7 ms·
Procolored printer drivers contained malware
- elmt35 1y agoThe printer company in question is: Procolored
- jbverschoor 1y ago[flagged]
- yccs27 1y agoYup, that clickbait headline should be "Procolored served customers malware for months, dismissed it as false positives" instead.
- kevincox 1y agoBut that only grabs the attention of people who own a relatively niche Procolored printer. This clickbait headline scares everyone with a printer into clicking. Absolute shit state we are in.
- HPsquared 1y agoWhat is it with printers and (pardon the pun) shady practices?
- gostsamo 1y agodiminishing market and margins call for extreme pressure to monitize whatever is left of the user base.
- bigfatkitten 1y agoThese aren’t commodity office printers. They’re UV inkjets, which are used to print artwork onto objects and cost many thousands of dollars.
- raverbashing 1y agoSo it sounds more like TDD (technobro driven development)
- bolognafairy 1y agoI assure you that “sneaking spyware into installers” predates “tech bros”
- Avamander 1y agoNo it's your average hardware vendor wanting to spend the smallest possible amount of money on software.
- M95D 1y agoThere's only some printer companies. I'm using Epson inkjet and I never had any problems. Drivers are very good too.
- jpc0 1y agoTheir inktank line is quite scummy tbh… Catch filter that can be trivially replaced in the field, firmware needs to be reset by an authorised repair center (yes there are workarounds but they aren’t official) Also on windows their “drivers” install a ton of crap with them, even when you install the most basic version in their installer. When in fact they have go a driver which does exactly what it should and only installs a driver but then they don’t get that sweet spyware installed on your machine. Never mind their network printer driver just failing to print half the time. Prints fine from my phone, on the same network right next to my PC but from my PC, FU. Epson are not innocent in the chaos that is printers.
- stop50 1y agoTo be frank: every consumer printer "driver" installs bloat.
- rvnx 1y agoIf Bitcoin wallets would be designed properly they would ask for a second confirmation before sending 100k USD. This may be the main thing to fix here, as it's very plausible that hacks happen again and again... by design. Today it's an infected printer, tomorrow it will be a game on Steam.
- alpaca128 1y agoSteam already had a game with an infostealer a while ago. A pirate game. But something like that would only be surprising if it was more than an obvious lazy asset flip.
- cm2187 1y agoThe malware doesn’t send all the content of the wallet to itself, it just replaces the recipient address in the clipboard (so you wouldn’t notice unless you checked the address). The 100k I think are cumulatively, though if it is 9btc, it’s more like 1m.
- cjbprime 1y agoThen the malware would provide that confirmation to the wallet too. Defending yourself from malware running on the same (Windows) machine is mostly impossible.
- xnickb 1y agoThat's a much harder attack to pull off. Windows actually does a decent job at preventing this kind of thing from being easily achievable. Clipboard attacks are far easier, as most modern systems treat clipboard as a non-critical resource. Which is mind blowing if you ask me. An app reading from clipboard must ring all sorts of alarms. Let alone writing to it.
- gruez 1y ago>An app reading from clipboard must ring all sorts of alarms. Let alone writing to it. You realize any sort of content editing app is going to be reading from clipboard? Most apps used on a daily basis are going to be reading from clipboard.
- canvascritic 1y agoSnipVex clipjacking wallets is almost beside the point, the real failure is a printer vendor treating software like a side gig. Printer and hardware companies get a pass on basic infosec hygiene that would be unacceptable for open source maintainers. until that changes, airgap your weird hardware setups I guess Also this is a perfect storm for lateral movement. USB-borne worms still work frighteningly well in small biz environments, especially ones with no centralized IT and people plugging printers directly into Windows desktops with admin perms. Here SnipVex is just a cherry on top-a nice, opportunistic payload for the growing class of infostealers targeting crypto wallets
- ChrisMarshallNY 1y ago> a printer vendor treating software like a side gig This is a chronic problem with hardware vendors. Source: Software developer for hardware companies, for over 30 years.
- throw903332 1y ago> basic infosec hygiene that would be unacceptable for open source maintainers Opensource printer stack is a legacy mess. There is critical vulnerability almost every year. There are not enough money or developers to fix that!
- aaviator42 1y ago> Opensource printer stack is a legacy mess. I don't necessarily disagree, but isn't this because of extremely bad firm/soft/hardware design by the printer companies that then have to be supported by the open source stack?
- juliangmp 1y agoThe printer stack as a whole is a legacy mess.. I have an easier time getting a 3D printer to work than any inkjet machine
- diggan 1y agoMaybe I got lucky, but in 2017 I bought a Brother DCP-L2520DW laser printer. No matter what OS, computer or network I connect it to, it seems to just work for everyone involved, always, and I don't think I've had a single issue with it since I got it nor did anything at all to set it up, basically installed CUPS on my desktop to get it to work and for Windows/macOS it just works. Not affiliated, just happy user, at least some companies seem to be able to deal with it, regardless if it's open source (my stack) or not (my wife's Apple-stack).
- razakel 1y agoHosting drivers on mega.co.nz. Totally fills you with confidence.
- codetrotter 1y agoI’ve seen other hardware companies that host firmware downloads for their products on Google Drive and some Chinese cloud drive. I don’t think doing that, nor Dropbox link, is different really from hosting it on Mega.
- bolognafairy 1y agoOkay. It still doesn’t fill me with confidence.
- MathMonkeyMan 1y agoTrust us, bro. We paid bottom dollar for this software.
- djfergus 1y ago“ It is also worth noting that I contacted Procolored support four times over the course of my testing, for help with figuring out the software and settings. Every single time, the agent requested multiple times that I allow them to connect remotely to my computer”
- tough 1y agolol are procolored just a NK hacker unit or something ffs
- jeroenhd 1y agoAt least mega.co.nz is a file sharing name I recognise. My keyboard's drivers are hosted on "egnyte.com"
- Lammy 1y agoThere's nothing wrong with Mega
- shakna 1y ago> While some redditors speculate that the trojan was planted on purpose, there is no evidence to support this claim. Outdated malware with an inactive command-and-control server is not advantageous for any attacker nor does superinfection make sense for this scenario. A far more plausible explanation points to the absence or failure of antivirus scanning on the systems used to compile and distribute the software packages. Procolored promises to improve this process, so that it cannot happen again. That this system is so insecure as to be hit multiple times, I don't know how much stock anyone should put in "improved processes". This is a company who seems to have gone out of their way to create an insecure environment - probably out of some frustration, but all the same, insecure.
- pavel_lishin 1y ago> Procolored promises to improve this process, so that it cannot happen again. Given their lax security posture, can we really trust this promise? I'd demand, at minimum, a pinky swear.
- sidewndr46 1y agoThe improved process likely involved legal adding a clause to some sort of EULA that renders them harmless from any of their basic security failures
- M95D 1y agoSomehow, I was expecting to be about HP.
- whimsicalism 1y agocrazy to me that people are still writing malware in delphi