7 ms·

I'm a brother shill but a while back they experimented with a consumer-hostile firmware update for one of their models. Since then, I've been edge blocking the

I'm a brother shill but a while back they experimented with a consumer-hostile firmware update for one of their models. Since then, I've been edge blocking the rdns of update.brother.co.jp. It usually resolves to 4 IPv4 addys. Depending on the DNS resolver, they should lie in one of these subnets. 3.164.143.0/24 # per asia dns 13.249.98.0/24 # per us dns 18.154.219.0/24 # can't recall 18.155.68.0/24 # per alibaba dns 18.160.225.0/24 # per he.net edit: It looks like Brother is using cloudfront to provide CDN services. Every region I try I get a diff subnet. Better to query yourself than rely on my IPs.

viraptor 2y ago
These are Amazon ranges. You're most likely blocking random aws load balancers including more than just brother servers. Also the brother servers can be redeployed at any point. It's likely better to prevent the dns name resolution instead.
- hyperman1 2y ago
  I'd suggest switching from a blacklist to a whitelist mindset. In this case, allow the printer only access to the local network.
  - account42 2y ago
    I'd be even more paranoid and connect the printer via USB only. You can then run your own print server if you want to support printing from multiple devices.
- codedokode 2y ago
  The printer might be using encrypted DNS.
  - viraptor 2y ago
    Very unlikely. At least not without a fallback. Lots of corps will not allow encrypted dns because they want good traffic monitoring for threat detection. It may be an option, but it almost certainly won't be enforced.
    - HPsquared 2y ago
      Maybe the "Enterprise-grade" printer that costs twice as much and doesn't do the annoying things. Like how Enterprise versions of Windows let you disable certain stuff.
    - account42 2y ago
      A plain UDP fallback won't help you if the printer can get to it servers without needing it in your home network. DNS-level filtering is pointless for devices you don't control.
      - viraptor 2y ago
        For malicious devices, sure. But a printer will do the basics and just use dns. There's no upside more important than a risk of whole bunch of devices just not being able to work. There's really no clever and sneaky functionality there.
beached_whale 2y ago
why does my brother printer need to be online? I dont add it to the allow list at all.
jchw 2y ago
Barring a particularly good reason, I reckon your best bet is to just block internet access from the printer altogether. I can't think of a good reason why it should have internet access.
- gregncheese 2y ago
  Scanning directly to a share folder? Scanning and sending to an email address.
  - jchw 2y ago
    You could come up with a list of features that are plausible but I can't imagine a world where having my scanner send an email would be more convenient than just having a scanned document directly on a computer or phone. Brother printers can scan to network shares without Internet access. Local networking is plenty.
    - rafaelmn 2y ago
      > but I can't imagine a world where having my scanner send an email would be more convenient than just having a scanned document directly on a computer or phone. I have a home office laser combo - it has a touch display on it and is bulky next to - when I need to scan in receipts I just upload it to a share folder where my accountant can pick it up.
      - averageRoyalty 2y ago
        Given the capabilites of the average HN user, it would be trivial to send to a local share that is monitored and auto uploads, effectively firewalling the printer off. I do this with my "smart TV", it only has access to my web proxy and a DNS sever I control, whitelist only.
      - account42 2y ago
        Just scanning on your computer/phone and emailing the result would not be any more effort.
ohgr 2y ago
I never let my printer near the Internet. It goes on the "fucking trash" subnet which has no route out. Mine's an HP but it complains occasionally that it can't get new firmware which makes me feel warm inside.
- aqueueaqueue 2y ago
  Eventually we get to the point we let nothing near the internet!
  - lukan 2y ago
    Good luck with soldered on LTE modems.
    - notpushkin 2y ago
      Cool, a printer and a free unlimited SIM card!
      - hhjj 2y ago
        Until they use eSIM, and then we will have to tinfoil all of our electronics.
        hkt 2y ago
        Or, cheaper electronics emerge that don't include any independent rogue networking capability!
        FredPret 2y ago
        Hardware that is not subsidized by spying on the consumer will be more expensive
        account42 2y ago
        All evidence points to the spying profits to not be returned to the user via lower prices.
tankenmate 2y ago
another option you could use is something like routedns[0], this allows you to filter DNS requests (or get them to resolve to 127.0.0.1) and it won't affect other services that might be on the same IP. [0] https://github.com/folbricht/routedns https://github.com/folbricht/routedns
FabHK 2y ago
Thanks, good idea. I went to my home router (a Fritzbox) and just blocked the printer from accessing the internet (it's under Internet -> Filter, and the printer is named BRW90....). Fairly straightforward - that should be a good enough fix, no?
- account42 2y ago
  It's probably enough a truly malicous printer could change the MAC address and device name to get around any such blacklist. Even a MAC-based whitelist is vulnerable to spoofing. To be truly safe you'd need to put the printer on its own lan without an internet connection or not connect it via ethernet/wifi at all.
account42 2y ago
Why give the printer internet access at all?
jerome-jh 2y ago
I have a Brother inkjet/all-in-one. Of course it never connected to the internet, thanks to a router firewall rule. Actually I only use Brother cartridges for black. They are quite economical and I bought a bunch of them at some point when they were cheap on Amazon. Now the color cartridges keep draining although we never print in color. So of course I do not fit Brother color cartridges! For that reason and others (very average quality when printing from Linux, takes only high quality 90g paper, heads regularly clogged even with Brother ink, color prints ugly even with Brother ink), I am not satisfied with this product. Unfortunately I still have a few years of black ink to consume before getting rid of it.
davidjytang 2y ago
> they experimented with a consumer-hostile firmware update for one of their models. Which model?
- WarOnPrivacy 2y ago
  It looks like the MFC-3750. ref: https://old.reddit.com/r/printers/comments/s9b2eg/brother_mfc_firmware_update_nongenuine_toner_now/ https://old.reddit.com/r/printers/comments/s9b2eg/brother_mf... My memory is that it was a trial for 2 or 3 similar models. There was backlash and they never pursued it further. I saw some mentions that indicated the current uproar is old issue being revisited.
ThePowerOfFuet 2y ago
Why not just block it at the DNS level?

