10 ms·

EFF to Texas AG: Epson Tricked Its Customers with a Dangerous Fake Update

178 points by DiabloD3 8y ago

dm319 8y ago
Disguising a malicious* update as a security update should remain the realm of scammers/crackers/outlaw and not large household companies. *I think malicious is the right word - it is done in the knowledge that it will result in higher costs and inconvenience for customers without consent.
- rocqua 8y ago
  Just spit balling their response: "These updates secure the user against using dangerous counterfeit cartridges that might damage the printer" If you really wanna push it, they might add something like "Moreover, these counterfeit cartridges could come with malicious hardware meant to infect the printer" Because sure, if you wanna get really inventive you probably could get some kind of hack going by getting hardware in the printer.
rdxm 8y ago
lol...I hope EFF doesn't expect our twice (or maybe three time, could be more, I've lost count) indicted jag-off AG to actually do anything that isn't related to self-enrichment....
mnm1 8y ago
If proven, these companies should be forced to pay a fee equal to the entire revenue from the printers affected and all their ink sales. I guarantee that if this was law, shit like this wouldn't happen. We really need regulation to punish companies that knowingly hurt consumers, especially when done in sneaky ways like this.
- coleca 8y ago
  Companies aren't magical beings. They are made up of people sitting in meetings in conference rooms, sending memos and writing TPS reports. Some one or ones made the decision to do this and those people should be punished individually via the criminal justice system. If a single individual had written a virus or piece of malware that did the same function and was caught, they would face criminal penalties. It should be no different if the act was performed under the umbrella of a corporation. When people can perform bad acts like this (see: VW) and not fear any personal consequences this behavior becomes common and acceptable.
  - jessaustin 8y ago
    ...those people should be punished individually via the criminal justice system. When does that happen to execs in USA? This suggests that it has been a long time: https://www.theguardian.com/commentisfree/2018/oct/05/americas-new-aristocracy-live-accountability-free-zone-david-sirota https://www.theguardian.com/commentisfree/2018/oct/05/americ...
    - thelasthuman 8y ago
      Yeah, the only people punished will be the lowly worker who was forced to do the job by the higher ups in the first place.
  - PhasmaFelis 8y ago
    Perhaps both. Punishing only the people deemed directly responsible makes it much too easy for corporations to scapegoat someone low on the totem pole, and it ensures that the culture that fosters bad behavior will never change--there's an endless supply of ambitious underlings to be sacrificed as necessary. If you hit them in the bottom line every time, they'll learn to police themselves. (Or perish. Either is fine.)
  - BoorishBears 8y ago
    It's always funny to see people wishing death to companies that they've probably invested parts of their 401ks in unknowingly, or had their insurance payouts come out investiture in. Our economy is less like a cabal of fat cats twirling mustaches and puffing cigars at the thought of how they can further disenfranchise the poor, and more like an ecosystem. It's not like CEOs will even suffer, they'll probably get a fat comp bonus to try and keep them from jumping ship in the middle of bankruptcy proceeding.
    - ceejayoz 8y ago
      > It's always funny to see people wishing death to companies that they've probably invested parts of their 401ks in unknowingly... It's always funny to see people thinking their personal profits should come first over preventing widespread harm.
londons_explore 8y ago
If Epson were smart, they would make it accept the currently installed, no matter if fake or real, and then reject the next cartridge installed. That way they wouldn't be caught.
- joncrane 8y ago
  This is devious.
- de_watcher 8y ago
  Don't give them ideas.
- comboy 8y ago
  Better yet, apply different printer settings (because you can't use "safe" setting designed for your own cartridge) that visibly worsen print quality. Some random line here and there. Ah, these 3rd party cartridges quality is just so bad.. But given how expensive these are anyway I'm surprised they don't use PK cryptography (micros are really cheap these days) to authenticate themselves to the printer. Extracting private key could quite difficult with appropriate chip used (still cheap). And the keys could be put in batches that correlate with the cartridge expiration date.
londons_explore 8y ago
Motorola just did that on the Moto E4 Plus phone. The August security update (only delivered last week) disabled NFC support unless you used a sim card from a specific network provider (who had presumably paid for exclusive NFC ability). 'Once installed, this update cannot be removed' say the release notes, with no details about lost functionality. My phone just lost a feature, and I'm not happy about it.
