13 ms·
Tracking leaks on NDA beta Xbox 360s by embedding serial number on-screen
- bovermyer 8y agoOK, that's actually pretty cool.
- deleted 8y ago[deleted]
- ux 8y agoThis reminds me of https://www.ghacks.net/2012/09/12/blizzard-watermarking-wow-screenshots/ https://www.ghacks.net/2012/09/12/blizzard-watermarking-wow-...
- dfxm12 8y agoI suppose this is a perfectly cromulent use of "security through obscurity", and an excellent example of steganography. I wonder if anyone thought about those rings or ever noticed they were different machine to machine.
- Someone1234 8y agoOn a related topic, it would be fun to embed the EURion constellation[0] into random things just so it results in difficult to trace side-effects. For example wear a t-shirt with it printed on, if someone tried to edit CCTV footage or a photo of you, it might error out. [0] https://en.wikipedia.org/wiki/EURion_constellation https://en.wikipedia.org/wiki/EURion_constellation
- dsl 8y agoEURion only works on flat services (photocopiers and scanners). Photoshop detects currency based on a Digimarc watermark, which you can't generate without paying a licensing fee.
- wolfgke 8y ago> Photoshop detects currency based on a Digimarc watermark, which you can't generate without paying a licensing fee. Sounds like a challenge for hackers. :-)
- userbinator 8y agoI'm sure at least one person in the world has reverse-engineered the algorithm, and it might be quite simple, but the legal implications prevent its publication. If anything, it would be more likely to be on the dark web.
- deleted 8y ago[deleted]
- weinzierl 8y ago> Photoshop detects currency based on a Digimarc watermark, which you can't generate without paying a licensing fee. You can't generate your own without paying a licensing fee. Nothing[§] prevents you from extracting existing watermarks and applying them to other things. This is called a copy attack. There are mitigations[1] but I believe they are not practical for banknotes. I've been told by a Digimarc representative in private conversation about the mentioned paper, that "The Digimarc for Images solution does not utilize the exact functionality described in the paper [..]". This was in 2011, I don't know if things have changed. [§] Ok, nothing technical at least; legally it's a different matter... [1] https://www.digimarc.com/docs/default-source/technology-resources/published-technical-papers/commercial-applications/dmrc_image_signatures.pdf https://www.digimarc.com/docs/default-source/technology-reso...
- dsl 8y agoThe current research in to the Digimarc currency watermark has determined an absolute minimal test case [1], however no one has discovered the exact watermarking mechanism. I was speaking in absolutes because we can't do a copy attack without knowing what features to extract. Someone has enumerated all the detected regions on the 20 pound note [2] if you'd like to take a stab at it! 1. https://murdoch.is/projects/currency/cropped.png https://murdoch.is/projects/currency/cropped.png 2. https://murdoch.is/projects/currency/small_crops.png https://murdoch.is/projects/currency/small_crops.png
- tgsovlerkhgsel 8y agoThe EURion is only what outdated software uses; there's a new scheme based on invisible digital watermarking.
- qubex 8y agoI first thought of that after I read Gibson’s Spook Country. Never tried it out though.
- emilfihlman 8y agoThis is super dystopian.
- dymk 8y agoUh, how so?
- lozf 8y agoI saw these a while ago: https://www.zazzle.com/eurion_constellation_t_shirt-235509764478000766 https://www.zazzle.com/eurion_constellation_t_shirt-23550976...
- deleted 8y ago[deleted]
- jjulius 8y ago>... cromulent... This really embiggened my morning.
- wlesieutre 8y agoNot as subtle, but Star Citizen's NDA test servers have hidden watermarks to track where screenshots come from. Someone pulled up the edges to show one here: https://i.imgur.com/FXzwlYd.png https://i.imgur.com/FXzwlYd.png You still get leaks because people take screenshots for their bug reports, upload them somewhere (even with an unlisted URL) for discussion on the bug reports forum, and then other users under the same NDA can download your screenshots and share them (rather than getting busted for leaking their own). So having a screenshot from a bug report leak isn't necessarily actionable for banning people. But it's still useful to prevent, say, users under NDA streaming the super buggy builds on Twitch. Once they're relatively stable, CIG drops the NDA requirement, opens testing to a wider audience, then eventually push out to the main servers. Doing this with a disguised UI component is a pretty cute implementation.
