hp EFF Calls On HP To Disable Printer Ink Self-Destruct Sequence

[vissha]

EFF Calls On HP To Disable Printer Ink Self-Destruct Sequence

 

 

HP firmware update rejected cheaper third-party ink cartridges.

 

HP Inc. should apologize to customers and restore the ability of printers to use third-party ink cartridges, the Electronic Frontier Foundation (EFF) said in a letter to the company's CEO yesterday.

 

HP has been sabotaging OfficeJet Pro printers with firmware that prevents use of non-HP ink cartridges and even HP cartridges that have been refilled, forcing customers to buy more expensive ink directly from HP. The self-destruct mechanism informs customers that their ink cartridges are "damaged" and must be replaced.

 

"The software update that prevented the use of third-party ink was reportedly distributed in March, but this anti-feature itself wasn't activated until September," EFF Special Advisor Cory Doctorow wrote in a letter to HP Inc. CEO Dion Weisler. "That means that HP knew, for at least six months, that some of its customers were buying your products because they believed they were compatible with any manufacturer's ink, while you had already planted a countdown timer in their property that would take this feature away. Your customers will have replaced their existing printers, or made purchasing recommendations to friends who trusted them on this basis. They are now left with a less useful printer—and possibly a stockpile of useless third-party ink cartridges."

 

An HP OfficeJet ink cartridge, just $26.99.

 

The printer DRM "was disguised as a security update," reducing trust in the software update process used to fix security flaws, Doctorow argued. If customers have reason to believe that security updates might compromise a device's basic functionality, they are more likely to reject updates and put their security at risk, he wrote.

 

The EFF asked HP to issue a firmware update that rolls back the self-destruct sequence; publicly commit to never using software updates to distribute so-called "anti-features" that are bad for customers; commit to disclosing the effects of future software updates; and "prominently disclose any capability or plan to remove features from devices in your sales literature, so customers know what they're getting before they buy."

 

Doctorow has not heard back from HP, he told Ars today.

 

It doesn't sound like the company will be making any changes. When we contacted HP today, the company did not say whether it will reverse course. Instead, a spokesperson said, "The purpose of this update is to protect HP’s innovations and intellectual property. These printers will continue to work with refilled or remanufactured cartridges with an Original HP security chip. Other cartridges may not function. In many cases this functionality was installed in the HP printer and in some cases it has been implemented as part of an update to the printer’s firmware."

 

The firmware in question is for the security chip "that maintains secure communications between the cartridge and the printer" in HP OfficeJet, OfficeJet Pro, and OfficeJet Pro X printers, HP said. The updates began rolling out in 2015, according HP's statement.

 

HP's use of a technical countermeasure to exclude non-HP ink cartridges raises concerns that HP might invoke Section 1201 of the Digital Millennium Copyright Act, which makes it illegal to circumvent technological measures that control access to copyrighted works, Doctorow also wrote. He asked HP to promise never to invoke Section 1201 against security researchers or "competitors who make legitimate aftermarket products."

 

"Security researchers rightly fear that disclosures of defects in products covered by Section 1201 could lead to severe punishments," Doctorow wrote. "Many respected researchers came forward at the Copyright Office's triennial 1201 exemptions hearing in 2015 to say that they'd been chilled from disclosing vulnerabilities in 1201-covered systems, from voting machines to tractors to insulin pumps. This means that bad guys are free to exploit vulnerabilities in these products, while good guys are scared off from warning the people who depend on them about the dangers lurking in them. Given the history of attacks on printers, and the widespread distribution of your products, this is the last thing you should want."

 

Nearly 8,000 people have signed an EFF petition calling on HP to restore the full functionality of its printers.

 

Source

 

Update:

 

[straycat19]

HP use to be found throughout an organization, there was one on every desk almost, even though there were networked laser printers.  Those days are long past.  We no longer buy individual printers, instead we have multiple color laser printers in each department from Ricoh.  

