HP cites threat of viruses from non-HP printer cartridges to justify blocking their use, experts sceptical

HP is once again been facing litigation regarding its Dynamic Security firmware updates, which stop the printer with a third-party ink cartridge installed from working. Addressing this issue, HP CEO Enrique Lores, in an interview with CNBC, has highlighted the fact that ‘hacked’ non-HP ink cartridges can be used to inject a virus into the printer, and from there to the network. This is seen as a practical justification for the controversial practice by HP, which has landed the company into lawsuits in several countries and cost it millions of dollars. However, experts are not convinced this is a valid reason.

Interestingly, HP’s primary basis for this claim is a research article funded by the company itself under its Bug Bounty program. Ink cartridges typically contain a microchip which communicates with the printer over a serial interface. In 2022, using a non-HP cartridge, a researcher was able to inject malware that gave him “persistent access and control to the printer”. The company acknowledges, though, that such an attack has never been encountered in the real world.

Ars Technica has sought out the opinion of security experts on online forums regarding the gravity of this concern. The general view seems to be that not only would it be difficult and impractical to accomplish in the real world, but that if any unexpected code such as a malware is detected, it could easily be blocked by the printer, without resorting to disabling the device entirely. The decision to outright block the use of non-HP cartridges appears not to be related to the security concern.

The latest lawsuit against Dynamic Security is hardly the first of its kind. HP has already paid several million dollars in class-action and antitrust cases in California, Europe and Australia. Despite this, it seems determined to control the use of ink cartridges, for reasons hinted by Lores in the same interview: “It's important to protect our IP. There is a lot of IP that we build in the inks of the printers, in the printers themselves ... And what we’re doing is, when we identify cartridges that are violating our IP, we stop the printer from work[ing].” 

The company has also been open about its push for a subscription model for printer ink, which drives recurring revenue and makes up for the loss that it incurs on printer sales. In Lores’ words, “...every time a customer buys a printer, it's an investment for us. We're investing [in] that customer, and if this customer doesn’t print enough or doesn’t use our supplies, it’s a bad investment.”

The latest lawsuit accuses HP of raising ink prices around the same time that the updates were pushed out. It has also been highlighted that while the research demonstrating the threat was published in 2022, Dynamic Security has been around since 2016.

For relatively economical home printing, the Canon MegaTank G3270 and the Epson EcoTank ET-2400 all-in-one wireless printers provide the option to refill ink at lower cost than buying cartridges.