Researcher Wants To Protect Whistleblowers Against Hidden Printer Dots (bleepingcomputer.com)
An anonymous reader writes: "Gabor Szathmari, a security researcher for CryptoAUSTRALIA, is working on a method of improving the security of leaked documents by removing hidden dots left behind by laser printers, which are usually used to watermark documents and track down leakers," reports Bleeping Computer. "Szathmari's work was inspired by the case of a 25-year-old woman, Reality Leigh Winner, who was recently charged with leaking top-secret NSA documents to a news outlet." According to several researchers, Winner might have been caught after The Intercept had shared some of the leaked documents with the NSA. These documents had the invisible markings left behind by laser printers, which included the printer's serial number and the date and time when the document was printed. This allowed the NSA to track down Winner and arrest her even before she was able to publish the leaked documents. Now, Szatmari has submitted a pull request to the PDF Redact Tools, a project for securely redacting and stripping metadata from documents before publishing. Szathmari's pull request adds a code routine to the PDF Redact Tools project that would allow app operators to convert documents to black and white before publishing. "The black and white conversion will convert colors like the faded yellow dots to white," Szathmari said in an interview. Ironically, the project is managed by First Look Media, the parent company behind The Intercept news outlet.
even black and white laser printers can watermark the document. The pixels are small enough that you won't notice them and at normal 300dpi scanning they won't transfer, just like the yellow dots, but if you get hold of the originals, there's data on there that can be used to track back to the printer in question. Inkjets do it too, both black and color models.
Turns colored dots into black ones. Problem solved.
excitingthingstodo.blogspot.com
I'd operate under the assumption that the NSA has hacked their hardware and software to put document tracking information into things like font rendering and image dithering artifacts.
OCR into a plain text file and strip out any formatting. It's the only way to be even remotely sure.
Log in or piss off.
No, no one. Well maybe just you. The rest of us are intelligent enough to realize that security clearances aren't determined by discriminatory items such as a person's name.
I think the purpose of a background check is to be "discriminatory". What a dope.
"This is useful to detect whistle blowers in the US."
Again, we are sacrificing billions around the world to dictatorships who will just use the exact same products to clamp down on their own people.
If 1984 were to be rewritten, it should have been from the point of view of many billions living in grinding dictatorship, being spied on by their governments simply using commercial products sold to them by some hundreds of millions living in relative freedom, embedding spying tech in those products to catch mundane crooks in their own society.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
by removing hidden dots left behind by laser printers, which are usually used to watermark documents and track down leakers,
This is incorrect. The purpose of the dots and why they are limited to color printouts is because they are intended to be used to identify currency counterfeiters.
wiki
During the 1990s Xerox and other companies sought to reassure governments that their printers would not be used for forgery.
Anons need not reply. Questions end with a question mark.
Is it just me, or does the part about "...working on a method of improving the security of leaked documents..." sound rather ironic considering that the ones in question were secure documents that shouldn't be released in the first place?
Beware of Sales Reps bearing gifts.
A color printer will print faint yellow dots for a water mark. Simply print the documents on yellow paper, then photocopy them on to white paper (and a low quality scan setting to be safe).
Back in the day typewriters were traced back because of manufacturing defects so the e may be typed 1/24th of an inch higher and 1/12th inch to the left.
A dot matrix printer could have pins that are in tolerance but have defects that could allow it to traced. The same with line impact printers.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
How can you call her a whistle blower? The value of the information to the American public was small or non-existent and it tipped off the Russian that we were on to them.
love is just extroverted narcissism
... use yellow paper?
There is no XUL, only WebExtensions...
It is much harder to prove authenticity in this case. Like rewriting the text by hand — it just is not as convincing.
That said, when it comes to accusing Trump, authenticity obviously yields to outrageousness in importance...
In Soviet Washington the swamp drains you.
Send it through an older fax machine. Bet Goodwill has one.
Every agency office should install a special "whistleblowers only" printer in a prominent location near the office entrance.
100% this. I am NOT a fan of Donald Trump and if he were impeached I'd be thrilled. I do think the Russians were involved on some level in the election and I do think there might have been some shady things going on with his staff.
But at the same time, she's leaking sensitive information that's not her place to decide on. It may be part of an ongoing investigation where we don't have all the facts yet, it may be enough to reveal a source or method, or it may have been disproved by new information she didn't have access to.
It wasn't her place to leak this. There is currently an ongoing investigation in congress. If she wanted to get this out, contact one of the progressives or anti-Trump Republicans on the committee, meet them in a SCIF, and tell them the information in a classified setting.
Leaking this doc doesn't help anyone. It doesn't help her cause... if anything, it hurts it, and it has the potential to hurt ongoing intelligence collection.
