.
If 90% of printers in the EU are manufactured by foreign companies that's more in line with their consumer-friendly regulations targeting US tech companies, than if there's a local printer monopoly benefiting from outrageous ink prices.
(I know pulp trees are farmed, but I too have a Brother printer ...)
It really is circumstance based, rather than always good.
"it's time" was already forever ago and some serious committed practically religious power devs tried and gave up on it, even while toppling practically all other software ecosystems.
Hell even the current locked down user-hostile printers are actually running linux and gnu software. That must be exceedingly galling.
We have fully open source hardware AND software _3D_ printers capable of printing working guns, but we can't improve the process of squirting ink on paper so it's not universally abhorred?
Whereas 2D (inkjet) printing has all of the above (minus one motor), and actually comes with a few non-trivial non-printing related expectations as well, like loading and expelling a print surface (often many in one print), optionally flipping said print surface (and this requires that ink has dried as well) and colour processing to map computer colours to real-world colours.
Their firmware updates are complete clown car. When they actually do one, the update process itself is just stupid fragile. Cross your fingers and clear your schedule for the next day in case you aren't lucky. You have a 10% chance of being left with a machine that probably still runs but works worse than before, and no ability to roll back.
I have a 11th gen intel board that is completely unusable after an update, but might possibly still be recoverable if I reinstall it into the laptop so it can use the laptop display instead of displayport. But I'd have to take my current 12th gen board out and then put it all back again after.
A Framework printer, if it matched a Framework laptop, would still have shit firmware, probably licensed from one of the majors, with all the same bad behavior, except with more bugs.
disagree it's all their fault, I've had 0 problems with my amd board on linux, and anecdotally that appears to be common on the forums, where intel is more painful.
That's one of the reasons I refused to invest prior to their amd board. I can't trust intel not to be toxic.
I'd still take a broken crappy printer from framework (assuming it's hackable, and not doom and gloom like you predict) over the status quo. I mean, I mainline linux because software being non-toxic is more important than polish will ever be to me.
[1] https://epson.ca/For-Home/Printers/Photo/Expression-Photo-XP...
Of course, that's just the positioning. If you're 2D printing on a 3D printer by mounting a pen to the end, you're also limited by the thickness of the pen tip.
In any case, you could certainly draw text, but you'd only want to use a font that relies on thin lines, nothing thick. Filled in spaces would be difficult, and of course, photos are just completely out of the question.
As mentioned in a sibling comment, really you'd have just reinvented plotters which have existed for decades.
Unless you do a lithographic print but they need a light source to be seen.
Also you can print pixels. You convert to G code so it is made up of lines.
However it would be several million in legal fees to do this and I'm not sure if they make enough on refill to pay the lawyers. Unless they can convince the courts to give them legal fees as well.
(I've contributed to it. Very useful tool.)
There might be some fixes to bugs
Nevertheless, isn't Brother still the cheapest per page even with official cartridges? I would like to get some recommendations.
Everything is great about it apart from using 3rd party generic toner cartridges. It senses they are not original, does warning messages etc. and forces me to open/close the toner door every time i switch on the printer to get it to function again.
This ball breaking forced me to buy a legit brother toner cartridge at 3x price.
Now, I’m not to pissed off because laser printing is pretty cheap and as long as you are ok with BW prints its pretty good quality and convenient. Never going back to inkjet printers.
My first HP printer forced me to spam the Stop button for 10 seconds every time I turned it on as it would always try to print a colored test page with generous amounts of ink.
Surely Eric from Pebble should focus his energy on that.
IaaS (Ink as a service). /s
Good luck with that. Unkess they inspect every single vehicle and delivery entering the state they could only make it a little less convenient and force a few more people to buy a kit instead.
A video by Stuff Made Here covered what is essentially one such machine [0].
That specific machine is meant for generating handwritten notes, but I imagine it could likely work for general purpose documents too with some tweaks.
If selling printers was a business with decent margins, you would find a lot of Chinese white label printers doing more for less.
Not to mention that if you tried to re-invent it yourself, there's a good chance you'd end up violating a patent. Even if you didn't, HP or some other company could allocate a lot of legal funding to convince a judge that you have.
He says Brother contacted him, denying any firmware changes that hinder the use of third party toner. He states that he has send them a series of questions to explore the issue further.
https://youtube.com/watch?v=bpHX_9fHNqE&lc=Ugxbi1fUIxpbKI5YT...
