9 ms·

HP Ink Printers Remote Code Execution

71 points by Yhippa 8y ago

NullPrefix 8y ago
Tried reading the information, but can't understand if RCE is on the printer fimrware or the PC host. Anyone know?
- tonysdg 8y ago
  Firmware. From Resolution section: > HP has provided firmware updates for impacted printers as set forth in the table below.
- cptskippy 8y ago
  There isn't any information, the CVEs aren't yet public. > HP has provided firmware updates for impacted printers as set forth in the table below.
crazy_monkey 8y ago
Ah yes, printers... The original Internet of Sh*t!
phelmig 8y ago
This reminds me of this [1] talk at 28c3 (Ang Cui on how to exploit HP printers by sending a modified PDF to them). Which lead to one of the most hilarious IT-Sec headlines [2] [1] https://www.youtube.com/watch?v=njVv7J2azY8 https://www.youtube.com/watch?v=njVv7J2azY8 [2] http://gawker.com/5863388/hackers-could-turn-your-printer-into-a-flaming-death-bomb http://gawker.com/5863388/hackers-could-turn-your-printer-in...
- larkeith 8y ago
  Luckily, there's an error code for that: https://en.wikipedia.org/wiki/Lp0_on_fire https://en.wikipedia.org/wiki/Lp0_on_fire
lmns 8y ago
For whatever reason my printer (8610) provides an automatic update via the webinterface, but it can't find any update. Also the HP firmware updater for macOS isn't signed. Oh well.
- rogueresearch 8y ago
  Where do you find a firmware updater for macOS? Only instructions I see require connecting the printer to the public internet, which I'd rather not do.
ipython 8y ago
Is there an open source method to upgrade the firmware? The HP website lists two methods: first using their “eprint” web service where you have to accept some BS terms of service (no thanks) or opaque binary blobs for Windows or Mac.
- JTbane 8y ago
  Random fact: Richard Stallman may have been spurred to start the GNU Project due to the fact that he could not easily modify the source code of a printer.
  - yjftsjthsd-h 8y ago
    Which makes it ironic that there are still no open source printers. There are even open source 3D printers, but putting ink on paper is still annoyingly out of reach.
    - swiley 8y ago
      Just 3D print movable type and call it a day.
      - yjftsjthsd-h 8y ago
        I did once consider just 3D printing a single very thin layer :-) More practically, a 3D printer is probably only a half step removed from a decent plotter if you just replace the head with a pen or something.
jaclaz 8y ago
There is IMHO some form of "disconnection" between using "certain": >Two security vulnerabilities have been identified with certain HP Inkjet printers. and then list more than 200 (two hundred) printer models.
- readyp1 8y ago
  Maybe so, but "certain", from a grammatical standpoint, implies that they know exactly which models are affected, which in turn implies that it is not the entirety of their printers that are affected. Maybe that's not the case, and every single printer they make is affected, but that's just my thought on it ¯\_(ツ)_/¯
  - jaclaz 8y ago
    I don't know, by reading "certain HP Inkjet printers" I imagined that it would imply a small number of "known" affected models (all belonging to the Inkjet family, of course). It seems to me that the given list could be better summed up with something like: "All HP Inkjet printers manufactured in the last n years, with the exception of models A, B and C"."
  - NullPrefix 8y ago
    >entirety of their printers that are affected Some were too old for this vulnerability?
- psetq 8y ago
  To be fair, that list doesn't seem to include any of their LaserJet range, which I've always thought was their "business class" printers...
  - theevilsharpie 8y ago
    Laserjets wouldn't be in the set of "certain HP Inkjet printers" because they are Laserjets, not Inkjets. :P
floatboth 8y ago
Is anyone going to develop custom firmware / jailbreak for the vulnerable printers?
jdlyga 8y ago
Best printer decision I've ever made was to buy a Brother laser printer. It's like going from a flip phone to a smart phone. I rarely print anything, but when I do it's reliable, fast, and very easy to use. I buy toner maybe once every few years.
- mikestew 8y ago
  I think it's like going from a smart phone to a flip phone (reverse of what you said). I don't need your big-ass driver package, your HP ColarSmartz Fotoz app, your constant pop ups about ink being low, yes, again. I want to not think about you. Whereas with our Brother laser printer, I couldn't tell you the last time I bought toner, or gave that printer much thought at all other than grabbing a sheet off the print tray.