Don't use a color printer to leak shit.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
Who besides old geezers use printers anymore?
Convert the data to a textfile.
Use TOR at a Starbucks coffeeshop with a beard, sunglasses and a Trump hat and send the fucker to the New York Times Leaker page.
So what? As long as you can dumpster dive a bunch of them it shouldn't be an issue.
I still have an Epson FX-100.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Print on yellow paper.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
What you said hints at the big picture. Removing the means of identification would protect criminals, who are far more common than actual whistle blowers (of which Reality Winner is not). Forgery is just one crime, but there are a whole lot of other crimes where printer signature is significant. I'd argue that the majority of those happen to be white collar crimes.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Because the document is really nothing more than all the bogus stories that have been printed and reported since the election. There is no actual evidence of the claims they make, other than a possible IP address. Everything else is supposition based on "We know the Ruskies were in on it, somehow.".
If you think I voted for Trump because of this post, you're wrong. I voted for Dr. Jill Stein of the Green Party. Again.
Even dots that don't move betrays you, they are likely the serial number of the printer in question.
If you want to make a mess, then pick up discarded papers that has passed the printer before and run your print on them. It's not uncommon that some prints have waste blank pages included.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Look, just throw the stupid document on a copier and they're gone.
This isn't rocket science. What sort of a moron would print a document IN THE NSA and then hand that original to a reporter?
She needs to go to prison for the maximum span.
I personally believe Snowden should be pardoned, and they should stop pursuing Assange, but not every leak is sacrosanct, nor is every leaker a saint.
She clearly did this as a political act, despite signing documents affirming she would keep information confidential.
Basically, leaking info is like using a legally-carried handgun: you should do it only if you accept that the consequences of not using it are worse than the punishment you'll receive, and be perfectly ok with that result.
-Styopa
Contractors will always have a lot staff ready for any level of US security.
Look into the past of every staff member. Education, politics, languages, university, mil, gov, internet, protests, work, hobbies, interests.. walk the resume and interview everyone in person. Educators, friends. See what a person was like.
Learn from the issues the UK had from 1930-70's. Learn how the UK solved its internal security issues.
Learn why the USA was so good at security from the 1950's-80's.
Once a person has a job with security considerations keep on looking at their work and how they use the "internet", their politics, education, interests, hobbies, friends..
Keep looking, all year, every year.
Two contractors now working together is not a new security policy.
Create perfect bait projects and files just for staff given their politics, see if they respond.
Domestic spying is now "Benign Information Gathering"
The Ice Station Zebra option should add cartoons of Disney characters as faint yellow dots after stripping the original finger printing.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
> The value of the information to the American public was small or non-existent [...]
Because the up-to-now "theoretical" vulnerabilities of voting machines seem to have a "practical" side? That's uninteresting to the public?
It's clear that the staff at The Intercept are complete and utter imbeciles. It really seems that they didn't even know about the hidden printer dots which everyone (and I mean everyone) has known about for the last decades. Everyone at the Intercept should be fired and not ever work as a journalist again. This is just really really stupid. Even if you didn't know about the printer dots, sharing the documents with NSA is just mindboggling. Everyone should be fired.
Names are typically very representative of culture, in particular parents culture. In this case "Reality Winner" pretty directly points to `hippy idealist nutcase' culture. Mohammed is typically muslim, whilst something like Eriksen in the US would typically be Scandinavian and of a higher cultural educational level (not having changed their name to a local one as most US poor or low culture immigrants do) etc. If you select or avoid people according to their surname then that will lead to unreasonable discrimination which is why recruiting places in civilised countries often avoid showing the surname on CVs during recruitment.
In other words, in the grandparents terminology, names are a "discriminatory item", or in longer form, a piece of information which could be used for immoral (and probably illegal) descrimination and which you shouldn't take into account when recruiting.
How can you call her a whistle blower? The value of the information to the American public was small or non-existent and it tipped off the Russian that we were on to them.
Absolutely
The value of the leak is not in what it says, which any smart person probably assumed was happening anyway, but in that we knew it at all, which is to say the Russians now know that path has been detected where as before they did not.
There is one small thing which is that the Administration can not continue to deny the level of Russian interference with stuff like this out, but that's not really a bomb-shell because no one believed them anyway.
If you want news from today, you have to come back tomorrow.
by removing hidden dots left behind by laser printers, which are usually used to watermark documents and track down leakers,
This is incorrect. The purpose of the dots and why they are limited to color printouts is because they are intended to be used to identify currency counterfeiters.
1) They where originally designed to identify currency counterfeiters.
2) They are as well quite often used to track down leakers (both government and business).
If you want news from today, you have to come back tomorrow.
