4 ms·

Still have to be careful, they have another method where an update is delivered as a print job (that doesn't print anything). So also don't let any windows or m

Still have to be careful, they have another method where an update is delivered as a print job (that doesn't print anything). So also don't let any windows or mac (or android or ios or chromebook I guess) clients reach the printer by any means, even usb, with drivers you aren't 100% sure about.

account42 2y ago
Android and iOS don't support printer drivers so should be safe, no?
- Brian_K_White 2y ago
  idk about ios but I sure can print from android. I don't know if I'd be surprised or not to find out that you actually can't print from ios. It seems crazy to me, especially considering ipads, but the entire Apple ecosystem seems crazy to me and yet it exists despite my incredulity. I could even print from webos and palm but I guess that doesn't matter now. 50/50 toss up if the current webos on lg tvs still has any printer drivers. But if there was still any webos printer drivers, they will not be open source and so you can not trust them not to do unwanted things to your printer some day.
  - account42 2y ago
    Being able to print doesn't mean you have drivers for your printer - both the phone and printer support a semi-standardized protocol (probably bastardized postscript).
    - Brian_K_White 2y ago
      That's a driver. It's also a connection. If the blob is delivered in a ps package over https, or bluetooth, or via lpr or jetdirect makes no difference. The point is that software you don't control generated the data and delivered it to the printer.
      - account42 2y ago
        The OS is not going to deliver random printer firmware updates without some printer manufacturer software involved.
        Brian_K_White 2y ago
        Yes but so what? I said don't let an ios client reach the machine. I didn't say it was Apple who wrote the software that will commit the act you don't want. The same danger on Windows doesn't come from Microsoft. You download and install software from HP and it does the deed. You could in theory write an open source driver that runs on windows and is safe. There are also old closed source drivers which just happen to be well behaved. Which is why I said "drivers you aren't 100% sure about". On Android, depending on the version and distribution, there have been both pre-installed and user-installable printer drivers from hp and samsung and everyone else, pretty much just like on Windows. Even the pre-installed whichbare "part of the os" are written by the manufacturer not Google or AOSP. And just like Windows it is technically possible to write an open source driver that you can safely use and trust. Which again is why I said "drivers you aren't 100% sure about"
        account42 2y ago
        So what is the scenario you fear? An iOS or Android user goes to brother.com and prints brick_my_printer.pdf? With that level of paranoia you might as well trash the printer because an update could theoretically be steganographically hidden in a way no filter or intermediate print servers can catch without unacceptably degrading the print quality.
        Brian_K_White 2y ago
        Why do you ask about a "scenario you fear"? I don't "fear" anything. It is simply a fact that printers have an update mechanism that doesn't require the printer to have access to the internet, which is merely a print job. And so if one wants, as the gggp comment did, to ensure that ones printer cannot be updated without ones deliberate instigation, one must also be aware of all possible sources of print jobs. I don't know why you seem to have a problem with this. What scenario do you fear? In what way does this knowledge hurt you?
  - becurious 2y ago
    You can print from iOS to printers that support AirPrint. No drivers needed, but the printer needs to support the AirPrint protocol.
    - Brian_K_White 2y ago