  - scarface74 8y ago
    Why are printer drivers still a thing in 2018 in the Windows world? I make sure the printer supports AirPrint and "it just works" with Macs, and my IOS devices -- including my ancient circa 2010 iPad that hasn't seen an update in 7 years (yeah I got a newer iPad also).
    - krylon 8y ago
      My job currently is mostly programming, but until about a year ago, it was mostly sysadmin and helpdesk monkey for a small-ish company (~75 users). In this time I have had enough inexplicable printer-related problems, that my views on printing are no longer fit for a public forum. If I could, I would go Office Space on each and every one of those hellish machines. But I need to remember, it's not the printer's fault, it's Windows - on GNU/Linux, printing has Just Worked(tm) for me for the last ... about ten years. Once upon a time I was reduced to converting my print jobs to the printer's native language with Ghostscript and then cat(1) the resulting files (one per page) to the printer's device file. But then came CUPS, and while some people still complain that GNU/Linux is not suitable for desktop use, when it comes to printing the experience is lightyears ahead of Windows.
baybal2 8y ago
I think it has something to do with their recently announced bounty.
Qerub 8y ago
HP's "The Wolf" commercials (feat. Mr. Robot^WChristian Slater) totes up their printers as "the world's most secure printing": https://www.youtube.com/watch?v=DkajtSOAyec https://www.youtube.com/watch?v=DkajtSOAyec :)
danesparza 8y ago
Hmmm ... I'm curious why this article is getting any traction on HN. Is it the novelty of remote code execution on a printer? This isn't news: Defcon presentation from Defcon 19 (I swear I remember something earlier than this, but this is just from a quick search) https://www.defcon.org/images/defcon-19/dc-19-presentations/Heiland/DEFCON-19-Heiland-Printer-To-Pwnd.pdf https://www.defcon.org/images/defcon-19/dc-19-presentations/... Also: https://github.com/RUB-NDS/PRET https://github.com/RUB-NDS/PRET
- Sohcahtoa82 8y ago
  Because this is a new vulnerability. Does PRET even still work? I'd be surprised if the vulnerabilities that allow PRET to work haven't been patched.
krylon 8y ago
Fortunately, my trusty old LaserJet 1010 does not have a network interface. But I suspect that outside of organizations dealing with classified data, printer security is fairly terrible, anyway.
- londons_explore 8y ago
  Too many organisations put printers on their internal networks. Printers should be on a seperate subnet, firewalled off to oncy accept incoming connections (and maybe outbound to specific radius and SMTP servers), and not given internet access.
  - reaperducer 8y ago
    Then they can’t automatically order supplies. The printer I work with these days will phone for supplies that tend to arrive the day before the toner runs out. Although I imagine the network connection could be replaced with a phone line, but there’s only one landline in this company of 500+ people and I’m using it for something else.
    - krylon 8y ago
      At work, we have an Agent running on one of our servers that queries the printers via SNMP (Well, I think it uses SNMP) and then sends the results to the mothership. When toner runs low, new toner arrives. But yeah, we keep our printers on the same network segment as the clients. Maybe we should change that. Then again, I have enough on my plate as it is.
- reaperducer 8y ago
  But I suspect that outside of organizations dealing with classified data, printer security is fairly terrible, anyway. You’d be surprised. One org I worked for had a Kyocera all kitted our for HIPAA compliance. I looked through the manual for it once and it glossed over a number of very interesting data handling techniques. The only one I remember off the top of my head is that after a print job, the internal hard drive would scrub itself and repeatedly write garbage data over the location of the previous print job. To the user it was seamless, except for the occasional tiny “Purging hard drive data” notice at the bottom of the printer’s screen.
londons_explore 8y ago
I wonder if anyone actually writes to them to ask for a pgp signed version of the security bulletin...