After "Darl McBride" of SCO infamy, "Oral Roberts" and so many more it's clear that weird names are just something people do in America.
Her actions in putting her own country before Russia should be considered before making fun of her name.
There's more news to come I'm sure - stay tuned for more Russian backchannel action.
No.
It tipped off the public.
The Russians appear to have already known and already put pressure on to stop the investigations.
More liberals making a mockery of themselves. Today's example: Publicly white-knighting for a treasonous cunt and advocating for better privacy protection for secure documents by making it easier to leak them to the press. And he STILL won't get any fucking pussy!
Film at 11, jerking off in their parents basement after coming home from the "security researcher" job at the uni. (Emptying bins in the security research lab I guess counts these days!)
Well...
Being an "Intel Specialist", if she was worth her salt, she could have simply memorized bits of the content over a few days and recreated it at the library in a text document.
Or, if she was inventive, she could simply have made it all up and created a realistic document. I'm surprised this doesn't happen more often, if you know the format it's very easy to create believable stuff, and the formats and classification markings are documented in publicly available government regulations / instructions as a matter of public record.
If you want news from today, you have to come back tomorrow.
It may be a stupid action, I have no idea, but when this material of national importance is being denied at the highest levels maybe it's time to get the word out and put the country first instead of the chain of command.
Those can't be used to print fake currency so the feature was never required.
Take off every 'sig' !!
You posted as AC, and you STILL said 'effin'. LOL
This is true. I often ignore posts from Anonymous Coward. It depends on how much time I have. If I don't have much time, I mentally filter them out. If I have time, I read them. Oftentimes, they don't say much that is worth my time. So, I sometimes miss out on good posts, but I consider it worth it.
"So long and thanks for all the fish."
Her parents called her Sara. She changed her name to "Reality"
It is ABSOLUTELY her place to decide on.
In fact, it's her DUTY to release information like this. It's the duty of ANYONE who has classified information to make the decision that the public needs to know, and if so to release it to the press.
Don't leak raw documents - digitize and run them though any OCR.
Don't trust The Intercept with your leaked documents--those fuckers will rat you out to the NSA.
Journalists have a moral responsibility to protect their sources when necessary, and The Intercept fails.
The Intercept wants everyone to know: "We won't break your story. We'll turn you in."
"It's definitely this Anonymous Coward guy. My store had a big sale on printers last week and he shows up at checkout with five of them. I told him there's a limit of two per customer because of the sale but he raised such a loud stink that we just let him buy all five at the sale price. I knew he was trouble."
When I was in high-school in the early 1980s, I had a few teachers who refused to accept term papers that came off a dot-matrix printer because as everyone should know, the quality of the content is far less important than the appearance. So, a couple of us nerds bought a nifty little gadget called a Dynatyper. http://www.computerhistory.org...
Problem solved.
But seriously, any parent that would name their kid "reality" a) has a screw loose and b) is setting the kid up to have a vastly over-inflated ego.
What of a person that prints with a pattern of dots that makes the watermark unreadable? I can envision someone creating a printer driver that does exactly this and release it on the internet. The government might try to arrest the people that did this and have them put in prison but once it is out there it can't be taken back.
This watermark scheme will be defeated. Recent events put a spotlight on them and so I expect a trivial means to circumvent it to be out in about... 5... 4... 3...
I am armed because I am free. I am free because I am armed.
Was not this in fact a plot point in some recent spy movies? I know fiction is not fact but if some filmmakers can figure this out then others can figure it out too.
I am armed because I am free. I am free because I am armed.
If all of that turns out to be true, we should question her sanity. What she did borders on treason, not whistle blowing.
"An F.B.I. affidavit said a visible crease mark on the file, a scan of which The Intercept provided to the government while trying to authenticate it, prompted investigators to surmise it was a printout. Audit trails showed six people had printed copies, but only one — Ms. Winner — had also used a work computer to exchange emails with The Intercept. A search warrant application said she had found the report by plugging keywords into the N.S.A.’s system that fell outside her normal work duties — and had printed no other files."
Source: https://www.nytimes.com/2017/06/06/us/politics/reality-leigh-winner-leak-nsa.html
Yes.
There have been a lot of denials of what her information claims to be true so she released it to citizens to deny official propaganda.
It's about putting country before King - something George Washington was keen on.
Actually no, it was your duty to vote and not mine. However you appear to be putting a Party ahead of your country - how Soviet of you!
Snowden and Manning leaked during the Obama administration, so it looks like I did do the same thing instead of your projected view of what you would do.
How can you call her a whistle blower? The value of the information to the American public was small or non-existent and it tipped off the Russian that we were on to them.