- metildaa 8y ago
  Have you considered taking Motorola to small claims court over this? Motorola has a history of turning off features in software months after selling a device, I remember when they bricked band 12 on certain devices at T-Mobile's behest. As my friends updated, their coverage went from usable to not working indoors, with no warning that an update was disabling part of their LTE radio. Very scummy business practice, it is not good to let Motorola continue to abuse customers like this with no consequences.
  - sp332 8y ago
    There's an app that might help you do that: https://news.ycombinator.com/item?id=18193349 https://news.ycombinator.com/item?id=18193349
- kevin_b_er 8y ago
  Motorola is a wholly owned entity. Rather, 联想集团有限公司, better known in the West as Lenovo Group Ltd., did that to you
grahamm 8y ago
The whole update world is messed up IMHO. My phone shows me multiple pending updates each day. What I notice is some apps updates are pushed out religiously every couple of days. I suspect most are legit but some I am not sure about, in fact I even think it's so my phone reminds me that I have app or game "X" installed. When I look at the reason for the update all it says is "Bug fixes" or "Information not provided by user". I feel it's more about reminding you that app is there than actually fixing issues and delivering new features.
- Waterluvian 8y ago
  Updates are too easy and it makes developers sloppy when they can just push changes so often. I think some consoles used to charge a lot of money to vet an update for a game. I wonder if that pushed devs to update less often and test/prepare more.
  - dagenix 8y ago
    Making it artificially harder to push out an update doesn't sound like much of a good idea, if that is what you are suggesting.
    - Waterluvian 8y ago
      No suggestions. Just a thought on cause and effect.
- tetrep 8y ago
  I don't think regular updates are abused to remind you because it's pretty trivial for the application to pester you with notifications itself. I think the updates are a combination of wanting to keep the app fresh and "normal" bug fixes/features that, especially since "nobody" cares about details, developers never bother writing details for. If you're on Android, you can disable update notifications from the app store settings.
  - JoshTriplett 8y ago
stevespang 8y ago
I smell a class action . . . .
kodablah 8y ago
Update aside, the letter also notes the practice of disallowing third party cartridges in general is nefarious. I wish that were the case, but I liken it to the printer equivalent of HDCP. Every day I see advertisements for the new, hip, consumer-friendly tech-gen versions of mattresses, toothbrushes, contact lenses, etc. Where is the company making consumer-friendly inkjet printers? Surely it can't be much more difficult than the 3D printers that were made in proverbial basements.
- sp332 8y ago
  Well... https://epson.com/ecotank-super-tank-printers https://epson.com/ecotank-super-tank-printers Epson sells printers that are explicitly marketed as "easy to refill".
  - kodablah 8y ago
    Looking to avoid the existing printer hegemony, regardless of what products they sell.
- snuxoll 8y ago
  > Where is the company making consumer-friendly inkjet printers? Brother, enough said. No bullshit preventing you from using refilled cartridges if you want, their hardware doesn't randomly die as much as competing brands, etc. Heck, even if you go with OEM cartridges they aren't too bad either.
  - toomuchtodo 8y ago
    100%. I have Brother laser printers that are over a decade old that still hum along without any troubles.
  - kodablah 8y ago
    I agree that Brother is probably the best of the bunch. My specific question didn't ask it the way I led up to it, but I was wondering if there was a potential disruptor of the old guard. But as another commenter mentioned, the space is likely not lucrative and has already raced as far to the bottom as it will (whether consumers will pay a bit more to encourage an upstart is unlikely).
bsenftner 8y ago
For this type of behavior, I abandoned printers entirely a few year ago. It took a bit to find businesses that never required paper for transactions, but now I am happy to never have to print or scan anything. To turn away from an entire industry kinda feels good. Everyone should treat dark business practices this way. Drive them into bankruptcy or ethical behavior.
guy98238710 8y ago
How I wish we could buy opensource printers and other devices. There is a so-so opensource home router and a few stabs at opensource phones/tablets, but not much more.
csense 8y ago
This isn't a new thing. I remember Nintendo's made Wii updates that intentionally brick modified consoles.