- piyh 8y agoWhat do you mean by pulled up the edges?
- vahji 8y agoI guess https://en.wikipedia.org/wiki/Edge_detection https://en.wikipedia.org/wiki/Edge_detection ?
- anotheryou 8y agophotoshop -> filters -> find edges -> some tweaking of the tone curve
- wlesieutre 8y agoI was being deliberately vague because I don't know exactly how the person who made the example processed it, but it's probably this. Find Edges and then maybe something else to clean it up or make the text stand out.
- anotheryou 8y agoI was curious and tried to reproduce it from other screenshots :) https://i.imgur.com/FBfwoLR.png https://i.imgur.com/FBfwoLR.png
- deleted 8y ago[deleted]
- rixrax 8y agoJust as a thought experiment - what if they actually never implemented this. But now through this announcement, everyone will think twice before leaking BETA etc. program screenshots and second guess which UI elements might be the ones that are used to identify them. ;-) That said, excellent example of steganography as pointed out by others too! Thumbs up!
- cududa 8y agoActually that was a trick they used in Windows 8 betas. They put a weird puzzle watfermark on it, except they were all exactly the same! However I guarantee this was real, but hasn’t been a part of the Xbox experience for yearrrs
- withinrafael 8y agoHow do you guarantee this, Cullen?
- cududa 8y agoBecause Steven has literally talked about this on Twitter.
- withinrafael 8y agoYou guaranteed the Xbox tracking, so I was referring to that. Not the puzzle.
- cortesoft 8y agoIsn’t his guarantee based on the fact that he was the one who did it?
- jmkni 8y agoThat's neat. Lots of broadcasters do something similar (display a number on the screen) when they are broadcasting sports events etc to detect streaming. I'd love to know how that works. Presumably they broadcast the same thing to everybody, so is it actually the box/receiver which adds the number to the screen? Does everybody get a unique number, or do groups of people get the same one?
- detaro 8y agoHere's some marketing materials from a company selling this: https://dtv.nagra.com/watermarking https://dtv.nagra.com/watermarking - seems like yes, one option is software in the receiver.
- nickysielicki 8y agoIf anyone is interested in getting an in-depth look at how satellite TV boxes work, this 33c3 talk is awesome: https://youtu.be/ex_dEEh4dl0 https://youtu.be/ex_dEEh4dl0
- corint 8y agoFor Sky TV in the UK, the Sky TV satellite boxes occasionally display the subscriber number in a faint font just above the channel logo in the top-right. If you've simply hooked up the satellite decoder to a video capture device with a view to streaming sports content, then your subscriber number just gets occasionally shown on the stream too. So no doubt there's a specific "when" for the subscriber number being shown, and it's a case of finding & watching as many streams as possible to see how many of them feature the subscriber number. Gotcha!
- davb 8y agoBT TV do it with a base64-encoded subscriber account ID on the top right (easily recognisable due to the '=' padding characters).
- Maxious 8y agoApparently state level actors can defeat the watermarking... > “There’s nothing else like it in the world,” Esteban Israel, beIN’s executive director of technology, said of beoutQ’s level of sophistication. “We work with all the top technology vendors, technology developers. We have our experts, we deploy state of the art technologies and we have not seen this anywhere else.” https://www.nytimes.com/2018/05/09/sports/bein-sports-qatar-beoutq.html?smid=matthewkeyslive https://www.nytimes.com/2018/05/09/sports/bein-sports-qatar-...