It took about 5 minutes to see that I would not be replacing it with another.
Canon for now.
Shipping labels. Returning something you bought online? The merchant often will send you a shipping label to print and tape to the package. My wife chooses to buy a lot of clothes online and return the ones that don't fit.
Signs for when we host a large gathering of people. Sometimes it's to label garbage vs recycling (for the large number of aluminum cans, mostly). Usually it's to warn people that one of the cats likes to try and sneak outside, and please watch out and don't let him outside.
Certain government paperwork. While many things can be filled and submitted online, other stuff (passport renewals come to mind) need to be printed and physically mailed. This tends to be very infrequent, but the forms contain personal information. How much do you trust a print shop?
These can usually be printed by the clerk when you drop off the package here if you show the barcode on your phone. Means you need to drop off at a manned location though.
Maybe I'm an exception, but I'm surprised other people aren't constantly finding things they need printed.
The last semi-regular thing I'd print were postage labels for when I sell stuff on eBay. But in the last few years it's changed, now I can just go to the post office with a QR code and it's all done.
$ convert -density 90 input.pdf -rotate 0.5 -attenuate 0.2 +noise Multiplicative -colorspace Gray output.pdf
1. Tax return to mail
2. Other government forms to mail
3. Contracts
Unfortunately, while the majority of the things I do in my life are purely digital, this fails as soon as you interact with the government in any meaningful way off the happy path or interact with the legal system, in those cases hard-copy only with original signatures is required to get anywhere.
For example, you probably want to keep updating the OS of your computer, if the computer is at all connected to the internet in any way. Which for most of us is the case because we want to browse the web etc.
One day, after an OS update for your computer, the vendor software for using the scanner portion of your multifunction printer stops working because it’s not compatible with the latest version of the computer OS. So you are forced to update that too. And then when you try to use the new version of that software, it refuses to work unless you let it update the firmware of your multifunction printer. So you allow it to do that. And now they successfully locked you out from using 3rd party printer cartridges with your multifunction printer.
If you are lucky / if you did research ahead of time before you bought the multifunction printer in the first place, maybe you bought one that doesn’t require any manually installed vendor provided software to work. And so at least you don’t have the exact situation above.
But even then you’d have to do a lot of digging to know what happens in the background.
If you are on macOS or Windows, does any of the parts of the OS that allows your multifunction printer to work without you manually installing anything extra do any kind of firmware updates for your printer automatically and silently in the background? I have no idea.
Hell, even with Linux there are binary blob things involved in a lot of distros that I couldn’t know if they would eventually end up updating firmware for my printer.
It seems to me that it is near impossible to truly be certain that any multifunction printer does not eventually somehow receive a firmware update even if you never manually install any vendor provided software related to the printer.
I do the same with my mobile phone. Only update when i know the need - aka, an app has a new feature that is worth the risk of an update. And only update that one app.
The security threats from external sources are less than the "real" threat - the very companies trying to sell you the update.
(With open source software, it's generally straightforward or at least possible to downgrade if something breaks… and I'm usually very confident that the software isn't being intentionally degraded on purpose.)
But folks like you and me are few and far between, and vendors and IT departments tend to be incredibly hostile to this approach.
This practice should be illegal.
> We are aware of the recent false claims suggesting that a Brother firmware update may have restricted the use of third-party ink cartridges. Please be assured that Brother firmware updates do not block the use of third-party ink in our machines.
... https://arstechnica.com/gadgets/2025/03/brother-denies-using...
If someone uses some $0.50 ink cartridge from wish that completely gunks the printer I'd probably say "you used bad ink, sorry" if I was the manufacturer. I mean in practice there's probably great ink that's half price and as good as the original. But in principle.
Have a laser myself, but my mom, who does print a lot of high quality images on proper photo paper, does not get the same results with laser.
For you everyday documents though I fully agree.
I forget what, but this isn't the first shady move from Brother. They seem to be well on in the enshittification phase of their business.
Same here.
I keep my HP LaserJet isolated from the Internet (both directions), as well as from LAN devices that haven't been allowlisted for it. Only devices that are limited to generic open source drivers can print to it, since you can't trust the battleship-sized HP "driver" packages not to update firmware.
My Brother color laser printer, I don't use very often, so I just carry the Debian laptop over to it, and plug in the USB cable, as needed.