Without completely disagreeing with the first clause, I feel compelled to note that the Russians have been aware the US is on to them for some time. There's nothing in the publicly released parts of the analysis that they didn't know.
And the question of whether whistle-blowers can blow the same whistle twice is sufficiently abstruse that I feel it's safe to say that in the grander scheme of things, I don't give a flying fuck. She acted in the public interest and provided us with material that reinforced an admittedly already strong case that Russia was engaged in a concerted attempt to infiltrate American electoral systems.
She was also a whack job. These statements are not contradictory in any way.
Crumb's Corollary: Never bring a knife to a bun fight.
True, but here she made a stupid decision to leak information of little to no value. Russians running an unsuccessful phishing attack against a voting machine company isn't news, that's just Tuesday. If it were successful and being covered up, that would be different.
"When information is power, privacy is freedom" - Jah-Wren Ryel
This has nothing to do with the vulnerabilities of voting machines. This was an unsuccessful phishing attack against a company, which in terms of computer security newsworthiness ranks about the same as a port scan.
"When information is power, privacy is freedom" - Jah-Wren Ryel
This. I think the only surefire way to take care of these dots is to either reduce resolution to the point that they're unreadable, or to seek-and-destroy them by pasting over the entire pattern area with nearby colors wherever it occurs.
"When information is power, privacy is freedom" - Jah-Wren Ryel
The dots are inserted by the printer firmware, not the driver.
I don't doubt that but the driver can insert dots too. Unless the firmware is complex enough to see these dots and know enough to not print them then the driver can insert dots that can render the firmware inserted dots unreadable.
I am armed because I am free. I am free because I am armed.
There will be absolutely no information whatsoever released to the public from her trial. We have secret courts here in America, too.
Well how much of a good idea would it be, to base any possible protections for whistle blowers. If, Their status for being a WB was based on how effective they are.. It needs to be encouraged to release evidence of wrong doing.. But how is everyone supposed to judge what they do, based on how many people like what they say.. "Well I found evidence that my boss if cheating on his taxes, by only a half mil a year... Do I or don't I? Will anyone other than some paperless at the irs going to care?"
Lol, Hey at least you are sane about it.. Some just imitate a rabid skunk. when they see a post from AC. I just finds it a little funny how people argue about discrimination. Currently about if her name is bad for her.. All the while, How many people in here flat out refuse to read anything from AC?
Hmmm, that might just about be feasible. It'd interfere with readability, and not exactly be inconspicuous, but you could make occasional complaints about "the bloody printer is still spilling yellow toner" ... sort of workable. But ...
... not installable. Monitored computer on a secured commercial (let alone military or SpookTLA) network, you'll be prevented from installing random drivers from anywhere other than the IT department's update drive - where they vet what is available for installation pretty closely.
You can't consider any site anything like secure if the site induction doesn't include "here are your coveralls, there are the change cubicles, here is your polythene sealable bag for your personal goods ; get changed ; there are no pockets ; all your goods go into the bag, follow the instructions to seal. You'll be locking the bag into a locker in this building before we enter the secure site. Bring your ID card and fingerprints and nothing else (which is why there are no pockets). Anything less means that you actually trust the people you're using to some degree - which is a no-no in security.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"
Basically you are arguing that the release of classified information is up to the person handling it. Do you believe that a government should be able to have secrecy or not? It's as simple as that.
love is just extroverted narcissism
If you work for a government agency they should be able to detect installations. Which should result in an instant termination and a thorough investigation.
In addition, anybody who actually decides to learn about voting machines will learn about their insecurity and why many or most of them should never be used, without Winner's input.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Liberals defending treason and sedition, same shit different day.
Weird, I thought it was the conservatives who liked to tell everyone that the big bad government couldn't tell us what to think, that the feds and the spooks couldn't decide what was moral and the rest of us just had to fall in line. We are all endowed by our creator with reason, and above all, we are led, but not ruled.
Would you have said the same thing if there were "leaks" left-and-right by conservatives during the Obama administration?
I was absolutely fine with Snowden, the Ur-example others have used. I've no problems with the leaks exposing the drone programs and surveillance programs.
I'd just like to see an actual trial for this stupid cunt.
You sound like an extremely disgusting person. Do you talk like that to people in Real Life? Does it get you beaten up a lot?
The flat out denial of facts makes it pretty easy to spot the progressive/SJW/leftard/commie (all pretty interchangeable in the US at this point). Winner didn't try to use the chain of command to no avail, and leaked inconsequential information which at best could be used as "politically embarrassing" (according to even the far left media).
The only people applauding her are the same ones applauding all of the Stalinist tactics being used to smear the current President and his administration. More and more people are seeing those tactics for what they are, and see the useful idiots for who they are.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.