- boingy 8y agothey also used a 'zebra' skin on prototype Xbox One consoles to be able to find people who leaked images of the physical console: https://www.thetechgame.com/News/sid=8160/photos-of-an-xbox-one-zebra-prototype.html https://www.thetechgame.com/News/sid=8160/photos-of-an-xbox-... Xbox have a reputation for watermarking things to a large extent to deter leakers. The first ever footage of Halo 4 Multiplayer came courtesy of someone recording it from a terrible camera, played on a CRT television, from a VHS recording, while in a barn. I would link it but it also has obnoxiously loud music playing over the top of it but if you search 'halo 4 barn leak' you will be able to find it. Admittedly I'm sure whoever leaked that went a bit too far for comedic effect
- kweks 8y agoZebra skins are also used on prototype cars / unreleased cars - not for traceability, but to obscure their form - very similar to the technique used in WW2 battleships. https://en.m.wikipedia.org/wiki/Dazzle_camouflage https://en.m.wikipedia.org/wiki/Dazzle_camouflage https://encrypted-tbn0.gstatic.com/images?q=tbn%3AANd9GcTv1xOaFzir591tHFQeq03b4W35rdvZaV8i0WuD8GOcE5PuA_eX https://encrypted-tbn0.gstatic.com/images?q=tbn%3AANd9GcTv1x...
- robin_reala 8y agoDazzle camo was more of a WW1 thing.
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- kweks 8y agoThanks for the clarification. I noticed that the Swedish navy still seems to use it ? https://www-thelocal-se.cdn.ampproject.org/ii/w1000/s/www.thelocal.se/userdata/images/article/f135320fc79a7c11e4c2442cd0e02113639cbaf6322a4eb4bf143bdd85ca8449.jpg https://www-thelocal-se.cdn.ampproject.org/ii/w1000/s/www.th...
- ocdtrekkie 8y agoAs someone who's been on a few NDA'd betas before... I just don't understand why people leak. Is it the feeling they can break the rules without likely facing truly serious repercussions? (Has anyone ever gone to jail or even been seriously fined for violating a video game NDA?) Is it the notoriety of it? I mean, I won't deny there was a fun factor to having a New York Times reporter beg me to violate a Google NDA once. But even then, I had more fun knowing something the New York Times didn't than breaking my agreement, ruining my personal reputation/credibility as a trustworthy individual, etc. And generally if I have access to these sorts of things, I'm enthusiastic about what the company is doing, and the last thing I'd want to do is sabotage them.
- zamalek 8y agoIt either comes down to personal philosophy (such as freedom of information), or fake internet points (or fake internet fame).
- shittyadmin 8y agoOr cash, don't forget cash.
- strig 8y agoDon't forget good old ignorance either.
- woodrowbarlow 8y agowere you offered compensation for breaking your NDA? because i always assumed that's the reason people leak -- to get one last payday before being blackballed.
- ocdtrekkie 8y agoNo, I was not. But I doubt that would've impacted my decision... At the time, I viewed any sort of involvement with a Google project as a valuable career/networking opportunity.
- iamben 8y agoAlways amused me: Sky used to use a pint glass on subscription sports package for pubs/bars. But some sneaky publicans were sticking pint glass stickers to the corner of their screens to fool inspectors... So now the glass has a different filling depending on the day.
- lostlogin 8y agoExcellent. Couldn’t sky just check what subscription a venue had?
- djaychela 8y agoIirc there was a bounty for reporting an improperly licenced bar.
- blowski 8y agoA lot of pubs are very close to residential addresses, so the house next door gets Sky and runs a cable through to the pub.
- gsnedders 8y agoPlenty of older pubs had/have landlords living on the premises; a residential license is perfectly justifiable provided it's only for their personal use.
- dylan604 8y ago"Hey, why are all of these people in my house watching this game? I never noticed because I was so into the action." Not really sure that would fly.
- shawnz 8y agoRight, but rather than going in to the pub and looking at the watermark, why not just check if that pub pays for the proper service by looking up their address in the customer files?
- 8y ago
- deogeo 8y agoRelated - printer dots: https://en.wikipedia.org/wiki/Machine_Identification_Code https://en.wikipedia.org/wiki/Machine_Identification_Code Great tool to crack down on any clandestine poster campaigns.
