3 ms·

This is a pretty common method of watermarking sensitive content in EVE Online alliances, however we've found it suffers from some serious drawbacks. Zero-Widt

This is a pretty common method of watermarking sensitive content in EVE Online alliances, however we've found it suffers from some serious drawbacks. Zero-Width characters tend to cause lots of issues when they are copied and pasted, which may alert a poorly equipped adversary that they're handling watermarked content. In addition, entities that are aware that you're watermarking text content in this way can just take screenshots of the text, transcribe it, or strip it of all non-ASCII characters. The best solution I've seen is something I like to call "content transposition". The idea is that you take a paragraph of content and run it through a program that will reorder parts of content and inject/manipulate indefinite articles in order to create your watermark, while keeping the content grammatically correct. That way even if an adversary is fully aware that you're watermarking text content, they need two copies of the watermarked text in order to identify and strip your watermark.

CapacitorSet 9y ago
Do you happen to have a link to these "content transposition" tools?
- bsamuels 9y ago
  No, counter intelligence tools in EVE are a closely guarded commodity. The automatic ones I've seen leave a lot to be desired. There's one group that I'm nearly certain is running one that works well but I don't have evidence to back it up. One group decided that writing an automatic transposition program was too hard, and instead manually create transpositions for major posts. You can find the writeup here: http://failheap-challenge.com/showthread.php?16311-Taking-the-meta-seriously-(Part-deux)&p=1047855 http://failheap-challenge.com/showthread.php?16311-Taking-th...
  - maz- 9y ago
    We wrote automatic tools too ;) Some were identified and others... not
  - Rami114 9y ago
    I can't believe people still read that stuff I wrote :o
    - bsamuels 9y ago
      You're the only person who ever writes about exploiting people's CI tools, so I end up quoting your work a lot. Would love to see a swing taken at Pandemic Legion's new forum background watermark, it's a lot more interesting than the old one.
- 3131s 9y ago
  I was wondering that too, because even the example of adding / deleting indefinite articles and remaining grammatical would be very difficult.
lost_my_pwd 9y ago
That same type of "content transposition" tool would also be a way to ensure obfuscation of content source if applied to copied text.
reichardt 9y ago
What kind of content would be distribution that way? Something like battle plans send to individual members? Would they not be able to just snitch the important information without copying word for word the sensitive message?
- BinaryIdiot 9y ago
  It's a TON of data. When I was in an alliance during my EVE days we had TONS of "classified" information. It would consist of systems, contents within those systems, daily numbers for corp and alliance transactions, influx of cash, spies, plans, user information, capital and super capital ship information / plans; EVE is such a huge and complex game that many joke that it's a "second job". Well, that means they also have a TON of data that can be used by other corporations / alliances. Such an interesting game. I played for years and always want to go back.
- bsamuels 9y ago
  There's two kinds of text-based data that counter intelligence ops try to protect: Forum posts and 'fleet pings'. For forum posts, an adversary can do exactly what you say - just take the meaning of the forum post and write a cable on it. Fleet pings are how massive fleets are formed in EVE. Basically they are a @here ping on Discord, or a server announcement on XMPP or IRC. Fleet pings are important because if you know when your enemy is pinging for fleets, you know when and where to find their fleets to fight them. For that reason, the value in fleet pings is very time sensitive, and cannot be transcribed by a spy in real time. Usually orgs will set up a "ping relay" channel for its top fleet commanders, with a bot that relays pings from enemy alliances. This is a very common interception point for obtaining watermarked pings and burning spies.
rl3 9y ago
Almost a decade ago I wrote a tool to search forum dumps from various EVE Online alliances. The content was acquired by spies and often watermarked. The first barrier was that homoglyphs would inhibit text search, so I had to build an automated homogylph detection and substitution layer. Once homoglyphs were stripped, the challenge was then to fit the entire search corpus into memory, so I compressed each page with LZMA, loaded it into memory, and decompressed on the fly when searching—probably not optimal, but still way faster than loading from disk. I always wanted to try reverse engineering some of the watermarking systems so we could modify the watermarks on certain material, subtly leak it, and effectively frame adversaries while protecting our own spies in the process. Fortunately or unfortunately I never got around to that.
joshstrange 9y ago
I know there is no way I have the time or energy to play EVE but it is the most fascinating game (MMO) that I have ever seen. The writeups on it are so fascinating.

