HPLIP

Does hplip-3.21.4 have png files that are actually ppd and binaries

Asked by ajay

I had installed hplip-3.21.4 on my Linux Mint 19.2. using hplip-3.21.4.run from https://developers.hp.com/hp-linux-imaging-and-printing. While searching for suspicious files I found that installation folder have some *.png files that were actually either ppd files or binaries. Is it default.

Important Note: I removed the installation completely after taking backup and reinstalled. There is no such files found in new installation even after 2 months.

Question information

Language:
English Edit question
Status:
Solved
For:
HPLIP Edit question
Assignee:
No assignee Edit question
Solved by:
ajay
Solved:
Last query:
Last reply:
Revision history for this message
brian_p (claremont102) said : 		#1

> There is no such files found in new installation even after 2 months.

Then you should mark this post as solved.

Revision history for this message
ajay (homsec) said : 		#2

No my question is where did those files appear in earlier installation. was it was part of default package or caused by any hack.

Revision history for this message
Manfred Hampl (m-hampl) said : 		#3

Can you provide a file name of such spurious file?

Revision history for this message
ajay (homsec) said : 		#4

List of files
                             File name First line in File
hplip-3.21.4/ppd/classppd/ps/busy.png #!/usr/bin/env python
hplip-3.21.4/ppd/classppd/ps/add_user_quick.png # -*- coding: utf-8 -*-
hplip-3.21.4/ppd/classppd/ps/add_users.png # -*- coding: utf-8 -*-
hplip-3.21.4/ppd/classppd/ps/folder_remove.png '''Pexpect is a Python module for spawning child applications and controlling

Other than above all total 31 png files in hplip-3.21.4/ppd/classppd/ps/ folder were python codes.

hplip-3.21.4/data/pcl/default_printer.png *PPD-Adobe: "4.3"
hplip-3.21.4/data/policykit/default_psc.png *PPD-Adobe: "4.3"
and lot more

Revision history for this message
Manfred Hampl (m-hampl) said : 		#5

Those files are not delivered by the HPLIP installer.

There are png files with such names, but these contain images and reside in different directories, e.g.
hplip-3.21.4/data/images/16x16/busy.png
hplip-3.21.4/data/images/devices/default_printer.png
etc.

I have no clue what there was happening on your system.

Revision history for this message
ajay (homsec) said : 		#6

Some one hacked. When I used to open an document (pdf or doc) from any usb drive and print one hplip directory and py files used to automatically got generated in that directory. That cause me to suspect. Later printer stopped responding too. I have backup Now I have to inspect all files. Possibly cups port was being abused to sniff.