10

Today, I received a pop-up warning saying "hpRaster.bundle will damage your computer. You should move it to the Trash".

"hpRaster.bundle" is installed by Mac OS X as part of its drivers for my HP Laserjet P1102w printer.

I ran a malware search on CleanMyMac X, and it only flagged up an issue with Safari. (Dealt with.)

Is there anything I can do to prevent these false positive warnings happening save waiting for Apple to push updates?

Improve this question
6
  • Catalina doesn't have a malware warning of any kind. What anti-malware application are you using?
    – Allan
    Commented Oct 23, 2020 at 21:11
  • 1
    Yes it does. It’s one of Gatekeeper’s functions.
    – Richard Cosgrove
    Commented Oct 23, 2020 at 21:13
  • That's not Gatekeeper. That's would be XProtect but that's only when an app is being opened for the first time. There's no malware detection system (like anti virus) on Catalina. Any false positive detection would be the responsibility of the people writing the detection - not the (innocent) vendor who was incorrectly flagged.
    – Allan
    Commented Oct 23, 2020 at 21:21
  • 1
    I got Gatekeeper and Xprotect confused. But this is down to OS X incorrectly flagging files as malware, due to HP having certificates revoked: go.theregister.com/feed/www.theregister.com/2020/10/23/…
    – Richard Cosgrove
    Commented Oct 24, 2020 at 9:25
  • 1
    @Allan the HP installers are egregiously bad at being good citizens of secure and minimal installation. I think everyone is leveling up on what to call this and the various technologies surrounding signed apps, CRL, OCSP, notarized and stapled tickets and more. It’s not wrong for many to over simplify and just want an EZ button and the more technical we are, the more we risk losing people to jargon fatigue.
    – bmike ♦
    Commented Oct 24, 2020 at 19:54

6 Answers 6

Reset to default
9

Unfortunately, this appears to be an issue with HP printer drivers and/or Catalina 10.15.7 - I'm one of many people with the same issue. Lots of us are reporting the same symptoms on the HP Support forums, but at the time of writing there's no fix. Based on experiences so far, HP are ignoring the issue, hanging up on phone calls, or claiming that you'll need to buy a new printer.

All indications at the moment are that there's some kind of issue with the driver signing. Using AirPrint may be a workaround.

I'll update this answer if anything substantial changes.

UPDATE: The issue has now been resolved. We can assume that Apple and/or HP has reinstated the code signing certificate, or added the signature to a whitelist, or some other behind-the-scenes magic. No user intervention was required for me - no reinstallation of drivers or anything else, the printer that was failing to start a few days ago now works without any problems.

Improve this answer
8
  • 1
    Thanks. I’ve experienced HP’s complete lack of technical support before, so that’s why I didn’t bother checking those forums.
    – Richard Cosgrove
    Commented Oct 23, 2020 at 18:56
  • Turns out HP told Apple to revoke the drivers’ certificate, causing OS X to class it as malware. go.theregister.com/feed/www.theregister.com/2020/10/23/…
    – Richard Cosgrove
    Commented Oct 24, 2020 at 9:21
  • There's no evidence that HP asked Apple to revoke it. Apple chose to revoke the HP driver cert, or perhaps was asked to do so by HP. It isn't known why this happened and could very well be a 3rd party CA authority. This is how fake news gets created and spread.
    – Allan
    Commented Oct 24, 2020 at 17:01
  • 1
    I haven’t chased down who revoked the cert, but I see HP and Apple fixing this darn fast and properly given the severity of the issue. Boy I would love to be a fly on the wall of their after-action technical meetings on this event.
    – bmike ♦
    Commented Oct 24, 2020 at 19:56
  • 1
    Allan - There is an update to the story that Richard linked to, wherein an HP spokesperson specifically told The Register on Friday night: "We unintentionally revoked credentials on some older versions of Mac drivers. This caused a temporary disruption for those customers and we are working with Apple to restore the drivers." Source: theregister.com/2020/10/23/hp_printer_macos To draw a parallel, this is like them saying "This was entirely our fault. We did this. By accident. Us. It was not Apple's fault. It was ours. Our fault. We screwed up, not Apple." 😁
    – TJ Luoma
    Commented Oct 26, 2020 at 20:12
6

Download new driver from hp support website can solve this problem. eg: https://support.hp.com/cn-zh/drivers/selfservice/closure/hp-laserjet-pro-p1106-p1108-printer-series/5099191?ssfFlag=true&sku=

Improve this answer
1
4

The HP certificates were revoked due to security breaches and it is not clear if Mac software is vulnerable or just that HP chose to revoke certificates used in both the vulnerable software and Mac software that was not compromised by these specific vulnerabilities.

The wording of Apple’s pop up did surprise many people, but these CVE are super severe so I don’t disagree with the decision to shut off / revoke all their certificates implicated in known problems and repackage the software they know is safe. It appears this all happened in less than 12 hours on a Friday.

We pushed this HP installer to thousands of Macs middle of the day yesterday and t restored all printing before Apple had the updates which we are applying as well to all computers.

Improve this answer
2
  • Are you saying that the Apple-managed certs were revoked because they were also used in Windows software affected by the reported vulnerabilities? There's also a 1 month gaps between the HP bulletin and HP asking (or getting) Apple to revoke it.
    – benwiggy
    Commented Oct 29, 2020 at 16:46
  • For the current macOS version (Big Sur 11.2.1) the most reliable way of resolving the problem seems to be procedure using the “HP Uninstaller” described in the support.hp.com/us-en/document/c06960563 knowledge base article. Just installing the hp-printer-essentials-S-5_14_8_4.pkg software still fixes printing but no longer fixes scanning on scanner-equipped devices. Please note that the warning about the installer removing “all configured devices” appears not to apply to non-HP devices. I had several such devices configured, and they were luckily all left untouched.
    – Otto G
    Commented Mar 1, 2021 at 19:41
0

HP have released a notice about how to fix this issue: reinstall the affected drivers via HP Easy Start, Apple Software Update or downloading drivers from HP’s website.

I tried the second. I got an error saying the driver is damaged and can’t be installed. But the driver download from HP at https://support.hp.com/gb-en/drivers worked.

https://eclecticlight.co/2020/10/26/what-happened-with-security-updates-and-hp-printer-software/

Improve this answer
0

This quick recipe worked for me. I deleted the offending file by entering this in my Terminal:

sudo rm -rf /Library/Printers/hp/laserjet/p1100_1560_1600series/hpRaster.bundle

Then, when I next tried to print a page, a message came up with a "need to install printer driver" message with a "click here to install" link. I clicked that thing and all is now well.

Improve this answer
-1

By the time I read this page, I had already tried Apple Software Update (multiple times) so I tried HP Easy Start. The bad news is that I'm still seeing a diagnostic about Matterhorn.framework, whatever that is. The good news is that printing proceeds (I reach the summit (heh)) after closing the malware notification. Closing the earlier malware notifications shutdown printing.

Improve this answer
1
  • Try this to delete all your HP printer drivers and then re-installing the driver: open the Printer preferences panel. Remove your HP printers. In Finder open the folder [Your hard drive]\Library\Printers\. Open Terminal. Enter this (no quote marks) “sudo RM -r “ then drag the HP folder from Printers (AND ONLY THAT FOLDER) to Terminal. Press enter. Enter your admin password. RM -r will delete the HP folder and everything it contains.
    – Richard Cosgrove
    Commented Oct 28, 2020 at 22:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .