Slashdot Mirror
How a Few Yellow Dots Burned the Intercept's NSA Leaker (arstechnica.com)
On Monday, news outlet The Intercept released documents on election tampering from an NSA leaker. The documents revealed that a Russian intelligence operation sent spear-phishing emails to more than 100 local election officials days before the election, which ran through a hack of a U.S. voting software supplier. Hours later, the Department of Justice charged 25-year-old government contractor Reality Leigh Winner with sharing top secret material with the media. The DoJ said it Winner had "printed and improperly removed classified intelligence reporting, which contained classified national defense information" before mailing the materials. But how could the DoJ know that it was Winner who had printed the documents, or that the documents were printed at all? ArsTechnica explains: [...] The Intercept team inadvertently exposed its source because the copy showed fold marks that indicated it had been printed -- and it included encoded watermarking that revealed exactly when it had been printed and on what printer. The watermarks in the scanned document The Intercept published yesterday -- were from a Xerox Docucolor printer. Many printers use this or similar schemes, printing faint yellow dots in a grid pattern on printed documents as a form of steganography, encoding metadata about the document into its hard-copy output. Researchers working with the Electronic Frontier Foundation have reverse-engineered the grid pattern employed by this class of printer; using the tool, Ars (and others, including security researcher Robert Graham) determined that the document passed to The Intercept was printed on May 9, 2017 at 6:20am from a printer with the serial number 535218 or 29535218. Further reading: How The Intercept Outed Reality Winner.
If you're going to leak documents, take a photo and crank up the jpeg compression level to help hide the watermarks.
Okay, who leaked the information about how they spotted the leak source?
-Bob-
Dang. Found on the PDF scans even though you can't see them. Lessons learned:
1. make sure to take really really low quality scans only of senstitive printouts.
2. Use someone else's printer
3. The "swamp" being drained is evidently people who are reporting on wildly unethical things the government is doing.
Obligatory yes the last guy did it too. STFU and focus on the current abomination in office, maligning the last guy doesn't help anything more than you losing sleep at night.
As a non-native english speaker, I ask: is this an actual, socially acceptable name in english-speaking countries? "Reality Winner", just like somebody who won a reality show?!
While not everybody knows about the yellow dots, almost everybody involved with infosec does. How can The Intercept can be trusted to hold or publish any leakers' information securely?
Was this one reporter who screwed up? Didn't he have a second person reviewing his work? Isn't there a team of people at The Intercept who discuss whistleblowing publications? Isn't anybody on such a team aware of digital privacy issues?
This will be a huge loss if The Intercept becomes useless as it was basically founded to handle stories like this. But given that, how could the outcome have been so bad in this case?
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
While interesting, and certainly providing confirmation, this wasn't the primary mechanism that was used to track her down according to the affidaivat. Before even IDing a specific printer, they simply looked for someone that had printed it out, period.
Internal auditing showed that only six employees had printed out the item in question. A search of the six computers showed that she had emailed The Intercept from her work computer (and that no one else had). Coded metadata just backs it up, but it's dumber than that.
Hire a Linux system administrator, systems engineer,
In fairness to them, she also (reportedly) violated some of the things they suggest, like emailing them from her computer at work.
Then again, they also (reportedly) gave away her location (Augusta GA) to the government person they were trying to verify the documents with.
"The U.S. Government Agency determined that six individuals printed this reporting. WINNER was one of these six individuals. A further audit of the six individuals' desk computers revealed that WINNER had e-mail contact with the News Outlet. The audit did not reveal that any of the other individuals had e-mail contact with the News Outlet."
Also, don't use your work computer or email account to send/receive emails to the organization you're leaking classified documents to.
In The Year Two Thouuuusand....
Sadly, she is being charged under the Espionage Act. There is no defense, no mitigating circumstances, and she will spend many long years in prison as an example. Even if you disagree with her actions , this sounds inappropriate. Like the Soviet Union or China.
Then again, they also (reportedly) gave away her location (Augusta GA) to the government person they were trying to verify the documents with.
Wait, they have top secret government documents, and they're going to verify them with the government? And then give information of their source to the government? And then release the original photos of documents to the public? Did they also hand over the originals to the government so they could grab fingerprints and other forensic evidence off of them?
There is no excuse for how many failures the Intercept committed in protecting a formerly anonymous source. I'm going out on a limb here and say that this will be the last time they receive info from an actual anonymous source that isn't a complete idiot. Then again, as noted, Winner appears to qualify as a complete idiot, emailing them from work in the first place.
The cesspool just got a check and balance.
> and picked a more socially acceptable name
Her birth name is Sara, not "Reality". She chose to be Reality Winner instead of the normal name her parents had chosen.
Yeah, like Daniel Ellsberg, she broke the law to serve the law
With THIS supreme Court however, she won't even get a hearing, even if Trump is finally implicated, impeached, convicted, tried, convicted and hanged.
Trey Gowdy on Hillary emails
He talks about intent around 1:55, but the lead up is not bad either. They chose to pretend there was no intent. There was proof of intent, but no prosecutor to prosecute her.
She did nothing but to serve her own interests of hating the President.
Here is the EFF's guide on yellow dots.
And it's not in any way limited to Xerox.
You can test it yourself by photographing a piece of paper from a suspect printer, loading it into the GIMP and showing just the blue channel. The "yellow" dots will show up as a darker shade of blue than the surrounding page.
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
You are confused. "The Law" is not a description of "right" and "wrong".
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
What a waste. She could have told us who really killed JFK, that Obama really was born in Kenya, who really shot JR (Probably too long ago for /. people).
Well she'll have a while to think about it. Maybe she'll get Chelsea Manning's old cell.
You're right to be sceptical. Maybe most of the sceptics aren't bothering to post, for whatever reason.
Oh fuck aye. Of course they should, if they were competent at InfoSec, an had been aware for the 15-odd years that this technology has been deployed.
Ah, you don't understand how it works. There is nothing in the document that stores this watermarking information. It is ADDED to the document BY the printer, AFTER the printer has rendered the provided information to being an image. In fact, one of the methods promoted years ago for identifying which printers did this (and for obtaining enough information to crack their steganography encoding), was to print a blank document on pale blue paper - which made the contrast of the pale yellow dots much more visible.
The information in the steg encoding included the printer's serial number, date and time, and quite conceivably, the printer-user's network authentication. Which I assume is how they nailed the perpetrator.
As a corollary, whoever was publicising this should have known to photocopy the documents provided onto monochrome (ie black/white, not grey-scale) output, then burned the originals. Precisely to avoid having to hand over such steg to agents.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"