viraptor 2y ago

These are Amazon ranges. You're most likely blocking random aws load balancers including more than just brother servers. Also the brother servers can be redeployed at any point. It's likely better to prevent the dns name resolution instead.

hyperman1 2y ago
I'd suggest switching from a blacklist to a whitelist mindset. In this case, allow the printer only access to the local network.
- account42 2y ago
  I'd be even more paranoid and connect the printer via USB only. You can then run your own print server if you want to support printing from multiple devices.
codedokode 2y ago
The printer might be using encrypted DNS.
- viraptor 2y ago
  Very unlikely. At least not without a fallback. Lots of corps will not allow encrypted dns because they want good traffic monitoring for threat detection. It may be an option, but it almost certainly won't be enforced.
  - HPsquared 2y ago
    Maybe the "Enterprise-grade" printer that costs twice as much and doesn't do the annoying things. Like how Enterprise versions of Windows let you disable certain stuff.
  - account42 2y ago
    A plain UDP fallback won't help you if the printer can get to it servers without needing it in your home network. DNS-level filtering is pointless for devices you don't control.
    - viraptor 2y ago
      For malicious devices, sure. But a printer will do the basics and just use dns. There's no upside more important than a risk of whole bunch of devices just not being able to work. There's really no clever and sneaky functionality there.

beached_whale 2y ago

why does my brother printer need to be online? I dont add it to the allow list at all.

jchw 2y ago

Barring a particularly good reason, I reckon your best bet is to just block internet access from the printer altogether. I can't think of a good reason why it should have internet access.

gregncheese 2y ago
Scanning directly to a share folder? Scanning and sending to an email address.
- jchw 2y ago
  You could come up with a list of features that are plausible but I can't imagine a world where having my scanner send an email would be more convenient than just having a scanned document directly on a computer or phone. Brother printers can scan to network shares without Internet access. Local networking is plenty.
  - rafaelmn 2y ago
    > but I can't imagine a world where having my scanner send an email would be more convenient than just having a scanned document directly on a computer or phone. I have a home office laser combo - it has a touch display on it and is bulky next to - when I need to scan in receipts I just upload it to a share folder where my accountant can pick it up.
    - averageRoyalty 2y ago
      Given the capabilites of the average HN user, it would be trivial to send to a local share that is monitored and auto uploads, effectively firewalling the printer off. I do this with my "smart TV", it only has access to my web proxy and a DNS sever I control, whitelist only.
    - account42 2y ago
      Just scanning on your computer/phone and emailing the result would not be any more effort.

ohgr 2y ago

I never let my printer near the Internet. It goes on the "fucking trash" subnet which has no route out. Mine's an HP but it complains occasionally that it can't get new firmware which makes me feel warm inside.

aqueueaqueue 2y ago
Eventually we get to the point we let nothing near the internet!
- lukan 2y ago
  Good luck with soldered on LTE modems.
  - notpushkin 2y ago
    Cool, a printer and a free unlimited SIM card!
    - hhjj 2y ago
      Until they use eSIM, and then we will have to tinfoil all of our electronics.
      - hkt 2y ago
        Or, cheaper electronics emerge that don't include any independent rogue networking capability!
        FredPret 2y ago
        Hardware that is not subsidized by spying on the consumer will be more expensive
        account42 2y ago
        All evidence points to the spying profits to not be returned to the user via lower prices.

tankenmate 2y ago

another option you could use is something like routedns[0], this allows you to filter DNS requests (or get them to resolve to 127.0.0.1) and it won't affect other services that might be on the same IP. [0] https://github.com/folbricht/routedns https://github.com/folbricht/routedns

FabHK 2y ago

Thanks, good idea. I went to my home router (a Fritzbox) and just blocked the printer from accessing the internet (it's under Internet -> Filter, and the printer is named BRW90....). Fairly straightforward - that should be a good enough fix, no?

account42 2y ago
It's probably enough a truly malicous printer could change the MAC address and device name to get around any such blacklist. Even a MAC-based whitelist is vulnerable to spoofing. To be truly safe you'd need to put the printer on its own lan without an internet connection or not connect it via ethernet/wifi at all.

account42 2y ago

Why give the printer internet access at all?

jerome-jh 2y ago

I have a Brother inkjet/all-in-one. Of course it never connected to the internet, thanks to a router firewall rule. Actually I only use Brother cartridges for black. They are quite economical and I bought a bunch of them at some point when they were cheap on Amazon. Now the color cartridges keep draining although we never print in color. So of course I do not fit Brother color cartridges! For that reason and others (very average quality when printing from Linux, takes only high quality 90g paper, heads regularly clogged even with Brother ink, color prints ugly even with Brother ink), I am not satisfied with this product. Unfortunately I still have a few years of black ink to consume before getting rid of it.

davidjytang 2y ago

> they experimented with a consumer-hostile firmware update for one of their models. Which model?

WarOnPrivacy 2y ago
It looks like the MFC-3750. ref: https://old.reddit.com/r/printers/comments/s9b2eg/brother_mfc_firmware_update_nongenuine_toner_now/ https://old.reddit.com/r/printers/comments/s9b2eg/brother_mf... My memory is that it was a trial for 2 or 3 similar models. There was backlash and they never pursued it further. I saw some mentions that indicated the current uproar is old issue being revisited.

ThePowerOfFuet 2y ago

Why not just block it at the DNS level?