HP CEO Pulls Off James Bond-Style Hack with Ink Cartridges

Last Thursday, HP CEO Enrique Lores addressed the company’s controversial practice of bricking printers when users load them with third-party ink. ⁤Speaking to CNBC Television, he said, “We have seen that ​you can embed viruses⁤ in ⁢the cartridges. Through the cartridge, [the virus can] go to the printer, [and then] ‍ from the printer,⁢ go to the network.”

That frightening scenario could help explain why‍ HP, which was hit this month with another⁤ lawsuit over its Dynamic Security system, insists on deploying it ⁢to printers.

Dynamic Security stops HP printers from‍ functioning if an ink cartridge without an HP chip or HP electronic circuitry is installed. HP has issued firmware updates that block printers with such ink cartridges from printing, leading⁢ to the above lawsuit (PDF), which is seeking ⁣class-action certification. The suit alleges that HP printer customers were not made aware that printer firmware updates issued in late 2022 and early 2023 could result in printer features not working. The lawsuit seeks monetary damages ‍and an‍ injunction preventing HP⁤ from issuing​ printer updates that block⁤ ink cartridges without an HP chip.

But are hacked ink cartridges something we should actually be concerned about?

To investigate, I turned ⁢to Ars Technica⁣ Senior Security Editor‌ Dan Goodin. He ‌told me that he didn’t know ⁢of any attacks actively used in the wild that are capable of using a cartridge to infect a printer.

Goodin also put the question to Mastodon, and cybersecurity professionals, many with expertise in embedded-device hacking, were decidedly ‌skeptical.

Another commenter, going by Graham Sutherland / Polynomial on Mastodon, referred to serial presence detect (SPD) electrically‌ erasable ‍programmable read-only memory (EEPROM), a form ⁢of flash memory used extensively in ink cartridges, saying:

I’ve seen and done some truly ‍wacky hardware stuff in my life, including ⁢hiding data in SPD EEPROMs on‍ memory DIMMs (and replacing them with microcontrollers for similar⁤ shenanigans), so‍ believe me when I say that his claim is wildly implausible ‌even in a lab‍ setting, let alone in the wild,​ and let alone at​ any scale that impacts businesses or individuals ⁣rather than selected political actors.

HP’s evidence

Unsurprisingly, ‌Lores’ claim comes from HP-backed research. The‌ company’s bug bounty program tasked researchers from Bugcrowd with determining if it’s possible to use an ink cartridge as‌ a cyberthreat. HP argued that ink cartridge microcontroller chips, which are used to communicate with the printer, could be an entryway for attacks.

As ⁢detailed in a 2022 article ⁤from research firm Actionable Intelligence, a researcher in the program found a way to hack a ‍printer​ via a third-party ink⁢ cartridge. The researcher ⁣was reportedly unable to perform ‌the⁤ same hack with an HP cartridge.

Shivaun Albright, HP’s chief technologist of print⁢ security, said at the time:

A researcher found ‍a vulnerability over the serial interface‍ between the cartridge and the printer.

Read More rnrn