If you’re using an HP printer, such an attack is feasible because of the chips that they use for detecting ink levels, verifying the manufacturer, etc.. As a result, any cartridge could potentially infect your printer (since potentially an attacker could modify a first party ink/toner cartridge and replace its chip with one infected with malware). As such, the only fully “safe” approach is to modify your HP printer such that it doesn’t connect to these chips at all.
I look forward to HP providing firmware that will prevent the printer from communicating with any ink/toner chips (and that will allow printing to continue unabated, relying on the user to notice that ink levels are low and that new ink is required).
CEO: "We have observed through careful analysis that by locking our customers inside the restaurant, they will continue to order food from us in order to not starve. Therefore, from now on, all doors shall now be one way only"
5 years ago I bought a 10 year old HP Laserjet because I was fed up with every single bubble jet printer's quality and ink cost. I'm still using the toner that came with it. And I've been getting low ink warnings for 3 of those years. Maybe 500 or so pages in that time. I'd never buy a new HP though since they phone home. If you find an old Laserjet I can't recommend them enough.
Which is sad. The HP LJ4 was a fucking tank back in the day. I used to get them for friends and family, put in an Ethernet card, clean it up, and then it's print for another decade.
I like how HP says a big reason to not use 3rd party ink is because they can introduce malware, which is another reason they need to work to make sure you only use HP ink.
However, the security issue is because of the chips they use in order to make sure you only use HP ink.
It seems like to me that HP, HPE and HP Printing have had the most constant and slowest death in the industry and if this article proves anything, it isn't going to change.
If a company sees me not as a customer, but as a "bad investment", I think it is time to turn into an even worse investment and in the future buy products from a company that values their customers as human beings.
But how can malware be in the cartridge in the first place? Because someone in management had the ingenious idea, to put a chip with complex code and access rights in what is supposed to be a simple mechanical part.
I used to work for a laptop repair company. Nothing made me hate HP than having to work on their machines. Dell? Lenovo? Hell, Asus? I’d take ‘em all over an HP any day.
Drive lock:
This utilizes the ATA security commands. DriveLock uses master and user password. I don't know how exactly they are used, but simply the user password is used for unlocking the drive while master password is required to reset it.
While enabling DriveLock, HP UEFI ask me for a password. Which one is it? Does it re-use it for both? Does it use the admin password as master? Does it generate and save the master password in UEFI? I should probably test it out with hdparm.
Vanishing boot entries:
Did you just boot up from external drive? Where's the boot entries? ¯\_(ツ)_/¯ Can you at least add them in UEFI settings like with any normal computer? Nope. You need to use either efibootmgr or bootice. I usually just boot Hiren's Boot (PE) and use Bootice. Is that it though? Nope. The boot priority won't be saved. You need to head back into UEFI settings (and don't you dare forget to unlock your drive, or else start all over), go into boot settings, "OS Boot Manager" and then put them in correct order. What they don't tell you is that if you get out to "Save and exit", this won't be saved. You have to press one of the F keys, I believe F10, to save the boot order, and just then you can "Save and exit".
I like how HP says a big reason to not use 3rd party ink is because they can introduce malware, which is another reason they need to work to make sure you only use HP ink.
However, the security issue is because of the chips they use in order to make sure you only use HP ink.
It seems like to me that HP, HPE and HP Printing have had the most constant and slowest death in the industry and if this article proves anything, it isn't going to change.