- detaro 8y agoPossibly also helped to find NSA leaker Reality Winner, after the Intercept published good-quality scans of documents she'd printed at work: https://en.wikipedia.org/wiki/Reality_Winner#Intelligence_report_leak,_arrest_and_sentencing https://en.wikipedia.org/wiki/Reality_Winner#Intelligence_re...
- blattimwind 8y agoYeah that was a real amateur hour.
- flukus 8y agoConversely, wouldn't this make it incredibly easy to frame someone?
- ghostly_s 8y ago'clandestine poster campaigns'?
- deogeo 8y agoAnonymous speech. It has innumerable uses that are beneficial to society, e.g.: -Promoting unions without getting blacklisted by employers (possibly with the help of state security agencies, see https://www.bbc.com/news/uk-43507728 https://www.bbc.com/news/uk-43507728 ) -Shedding light on animal abuse in light of Ag-gag laws -Giving instructions on how to break DRM (DeCSS) -Revealing local corruption (e.g. in the police department or public office) without exposing yourself to retribution or crippling libel lawsuits -Campaigning for Catalonian independence -Etc..
- 8y ago
- JCharante 8y agoI'm surprised that so many people are surprised that this was a thing. Ever since I learned that tracking information is present but hidden in an Eve Online alliance's forum[0] for tracking down leakers, I've assumed that anything serious inside or especially outside a video game would have the same resources allocated. [0] https://www.reddit.com/r/Eve/comments/1ftvub/pl_forum_watermarking_unmasked_and_explained/ https://www.reddit.com/r/Eve/comments/1ftvub/pl_forum_waterm...
- 15155 8y agoFormer EVE player (Nulli Secunda) and long-time software engineer. I saw this way back when and now assume any kind of NDA'd or questionable text has uniquely-identifiable unicode replacement character sequences and invisible watermarks. It's just too easy to do.
- Moru 8y agoOld lexicons had misspelled words put in to catch the copycats. Since they don't have to prove who did the copying it's easy, they just have to prove that the copy is from them. We do something similar to our stuff. No need to prove who did the copying as they publish the stuff on their app/homepage and have exactly the same spelling mistakes as our homepage displays to the ip-numbers we know they are using for harvesting. Document all and send to the lawyers.
- AgentME 8y agoSince people were able to figure that out, then people could use that knowledge to create fake watermarks that decode to other people. If someone in the alliance wanted to frame another person in the alliance as a leaker, then they could do it easily with this knowledge. People that make systems like this should make sure the hidden value is signed or encrypted in a way using a hidden key so that people can't make fake watermarks for other users.
- cbanek 8y ago"You're giving away all our best tricks" - Wargames. It's true. And boy did it surprise those leakers who wanted to show off the fancy new UI and the new avatars.
- cududa 8y agoHell it surprised half the people internally that got fired using this
- cbanek 8y agoWell probably all of them - otherwise they would have done it differently! :)
- com2kid 8y agoWindows Mobile, pre-Windows Phone 7, used to leak builds almost daily, despite signing procedures being in place. There were rumors that Windows Phone 7 started embedding IDs in the builds. The leaks stopped pretty quickly.
- withinrafael 8y ago[Edit: Removed all commentary. I'm getting penalized for discourse around an unvalidated claim. I don't want to further affect my standing in the Hacker News community.]
- cududa 8y agoHello Raf. Someone in the comments below confirmed it, as well as on twitter :-) As a side note, I don’t see why after not having any substantial interaction in nearly a decade you continue to see the need to follow me around and harass me.
- deleted 8y ago[deleted]
- untog 8y agoThis seems like a particularly strange personal attack. Why make it?
- deleted 8y ago[deleted]
- ct0 8y agoWhat is the relationship to the link you posted? The demo was.... interesting
- cududa 8y agoAn embarrassing moment from when I was 19 that Raf likes to reply to things as a slight jab. And just for reference, a former Xbox employee confirming https://news.ycombinator.com/item?id=18650000 https://news.ycombinator.com/item?id=18650000
- RyJones 8y agoI'm glad the embarrassing stuff I did at age 19 isn't out there. RAF: people grow and change.