This isn't perfect, and I can still think of sneaky ways to update the firmware of the small fraction of the installed bases that do isolation like this.
But it's the best reasonable compromise I can find right now, without spending hundreds of hours on what I suspect is the next step of protection. (Which would be "data diode"-like filtering that's aware of application layer protocols and file formats, and only passes validated-safe bytes to the printer. I suspect that an even harder approach would be trustworthy open source replacement printer firmware, unless someone finds and pursues a GPL legal attack, like the situation that birthed the wonderful OpenWrt.)
AFAIK, Brother seemed to have pretty universal word-of-mouth goodwill among techies until the last maybe couple years. But even if that goodwill had significant effect on the balance sheet (relative to the primary marketing methods), my layperson impression is that it'd be a rare CEO who didn't cash in goodwill (especially goodwill built up by a predecessor). And with US government being sabotaged right now, maybe regulators like the FTC will also not be barriers to brands doing whatever a CEO wants, even more than in recent decades.
My old brother ink printer (10-15years ago) had an internal counter which upon reaching some threshold value (20k pages or whatever), would stop printing and would show some error.
To fix it, you had to go into special secret "Maintenance/Service" mode by pressing the right combination of keys and then resetting this value.
Which means it had to be thrown out or sent to "repair/servicing" after N number of pages by design.
The number one thing to do when buying a printer is to check how hackable/refillable it is, and which printer has the most active hacking/refilling systems available from China and other countries that can't afford to buy overpriced originals, etc.
A while ago I bought a bw laser printer from a brand I've never heard of: "Pantum". Specifically the Pantum P2500W, for 49,95€ (~ 53$). I have never seen them in a store in (western/central) Europe either.
It does not have a display, in general it's the simplest, minimalist printer I've ever owned I'd argue.
CUPS configuration exist in the Arch AUR (for usage with USB), and driverless printing with AirPrint (which also works with CUPS) is supported. This new driverless stuff works really nice in general, glad to use this instead of unreliable driver printers (which sometimes are not even available in low quality for Linux).
It does not require an internet connection and appears to not have any DRM on the cartridges: I use a 20€ (~ 21$) no-name toner cartridge from Amazon, and it works perfectly fine. In fact it doesn't have a display to complain about this (like my 10+ year old HP, which even back then showed me ads for their own cartridges, and HP paper).
They bought Lexmark in 2016 (which is why some Pantum printers look like Lexmark printers).
The company has origins in manufacturing third-party replacement ICs for building compatible consumables and as such has extensive experience reverse engineering many printer designs. Many compatible printing consumables outlets carry Pantum brand printers, as they are essentially buying them through the same channels they buy their compatible consumables.
Pantum has a program for identifying genuine Pantum consumables as well, as any respectable printer manufacturer would ;-) It's a fun little sticker with some tricks up its sleeve: https://global.pantum.com/support/identification/
I have some questions: - what model did you buy for 50€ ? was it second hand? (i only see 150+€ pantum laser printers) - any links to buy the printer/cartridge ; i'm super interested!
> - what model did you buy for 50€ ? was it second hand?
> any estimate on how many regular text page can you print with your 20€ cartridge?
> any links to buy the printer/cartridge
Regarding the printer itself, I don't have a good recommendation. iBOOD (where I bought it) does not sell it anymore (iBOOD mostly sells a quantity-limited amount of surplus/overstock/special-purchase items, and it was in September 2023, so there for sure is no stock anymore). When looking at the price graph of a popular price aggregation site (https://geizhals.eu/pantum-p2500w-a1474488.html), I can see that the price started out at 55€ in July 2016, the lowest price a store was selling it for was 35€ in 2017 for a month. Then it was available for 50€ a couple of times for a few weeks - months per year, and otherwise out of stock; until it seems to now be sold at Amazon.de by a third-party seller from China (without going out of stock constantly) for reliable 90€-110€ (this very second for 109,90€).
But at least as of now, it doesn't seem like that's the case.
- Open firmware and interfaces to the hardware
- Make a profit on the sale of the printer hardware
- Open spec for any ink manufacturer to create cartridges
A printer that's actually profitable without any ink sales is going to cost hundreds of dollars more than any consumer would be willing to pay.
- Fixate on open firmware and force all third parties to open source their code (because yes, third party firmware vendors are necessary to develop a working printer system)
- Make a puny profit on durable hardware
- Miss out on the only true recurring revenue you can have