71 points by Yhippa 8y ago

NullPrefix 8y ago

Tried reading the information, but can't understand if RCE is on the printer fimrware or the PC host. Anyone know?

tonysdg 8y ago
Firmware. From Resolution section: > HP has provided firmware updates for impacted printers as set forth in the table below.
cptskippy 8y ago
There isn't any information, the CVEs aren't yet public. > HP has provided firmware updates for impacted printers as set forth in the table below.

crazy_monkey 8y ago

Ah yes, printers... The original Internet of Sh*t!

phelmig 8y ago

This reminds me of this [1] talk at 28c3 (Ang Cui on how to exploit HP printers by sending a modified PDF to them). Which lead to one of the most hilarious IT-Sec headlines [2] [1] https://www.youtube.com/watch?v=njVv7J2azY8 https://www.youtube.com/watch?v=njVv7J2azY8 [2] http://gawker.com/5863388/hackers-could-turn-your-printer-into-a-flaming-death-bomb http://gawker.com/5863388/hackers-could-turn-your-printer-in...

larkeith 8y ago
Luckily, there's an error code for that: https://en.wikipedia.org/wiki/Lp0_on_fire https://en.wikipedia.org/wiki/Lp0_on_fire

lmns 8y ago

For whatever reason my printer (8610) provides an automatic update via the webinterface, but it can't find any update. Also the HP firmware updater for macOS isn't signed. Oh well.

rogueresearch 8y ago
Where do you find a firmware updater for macOS? Only instructions I see require connecting the printer to the public internet, which I'd rather not do.

ipython 8y ago

Is there an open source method to upgrade the firmware? The HP website lists two methods: first using their “eprint” web service where you have to accept some BS terms of service (no thanks) or opaque binary blobs for Windows or Mac.

JTbane 8y ago
Random fact: Richard Stallman may have been spurred to start the GNU Project due to the fact that he could not easily modify the source code of a printer.
- yjftsjthsd-h 8y ago
  Which makes it ironic that there are still no open source printers. There are even open source 3D printers, but putting ink on paper is still annoyingly out of reach.
  - swiley 8y ago
    Just 3D print movable type and call it a day.
    - yjftsjthsd-h 8y ago
      I did once consider just 3D printing a single very thin layer :-) More practically, a 3D printer is probably only a half step removed from a decent plotter if you just replace the head with a pen or something.

jaclaz 8y ago

There is IMHO some form of "disconnection" between using "certain": >Two security vulnerabilities have been identified with certain HP Inkjet printers. and then list more than 200 (two hundred) printer models.

readyp1 8y ago
Maybe so, but "certain", from a grammatical standpoint, implies that they know exactly which models are affected, which in turn implies that it is not the entirety of their printers that are affected. Maybe that's not the case, and every single printer they make is affected, but that's just my thought on it ¯\_(ツ)_/¯
- jaclaz 8y ago
  I don't know, by reading "certain HP Inkjet printers" I imagined that it would imply a small number of "known" affected models (all belonging to the Inkjet family, of course). It seems to me that the given list could be better summed up with something like: "All HP Inkjet printers manufactured in the last n years, with the exception of models A, B and C"."
- NullPrefix 8y ago
  >entirety of their printers that are affected Some were too old for this vulnerability?
psetq 8y ago
To be fair, that list doesn't seem to include any of their LaserJet range, which I've always thought was their "business class" printers...
- theevilsharpie 8y ago
  Laserjets wouldn't be in the set of "certain HP Inkjet printers" because they are Laserjets, not Inkjets. :P

floatboth 8y ago

Is anyone going to develop custom firmware / jailbreak for the vulnerable printers?

jdlyga 8y ago

Best printer decision I've ever made was to buy a Brother laser printer. It's like going from a flip phone to a smart phone. I rarely print anything, but when I do it's reliable, fast, and very easy to use. I buy toner maybe once every few years.