 

I have a HP 970CXI Professional Series printer I bought in 1999 and my wife still uses it daily.  I have never had a bit of trouble with it.  I truly believe I got my money's worth from that printer.  My sister is still using my first laser printer with an old computer system.  That printer is an Okidata OL400 LED that I bought at CompUSA in San Bruno in 1993.  I think I can honestly say they just don't build printers like these any more.

[DKT27]

This update released recently or not. My printer from this company is doing this from years now, especially after a firmware update released for my printer couple of years ago. Now my printer is just sitting there, not being used atall. Getting things printed from print shops is cheaper than maintaining this thing.

 

I doubt I will ever buy any product from them.

[davmil]

32 minutes ago, DKT27 said:

This update released recently or not. My printer from this company is doing this from years now, especially after a firmware update released for my printer couple of years ago. Now my printer is just sitting there, not being used atall. Getting things printed from print shops is cheaper than maintaining this thing.

 

I doubt I will ever buy any product from them.

I like Brother brand for the last couple years.  Cheap to buy & operate.   Over the years they've updated firmware & drivers as Windows has evolved. Good value IMO.

 

Does anyone know if lasers and their cartridges are similarly affected as the inkjets?

[DKT27]

12 minutes ago, davmil said:

I like Brother brand for the last couple years.  Cheap to buy & operate.   Over the years they've updated firmware & drivers as Windows has evolved. Good value IMO.

 

Strongly considering buying one. But they released newer models here which are about 20% more expensive now, while previous models not to be found.

 

While I have small amount of printer usage, so buying it may take some time. But have heard too good about them to ignore it.

[davmil]

2 hours ago, DKT27 said:

 

Strongly considering buying one. But they released newer models here which are about 20% more expensive now, while previous models not to be found.

 

While I have small amount of printer usage, so buying it may take some time. But have heard too good about them to ignore it.

Keep your eye out for a promotional.  Maybe a special deal will come along soon.  Worth considering in your final choice.

 

6 hours ago, straycat19 said:

HP use to be found throughout an organization, there was one on every desk almost, even though there were networked laser printers.  Those days are long past.  We no longer buy individual printers, instead we have multiple color laser printers in each department from Ricoh.  

 

I have a HP 970CXI Professional Series printer I bought in 1999 and my wife still uses it daily.  I have never had a bit of trouble with it.  I truly believe I got my money's worth from that printer.  My sister is still using my first laser printer with an old computer system.  That printer is an Okidata OL400 LED that I bought at CompUSA in San Bruno in 1993.  I think I can honestly say they just don't build printers like these any more.

Are HP Laser Toner cartridges / machines similarly affected?  e.g. - Are HP lasers going to gag on 2nd party toner cartridges?

[DKT27]

10 minutes ago, davmil said:

Keep your eye out for a promotional.  Maybe a special deal will come along soon.  Worth considering in your final choice.

 

Their products, inspite of being so reputed worldwide, are surprisingly not famous here. Meaning, while they are available to be bought here, unlike all the cheap products that go on sale, I doubt Brother's products will. Having said, you have a good point and will remember it.

[asf]

Is there no way to downgrade the firmware?

[CODYQX4]

.

[Beamslider]

I wouldn't touch anything HP with a 10 foot pole.

 

 

[Pequi]

18 hours ago, asf said:

Is there no way to downgrade the firmware?

Yes, a Brazilian company called "Mega Tintas" has published a video and software to do the downgrade. They do a lot of trade, so are probably trustworthy. Both the video (on youtube) and the program are in Portuguese.

Expect translations and plenty of ransomware posing as fixes in the next few weeks.

My advice, unless you are desperate, is to wait for HP to sort out the mess they made. They are breaking EU laws, and will probably offer a fix.

[davmil]

22 hours ago, asf said:

Is there no way to downgrade the firmware?

I've read you can get on their website and download the printer driver software bundle from pre-update and go back to the way it was.  I also read they're going to issue a firmware patch to disable the 'mis-feature' within the month.

[pc71520]

HP apologizes for ink-blocking update (BBC)