Does anyone know of any attacks, either PoC or in the wild, that use malicious printer cartridges to infect printers? I saw this article from 2022
It says that HP's Bug Bounty program found such attacks are possible, but there are no details about who reported the bug that made such attacks possible. I remain skeptical about the accuracy.
Any help from experts in the form of pointers to attacks or analysis about whether printer cartridges are a viable infection vector would be much appreciated.
HP CEO Enrique Lores said this about counterfeit ink cartridges this morningon CNBC:
They can "create security issues. We have seen that you can embed viruses in the cartridges, through the cartridges go to the printer, from the printer go to the network. So it can create [inaudible]"
I'm not aware of a single instance of this happening, either as a PoC attack by a researcher or a malicious one in the wild. Seems like the CEO is misspeaking. Any help here from people with experience in malware in embedded devices would be much appreciated.
Quote occurs at 3:28
@dangoodin if it’s possible to spread a virus from an ink cartridge across a network via HP printers I feel like that’s a failing on HP’s part, not the buyer of a third party ink cartridge. (I’ve also never heard of this happening, and it sounds like pure bullshit)