mikestew 8y ago
I think it's like going from a smart phone to a flip phone (reverse of what you said). I don't need your big-ass driver package, your HP ColarSmartz Fotoz app, your constant pop ups about ink being low, yes, again. I want to not think about you. Whereas with our Brother laser printer, I couldn't tell you the last time I bought toner, or gave that printer much thought at all other than grabbing a sheet off the print tray.
- scarface74 8y ago
  Why are printer drivers still a thing in 2018 in the Windows world? I make sure the printer supports AirPrint and "it just works" with Macs, and my IOS devices -- including my ancient circa 2010 iPad that hasn't seen an update in 7 years (yeah I got a newer iPad also).
  - krylon 8y ago
    My job currently is mostly programming, but until about a year ago, it was mostly sysadmin and helpdesk monkey for a small-ish company (~75 users). In this time I have had enough inexplicable printer-related problems, that my views on printing are no longer fit for a public forum. If I could, I would go Office Space on each and every one of those hellish machines. But I need to remember, it's not the printer's fault, it's Windows - on GNU/Linux, printing has Just Worked(tm) for me for the last ... about ten years. Once upon a time I was reduced to converting my print jobs to the printer's native language with Ghostscript and then cat(1) the resulting files (one per page) to the printer's device file. But then came CUPS, and while some people still complain that GNU/Linux is not suitable for desktop use, when it comes to printing the experience is lightyears ahead of Windows.

baybal2 8y ago

I think it has something to do with their recently announced bounty.

Qerub 8y ago

HP's "The Wolf" commercials (feat. Mr. Robot^WChristian Slater) totes up their printers as "the world's most secure printing": https://www.youtube.com/watch?v=DkajtSOAyec https://www.youtube.com/watch?v=DkajtSOAyec :)

danesparza 8y ago

Hmmm ... I'm curious why this article is getting any traction on HN. Is it the novelty of remote code execution on a printer? This isn't news: Defcon presentation from Defcon 19 (I swear I remember something earlier than this, but this is just from a quick search) https://www.defcon.org/images/defcon-19/dc-19-presentations/Heiland/DEFCON-19-Heiland-Printer-To-Pwnd.pdf https://www.defcon.org/images/defcon-19/dc-19-presentations/... Also: https://github.com/RUB-NDS/PRET https://github.com/RUB-NDS/PRET

Sohcahtoa82 8y ago
Because this is a new vulnerability. Does PRET even still work? I'd be surprised if the vulnerabilities that allow PRET to work haven't been patched.

krylon 8y ago

Fortunately, my trusty old LaserJet 1010 does not have a network interface. But I suspect that outside of organizations dealing with classified data, printer security is fairly terrible, anyway.

londons_explore 8y ago
Too many organisations put printers on their internal networks. Printers should be on a seperate subnet, firewalled off to oncy accept incoming connections (and maybe outbound to specific radius and SMTP servers), and not given internet access.
- reaperducer 8y ago
  Then they can’t automatically order supplies. The printer I work with these days will phone for supplies that tend to arrive the day before the toner runs out. Although I imagine the network connection could be replaced with a phone line, but there’s only one landline in this company of 500+ people and I’m using it for something else.
  - krylon 8y ago
    At work, we have an Agent running on one of our servers that queries the printers via SNMP (Well, I think it uses SNMP) and then sends the results to the mothership. When toner runs low, new toner arrives. But yeah, we keep our printers on the same network segment as the clients. Maybe we should change that. Then again, I have enough on my plate as it is.
reaperducer 8y ago
But I suspect that outside of organizations dealing with classified data, printer security is fairly terrible, anyway. You’d be surprised. One org I worked for had a Kyocera all kitted our for HIPAA compliance. I looked through the manual for it once and it glossed over a number of very interesting data handling techniques. The only one I remember off the top of my head is that after a print job, the internal hard drive would scrub itself and repeatedly write garbage data over the location of the previous print job. To the user it was seamless, except for the occasional tiny “Purging hard drive data” notice at the bottom of the printer’s screen.

londons_explore 8y ago

I wonder if anyone actually writes to them to ask for a pgp signed version of the security bulletin...