- Impossible 8y agoI've worked on AAA games that have had similar watermarks to catch leak sources.
- reaperducer 8y agoMovie companies have done this for a long time. I was friends with a movie critic back in VHS days, and the films sent to him to review before their release had a warning and an ID number that popped up every five minutes or so. Strangely, not every film company did it. And it wasn't limited to just the big movie companies. It seemed pretty random. Maybe because a shotgun approach was cheaper.
- dylan604 8y agoThere's also a forensic watermarking technique used that is invisible to the viewer. It is supposed to survive any kind of transcoding and scaling that might occur. I can't remember the name of it, but we would use it to encode videotape masters as well as for DVD/Blu-ray encodes. Very popular for use in Academy screeners.
- ghostly_s 8y agoEvery new watermarking technique they come up with is discovered and obscured within days each year by the screener leak community. I think it's kind of a sport for them at this point.
- baroffoos 8y agoIf you have 2 leakers they can just run a tool to compare the difference between the file and spot any watermarks. Of course the next level is making the watermark so there is a bit that is unique to 2 users only so you will then know the exact 2 who leaked it.
- crazysim 8y agoPretty sure they’ll just start bisecting the screener population down.
- stordoff 8y agoYou're possibly thinking of Cinavia, or something similar: https://en.wikipedia.org/wiki/Cinavia https://en.wikipedia.org/wiki/Cinavia
- michaelbuckbee 8y agoI met a dev who worked at Paypal that was pushing to steganographically add the IP address of the request client to the Paypal logo on every page load. The reasoning being that you could then look at any phishing/scam site that included the logo and find the IP of the perpetrator (presuming a bunch of other things).
- btown 8y agoWhile this might catch some folks, many phishing/scam sites can route their requests through residential proxy networks. There are plenty of legitimate networks (e.g. ones that use free VPN offerings as a way to route traffic through your IP) with minimal KYC, and even more illegitimate ones based on botnets. This seems like a lot of engineering for a mitigation that’s easily worked around.
- avar 8y agoRelated: Anyone else noticed how Google Maps is now doing more subtle watermarking where they embed their logo into Street View images using machine learning, e.g. here: https://imgur.com/a/0T8wP2u https://imgur.com/a/0T8wP2u URL: https://www.google.com/maps/@52.3730304,4.8793692,3a,68y,194.22h,83.04t/data=!3m6!1e1!3m4!1s4WICi0WcvZTyKwm8wM3brw!2e0!7i16384!8i8192 https://www.google.com/maps/@52.3730304,4.8793692,3a,68y,194... Edit: Look a the yellow area above the door obscured by the Land Rover. They embedded their logo along the shape & size of an appropriately sized feature on the building, as opposed to somewhere randomly where it would be more visible as it crosses e.g. the boundary between a building and a tree. When I first spotted this I thought Google's logo was actually on that building, but it disappears as you zoom in/out.
- eridius 8y agoI can’t figure out what I’m supposed to be looking for in that image.
- cbg0 8y agoThere's also another Google text to the right of the rear wheel.
- klodolph 8y agoI think that's the point. It's hard to see, on purpose. Behind the land rover, there is a door with a balcony above it. Just below the balcony, but almost touching the balcony, is "Google". It took me a while to find.
- hiccuphippo 8y agoI didn't noticed it in the imgur link, the image was probably compressed. You can see it in the google maps link.
- eridius 8y agoNow that I know what to look for, I can see it in your imgur image, but I don't actually see it on the live Google Maps link. I do se a small one overlapping the steering wheel on the car, which doesn't appear to be particularly smart placement.
- rasz 8y agoYour (legally purchased/streamed) music is most likely also fingerprinted in a way degrading its fidelity https://en.wikipedia.org/wiki/Master_Quality_Authenticated https://en.wikipedia.org/wiki/Master_Quality_Authenticated
- pragmatick 8y agoI might be too dumb to use twitter but where does he actually explain what he did? I only see a screenshot and reaction gifs
- pragmatick 8y agoTurns out, yes, I'm dumb.