CapacitorSet 9y ago

Do you happen to have a link to these "content transposition" tools?

bsamuels 9y ago
No, counter intelligence tools in EVE are a closely guarded commodity. The automatic ones I've seen leave a lot to be desired. There's one group that I'm nearly certain is running one that works well but I don't have evidence to back it up. One group decided that writing an automatic transposition program was too hard, and instead manually create transpositions for major posts. You can find the writeup here: http://failheap-challenge.com/showthread.php?16311-Taking-the-meta-seriously-(Part-deux)&p=1047855 http://failheap-challenge.com/showthread.php?16311-Taking-th...
- maz- 9y ago
  We wrote automatic tools too ;) Some were identified and others... not
- Rami114 9y ago
  I can't believe people still read that stuff I wrote :o
  - bsamuels 9y ago
    You're the only person who ever writes about exploiting people's CI tools, so I end up quoting your work a lot. Would love to see a swing taken at Pandemic Legion's new forum background watermark, it's a lot more interesting than the old one.
3131s 9y ago
I was wondering that too, because even the example of adding / deleting indefinite articles and remaining grammatical would be very difficult.

lost_my_pwd 9y ago

That same type of "content transposition" tool would also be a way to ensure obfuscation of content source if applied to copied text.

reichardt 9y ago

What kind of content would be distribution that way? Something like battle plans send to individual members? Would they not be able to just snitch the important information without copying word for word the sensitive message?

BinaryIdiot 9y ago
It's a TON of data. When I was in an alliance during my EVE days we had TONS of "classified" information. It would consist of systems, contents within those systems, daily numbers for corp and alliance transactions, influx of cash, spies, plans, user information, capital and super capital ship information / plans; EVE is such a huge and complex game that many joke that it's a "second job". Well, that means they also have a TON of data that can be used by other corporations / alliances. Such an interesting game. I played for years and always want to go back.
bsamuels 9y ago
There's two kinds of text-based data that counter intelligence ops try to protect: Forum posts and 'fleet pings'. For forum posts, an adversary can do exactly what you say - just take the meaning of the forum post and write a cable on it. Fleet pings are how massive fleets are formed in EVE. Basically they are a @here ping on Discord, or a server announcement on XMPP or IRC. Fleet pings are important because if you know when your enemy is pinging for fleets, you know when and where to find their fleets to fight them. For that reason, the value in fleet pings is very time sensitive, and cannot be transcribed by a spy in real time. Usually orgs will set up a "ping relay" channel for its top fleet commanders, with a bot that relays pings from enemy alliances. This is a very common interception point for obtaining watermarked pings and burning spies.

rl3 9y ago

Almost a decade ago I wrote a tool to search forum dumps from various EVE Online alliances. The content was acquired by spies and often watermarked. The first barrier was that homoglyphs would inhibit text search, so I had to build an automated homogylph detection and substitution layer. Once homoglyphs were stripped, the challenge was then to fit the entire search corpus into memory, so I compressed each page with LZMA, loaded it into memory, and decompressed on the fly when searching—probably not optimal, but still way faster than loading from disk. I always wanted to try reverse engineering some of the watermarking systems so we could modify the watermarks on certain material, subtly leak it, and effectively frame adversaries while protecting our own spies in the process. Fortunately or unfortunately I never got around to that.

joshstrange 9y ago

I know there is no way I have the time or energy to play EVE but it is the most fascinating game (MMO) that I have ever seen. The writeups on it are so fascinating.