178 points by DiabloD3 8y ago

Disguising a malicious* update as a security update should remain the realm of scammers/crackers/outlaw and not large household companies. *I think malicious is the right word - it is done in the knowledge that it will result in higher costs and inconvenience for customers without consent.

rocqua 8y ago
Just spit balling their response: "These updates secure the user against using dangerous counterfeit cartridges that might damage the printer" If you really wanna push it, they might add something like "Moreover, these counterfeit cartridges could come with malicious hardware meant to infect the printer" Because sure, if you wanna get really inventive you probably could get some kind of hack going by getting hardware in the printer.

rdxm 8y ago

lol...I hope EFF doesn't expect our twice (or maybe three time, could be more, I've lost count) indicted jag-off AG to actually do anything that isn't related to self-enrichment....

mnm1 8y ago

If proven, these companies should be forced to pay a fee equal to the entire revenue from the printers affected and all their ink sales. I guarantee that if this was law, shit like this wouldn't happen. We really need regulation to punish companies that knowingly hurt consumers, especially when done in sneaky ways like this.

coleca 8y ago
Companies aren't magical beings. They are made up of people sitting in meetings in conference rooms, sending memos and writing TPS reports. Some one or ones made the decision to do this and those people should be punished individually via the criminal justice system. If a single individual had written a virus or piece of malware that did the same function and was caught, they would face criminal penalties. It should be no different if the act was performed under the umbrella of a corporation. When people can perform bad acts like this (see: VW) and not fear any personal consequences this behavior becomes common and acceptable.
- jessaustin 8y ago
  ...those people should be punished individually via the criminal justice system. When does that happen to execs in USA? This suggests that it has been a long time: https://www.theguardian.com/commentisfree/2018/oct/05/americas-new-aristocracy-live-accountability-free-zone-david-sirota https://www.theguardian.com/commentisfree/2018/oct/05/americ...
  - thelasthuman 8y ago
    Yeah, the only people punished will be the lowly worker who was forced to do the job by the higher ups in the first place.
- PhasmaFelis 8y ago
  Perhaps both. Punishing only the people deemed directly responsible makes it much too easy for corporations to scapegoat someone low on the totem pole, and it ensures that the culture that fosters bad behavior will never change--there's an endless supply of ambitious underlings to be sacrificed as necessary. If you hit them in the bottom line every time, they'll learn to police themselves. (Or perish. Either is fine.)
- BoorishBears 8y ago
  It's always funny to see people wishing death to companies that they've probably invested parts of their 401ks in unknowingly, or had their insurance payouts come out investiture in. Our economy is less like a cabal of fat cats twirling mustaches and puffing cigars at the thought of how they can further disenfranchise the poor, and more like an ecosystem. It's not like CEOs will even suffer, they'll probably get a fat comp bonus to try and keep them from jumping ship in the middle of bankruptcy proceeding.
  - ceejayoz 8y ago
    > It's always funny to see people wishing death to companies that they've probably invested parts of their 401ks in unknowingly... It's always funny to see people thinking their personal profits should come first over preventing widespread harm.

londons_explore 8y ago

If Epson were smart, they would make it accept the currently installed, no matter if fake or real, and then reject the next cartridge installed. That way they wouldn't be caught.

joncrane 8y ago
This is devious.
de_watcher 8y ago
Don't give them ideas.
comboy 8y ago
Better yet, apply different printer settings (because you can't use "safe" setting designed for your own cartridge) that visibly worsen print quality. Some random line here and there. Ah, these 3rd party cartridges quality is just so bad.. But given how expensive these are anyway I'm surprised they don't use PK cryptography (micros are really cheap these days) to authenticate themselves to the printer. Extracting private key could quite difficult with appropriate chip used (still cheap). And the keys could be put in batches that correlate with the cartridge expiration date.

londons_explore 8y ago

Motorola just did that on the Moto E4 Plus phone. The August security update (only delivered last week) disabled NFC support unless you used a sim card from a specific network provider (who had presumably paid for exclusive NFC ability). 'Once installed, this update cannot be removed' say the release notes, with no details about lost functionality. My phone just lost a feature, and I'm not happy about it.