      That means ios is not safe. Software that you don't control and was not written by end-users for end-users benefit, but was instead written by the same people who wrote the printer's firmware can send a print job from ios to the printer. The printer doesn't care what physical connection or network protocol is used, including airprint, and in the case of ios, while you might be able to print some documents without using any software from HP, HP does still have a an "HP Smart" app (and probably others) for ios. Meaning that blocking the printer from the internet does not prevent the printer from receiving updates, and all of the closed-source platforms are the primary dangers as sources of update print jobs. Technicall linux/bsd are not garanteed safe either. It's possible for a native linux app to send the same kind of update, but just far less likely without the users knowledge or intent. You have to go pretty far out of your way to install non-repo software from a printer manufacturers web site, and actively grant it permission to install and activate services that run on their own... And even if you did that, if such software even existed that was not well-behaved, the first time it did that to a linux user that didn't expect it, we would all find out about it and every google search on the topic of linux drivers for that printer would warn about the bad software. Or just no one would ever actually bother even looking to try to install it in the first place simply because the normal open source drivers and apps work well and the manufacturers software is a crazy mess. I had a Samsung color laser printer that actually had linux software provided by Samsung that I actually installed just to check it out. HOLY SHITBALLS it was terrible both outwardly just using it as a user and behind the scenes how it was written. Just crazy utter garbage all around. That software, since it wasn't open source, might do anything on it's own just like a Windows driver, including sending a printer update, but it was such junk, and so not-needed, that no linux user ever installs it, so it does no harm even though it exists and could.
throw10920 2y ago
That's devious and evil. Do you have further details about the mechanics? e.g. if it's delivered by JavaScript embedded in a PDF then maybe one could introduce a proxy that strips that out.
- pbhjpbhj 2y ago
  Unless they got specific consent that sounds like unauthorised access and unauthorised alteration of a computer system (which I gather to be judged criminal in UK & USA at least).
  - skissane 2y ago
    > unauthorised access and unauthorised alteration of a computer system (which I gather to be judged criminal in UK & USA at least). I doubt it would ever be prosecuted. It is important to remember that the law doesn’t mean what you think it means, it means what the average prosecutor and/or judge thinks it means. Those laws were invented for use against scary “hackers”, not printer manufacturers updating their own products
    - andy_ppp 2y ago
      Yes, it's amazing how we have given corporations all the powers and none of the responsibilities of individuals over the years.
  - plagiarist 2y ago
    Crimes in the US are only for individuals (and even then only for poors). If you are a registered corporation you may defraud, steal, or manslaughter without consequence.
  - mrkstu 2y ago
    I’m sure we all consented when we clicked through the driver installation screens…
  - Brian_K_White 2y ago
    I would call it that, but no one in the government will. Printer manufacturers lawyers will just equate it with the same automatic updates that the printer will do by itself if it could. And they will have a dozen words buried somewhere in the middle of a bible sized tos that you "agreed to".
waltbosz 2y ago
> method where an update is delivered as a print job I wonder if this is a way to install custom firmware. Probably not. I would guess that the code that decodes the firmware from the print job probably passes it through the same signature check code as the regular firmware update process. Still it's an interesting route for exploit exploration.
- yencabulator 2y ago
  Generally a modern printer has a shitty embedded Linux install in it. There's more than likely an exploitable vulnerability in the network services; even more so if it serves a web admin interface. The complexity is really in constructing the replacement firmware to drive the hardware correctly; developing that is probably easier if you dismantle the printer and find debug leads on the motherboard. Getting the common chips like networking going sounds doable, but for the actual printing there's lots of trade secrets around driving the actual printing hardware. A more likely route: a Chinese factory should be able to make a smallish batch of cheap monochrome laser printers with good-enough print quality, publish badly-written but usable specs for it, and make it easy to replace the firmware.
knowitnone 2y ago
why own a printer if you can't even connect to it to print?
mcv 2y ago
This sounds like circumventing home network security measures and therefore illegal.

