Dan GoodinJan 19, 2024

Does anyone know of any attacks, either PoC or in the wild, that use malicious printer cartridges to infect printers? I saw this article from 2022

https://www.action-intell.com/2022/10/05/hp-bug-bounty-program-finds-reprogrammable-chips-open-printers-to-malware/

It says that HP's Bug Bounty program found such attacks are possible, but there are no details about who reported the bug that made such attacks possible. I remain skeptical about the accuracy.

Any help from experts in the form of pointers to attacks or analysis about whether printer cartridges are a viable infection vector would be much appreciated.

HP Bug Bounty Program Finds Reprogrammable Chips Open Printers to Malware | Actionable Intelligence

HP Inc. reported to Actionable Intelligence that it has confirmed third-party cartridges with reprogrammable chips can be used to inject malware into printers and compromise networks. HP has released a security alert and updated printer firmware to address the problem.

Actionable Intelligence | Market Research for digital printer and MFP hardware and supplies
Show threadDan GoodinJan 19, 2024

HP CEO Enrique Lores said this about counterfeit ink cartridges this morningon CNBC:

They can "create security issues. We have seen that you can embed viruses in the cartridges, through the cartridges go to the printer, from the printer go to the network. So it can create [inaudible]"

I'm not aware of a single instance of this happening, either as a PoC attack by a researcher or a malicious one in the wild. Seems like the CEO is misspeaking. Any help here from people with experience in malware in embedded devices would be much appreciated.

Quote occurs at 3:28

https://youtu.be/QPRMyQSZGuY?si=EU905oCTcW860xJs&t=208

HP CEO Enrique Lores on PC market trends: 'Significant tailwinds' will continue to drive demand

YouTube
Show threadGuillaume RossJan 19, 2024
@dangoodin Even if it did happen… fix your POS printer that has code exec from a cartridge???
Show threadhaifisch
@g @dangoodin bet this would be a fairly targeted attack if it were to happen, that or they really need to keep an eye on their supply chain. Going on CNBC and saying this without like a direct reference to a reported situation in history just spurs fear in the marketplace which is (imho) anticompetitive behavior from HP, basically just telling boogieman stories hoping people will turn away from the alternatives due to a fear of being "hacked", this time by your printer ink cartridge lol.
Jan 19, 2024 at 8:21pmWeb
Show threadGuillaume RossJan 19, 2024
@haifisch @dangoodin CEO goes on national news to brag about 0day in their product is a hell of a move
Show threadhaifischJan 19, 2024
@g @dangoodin AND in the first month of the new year, with all this time before defcon and other conferences. very bold strategy, lets see if this pays off for 'em.
Show threadGuillaume RossoliniJan 19, 2024
@haifisch @g @dangoodin yeah let’s see
Show threadNew England Clam ChowderJan 20, 2024
@g