metildaa 8y ago
Have you considered taking Motorola to small claims court over this? Motorola has a history of turning off features in software months after selling a device, I remember when they bricked band 12 on certain devices at T-Mobile's behest. As my friends updated, their coverage went from usable to not working indoors, with no warning that an update was disabling part of their LTE radio. Very scummy business practice, it is not good to let Motorola continue to abuse customers like this with no consequences.
- sp332 8y ago
  There's an app that might help you do that: https://news.ycombinator.com/item?id=18193349 https://news.ycombinator.com/item?id=18193349
kevin_b_er 8y ago
Motorola is a wholly owned entity. Rather, 联想集团有限公司, better known in the West as Lenovo Group Ltd., did that to you

grahamm 8y ago

The whole update world is messed up IMHO. My phone shows me multiple pending updates each day. What I notice is some apps updates are pushed out religiously every couple of days. I suspect most are legit but some I am not sure about, in fact I even think it's so my phone reminds me that I have app or game "X" installed. When I look at the reason for the update all it says is "Bug fixes" or "Information not provided by user". I feel it's more about reminding you that app is there than actually fixing issues and delivering new features.

Waterluvian 8y ago
Updates are too easy and it makes developers sloppy when they can just push changes so often. I think some consoles used to charge a lot of money to vet an update for a game. I wonder if that pushed devs to update less often and test/prepare more.
- dagenix 8y ago
  Making it artificially harder to push out an update doesn't sound like much of a good idea, if that is what you are suggesting.
  - Waterluvian 8y ago
    No suggestions. Just a thought on cause and effect.
tetrep 8y ago
I don't think regular updates are abused to remind you because it's pretty trivial for the application to pester you with notifications itself. I think the updates are a combination of wanting to keep the app fresh and "normal" bug fixes/features that, especially since "nobody" cares about details, developers never bother writing details for. If you're on Android, you can disable update notifications from the app store settings.
- JoshTriplett 8y ago

stevespang 8y ago

I smell a class action . . . .

kodablah 8y ago

Update aside, the letter also notes the practice of disallowing third party cartridges in general is nefarious. I wish that were the case, but I liken it to the printer equivalent of HDCP. Every day I see advertisements for the new, hip, consumer-friendly tech-gen versions of mattresses, toothbrushes, contact lenses, etc. Where is the company making consumer-friendly inkjet printers? Surely it can't be much more difficult than the 3D printers that were made in proverbial basements.

sp332 8y ago
Well... https://epson.com/ecotank-super-tank-printers https://epson.com/ecotank-super-tank-printers Epson sells printers that are explicitly marketed as "easy to refill".
- kodablah 8y ago
  Looking to avoid the existing printer hegemony, regardless of what products they sell.
snuxoll 8y ago
> Where is the company making consumer-friendly inkjet printers? Brother, enough said. No bullshit preventing you from using refilled cartridges if you want, their hardware doesn't randomly die as much as competing brands, etc. Heck, even if you go with OEM cartridges they aren't too bad either.
- toomuchtodo 8y ago
  100%. I have Brother laser printers that are over a decade old that still hum along without any troubles.
- kodablah 8y ago
  I agree that Brother is probably the best of the bunch. My specific question didn't ask it the way I led up to it, but I was wondering if there was a potential disruptor of the old guard. But as another commenter mentioned, the space is likely not lucrative and has already raced as far to the bottom as it will (whether consumers will pay a bit more to encourage an upstart is unlikely).

bsenftner 8y ago

For this type of behavior, I abandoned printers entirely a few year ago. It took a bit to find businesses that never required paper for transactions, but now I am happy to never have to print or scan anything. To turn away from an entire industry kinda feels good. Everyone should treat dark business practices this way. Drive them into bankruptcy or ethical behavior.

guy98238710 8y ago

How I wish we could buy opensource printers and other devices. There is a so-so opensource home router and a few stabs at opensource phones/tablets, but not much more.

csense 8y ago

This isn't a new thing. I remember Nintendo's made Wii updates that intentionally brick modified consoles.