account42 2y ago

Android and iOS don't support printer drivers so should be safe, no?

Brian_K_White 2y ago
idk about ios but I sure can print from android. I don't know if I'd be surprised or not to find out that you actually can't print from ios. It seems crazy to me, especially considering ipads, but the entire Apple ecosystem seems crazy to me and yet it exists despite my incredulity. I could even print from webos and palm but I guess that doesn't matter now. 50/50 toss up if the current webos on lg tvs still has any printer drivers. But if there was still any webos printer drivers, they will not be open source and so you can not trust them not to do unwanted things to your printer some day.
- account42 2y ago
  Being able to print doesn't mean you have drivers for your printer - both the phone and printer support a semi-standardized protocol (probably bastardized postscript).
  - Brian_K_White 2y ago
    That's a driver. It's also a connection. If the blob is delivered in a ps package over https, or bluetooth, or via lpr or jetdirect makes no difference. The point is that software you don't control generated the data and delivered it to the printer.
    - account42 2y ago
      The OS is not going to deliver random printer firmware updates without some printer manufacturer software involved.
      - Brian_K_White 2y ago
        Yes but so what? I said don't let an ios client reach the machine. I didn't say it was Apple who wrote the software that will commit the act you don't want. The same danger on Windows doesn't come from Microsoft. You download and install software from HP and it does the deed. You could in theory write an open source driver that runs on windows and is safe. There are also old closed source drivers which just happen to be well behaved. Which is why I said "drivers you aren't 100% sure about". On Android, depending on the version and distribution, there have been both pre-installed and user-installable printer drivers from hp and samsung and everyone else, pretty much just like on Windows. Even the pre-installed whichbare "part of the os" are written by the manufacturer not Google or AOSP. And just like Windows it is technically possible to write an open source driver that you can safely use and trust. Which again is why I said "drivers you aren't 100% sure about"
        account42 2y ago
        So what is the scenario you fear? An iOS or Android user goes to brother.com and prints brick_my_printer.pdf? With that level of paranoia you might as well trash the printer because an update could theoretically be steganographically hidden in a way no filter or intermediate print servers can catch without unacceptably degrading the print quality.
        Brian_K_White 2y ago
        Why do you ask about a "scenario you fear"? I don't "fear" anything. It is simply a fact that printers have an update mechanism that doesn't require the printer to have access to the internet, which is merely a print job. And so if one wants, as the gggp comment did, to ensure that ones printer cannot be updated without ones deliberate instigation, one must also be aware of all possible sources of print jobs. I don't know why you seem to have a problem with this. What scenario do you fear? In what way does this knowledge hurt you?
- becurious 2y ago
  You can print from iOS to printers that support AirPrint. No drivers needed, but the printer needs to support the AirPrint protocol.
  - Brian_K_White 2y ago
    That means ios is not safe. Software that you don't control and was not written by end-users for end-users benefit, but was instead written by the same people who wrote the printer's firmware can send a print job from ios to the printer. The printer doesn't care what physical connection or network protocol is used, including airprint, and in the case of ios, while you might be able to print some documents without using any software from HP, HP does still have a an "HP Smart" app (and probably others) for ios. Meaning that blocking the printer from the internet does not prevent the printer from receiving updates, and all of the closed-source platforms are the primary dangers as sources of update print jobs. Technicall linux/bsd are not garanteed safe either. It's possible for a native linux app to send the same kind of update, but just far less likely without the users knowledge or intent. You have to go pretty far out of your way to install non-repo software from a printer manufacturers web site, and actively grant it permission to install and activate services that run on their own... And even if you did that, if such software even existed that was not well-behaved, the first time it did that to a linux user that didn't expect it, we would all find out about it and every google search on the topic of linux drivers for that printer would warn about the bad software. Or just no one would ever actually bother even looking to try to install it in the first place simply because the normal open source drivers and apps work well and the manufacturers software is a crazy mess. I had a Samsung color laser printer that actually had linux software provided by Samsung that I actually installed just to check it out. HOLY SHITBALLS it was terrible both outwardly just using it as a user and behind the scenes how it was written. Just crazy utter garbage all around. That software, since it wasn't open source, might do anything on it's own just like a Windows driver, including sending a printer update, but it was such junk, and so not-needed, that no linux user ever installs it, so it does no harm even though it exists and could.

throw10920 2y ago

That's devious and evil. Do you have further details about the mechanics? e.g. if it's delivered by JavaScript embedded in a PDF then maybe one could introduce a proxy that strips that out.

pbhjpbhj 2y ago
Unless they got specific consent that sounds like unauthorised access and unauthorised alteration of a computer system (which I gather to be judged criminal in UK & USA at least).
- skissane 2y ago
  > unauthorised access and unauthorised alteration of a computer system (which I gather to be judged criminal in UK & USA at least). I doubt it would ever be prosecuted. It is important to remember that the law doesn’t mean what you think it means, it means what the average prosecutor and/or judge thinks it means. Those laws were invented for use against scary “hackers”, not printer manufacturers updating their own products
  - andy_ppp 2y ago
    Yes, it's amazing how we have given corporations all the powers and none of the responsibilities of individuals over the years.
- plagiarist 2y ago
  Crimes in the US are only for individuals (and even then only for poors). If you are a registered corporation you may defraud, steal, or manslaughter without consequence.
- mrkstu 2y ago
  I’m sure we all consented when we clicked through the driver installation screens…
- Brian_K_White 2y ago
  I would call it that, but no one in the government will. Printer manufacturers lawyers will just equate it with the same automatic updates that the printer will do by itself if it could. And they will have a dozen words buried somewhere in the middle of a bible sized tos that you "agreed to".

waltbosz 2y ago

> method where an update is delivered as a print job I wonder if this is a way to install custom firmware. Probably not. I would guess that the code that decodes the firmware from the print job probably passes it through the same signature check code as the regular firmware update process. Still it's an interesting route for exploit exploration.

yencabulator 2y ago
Generally a modern printer has a shitty embedded Linux install in it. There's more than likely an exploitable vulnerability in the network services; even more so if it serves a web admin interface. The complexity is really in constructing the replacement firmware to drive the hardware correctly; developing that is probably easier if you dismantle the printer and find debug leads on the motherboard. Getting the common chips like networking going sounds doable, but for the actual printing there's lots of trade secrets around driving the actual printing hardware. A more likely route: a Chinese factory should be able to make a smallish batch of cheap monochrome laser printers with good-enough print quality, publish badly-written but usable specs for it, and make it easy to replace the firmware.

knowitnone 2y ago

why own a printer if you can't even connect to it to print?

mcv 2y ago

This sounds like circumventing home network security measures and therefore illegal.