13 ms·
Police claims to have fingerprinted computer based on printed document
- bryanrasmussen 4y agoNorwegian - google translate to English https://www-nrk-no.translate.goog/norge/nye-opplysninger-om-trusselbrevet-i-forsvinningssaken_-_-vet-vi-sa-a-si-alt-om-dette-dokumentet-1.15965322?_x_tr_sl=no&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp https://www-nrk-no.translate.goog/norge/nye-opplysninger-om-...
- smilespray 4y agoMost of these forensic findings use publicly known techniques. What does intrigue me is how they managed to determine the graphics card. Anyone?
- tpmx 4y agoIt's odd. If it was from microdots they should know a lot more than about the printer than "most likely an HP inkjet".
- rob74 4y agoOr they do know more, but they're not releasing everything? The details they have published are not that useful in pinpointing a suspect - I mean, there are probably thousands of Norwegians who have a PC/laptop with Intel integrated graphics, Windows 8/10, an HP printer and who buy paper and envelopes from Clas Ohlson (a chain with over 200 stores).
- dontlaugh 4y agoIf they knew both, it would be odd to say an exact GPU model but not a printer model.
- vintermann 4y agoThousands are not that many. There's going to be a lot of people you can exclude from a crypto currency ransom/murder case planned at least 6 months in advance.
- sim7c00 4y agothere's a lot of techniques used in such research which is not 'public knowledge' (even though a lot of techies might know them). Hence, information might purposfully be a bit vague, to give the idea they did not reach certain conclusions. I'd expect they would, as you, know the exact model and make of the printer if it was microdots. They can also have libraries of things printed with lots of printers to analyse the quality of print etc., and then get an estimate for example by a neural network examining artefacts. in such a case, it would never be 100% certain, but maybe 95-99% range somewhere if they do it good. I can _imagine_ such techniques might even also get to the point where they can somewhat certainly identify other aspects of the pc like graphics cards, even though they don't know exactly how the network will draw these conclusions.
- phire 4y agoIt could theoretically effect font rendering, but I really doubt it. It's more likely the printer driver have encoded information about the gpu into the yellow microdots [1] that many color printers use to trace pages. But if they have microdots, then they really should have more information. [1] https://en.wikipedia.org/wiki/Machine_Identification_Code https://en.wikipedia.org/wiki/Machine_Identification_Code
- cm2187 4y agoWhat about B&W laser printers?
- phire 4y agoThey typically don't do watermarking. The whole justification was stopping the counterfitting of currency, since color printers can produce quite good results for near zero effort. And you can't really use a b&w laser to print convincing notes.
- lupire 4y agoBut now the gov wants to spy more, so they should have light grey tracking dots.
- deleted 4y ago[deleted]
- codedokode 4y agoThey can use black microdots, I guess? Or some kind of stenography in the printed image.
- hoistbypetard 4y ago> What does intrigue me is how they managed to determine the graphics card. Cheap GDI printers use the PC for rendering. I find it a bit surprising that would give enough to identify a specific card from a printed sample, but it certainly seems plausible.
- kuroguro 4y agoThere's quite a few papers on browser fingerprinting via canvas / webgl, I assume it's similar. Here's one talking about (among other things) fonts and GPU detection: https://hovav.net/ucsd/dist/canvas.pdf https://hovav.net/ucsd/dist/canvas.pdf
- 1970-01-01 4y agoPCL6 and WYSIWYG is my guess. https://support.hp.com/us-en/document/c00068221#AbT3 https://support.hp.com/us-en/document/c00068221#AbT3
- shakna 4y agoI assume a lot of that information comes from the Machine Identification Code [0], the "yellow dots" emitted by almost all printers. There's a number of encoding schemes [1], though most of those only identify the printer - they don't go far enough to identify the graphics card or OS where it originated. That's a new capability - if it's being accurately relayed here. [0] https://en.m.wikipedia.org/wiki/Machine_Identification_Code https://en.m.wikipedia.org/wiki/Machine_Identification_Code [1] https://dl.acm.org/doi/10.1145/3206004.3206019 https://dl.acm.org/doi/10.1145/3206004.3206019
- rospaya 4y ago> emitted by almost all printers I believe it's only by some copiers and laser printers, not inkjets for example.
- einr 4y agoIndeed if they had the identification code they would have been able to pinpoint the model and serial number of the printer, but they haven't released that information -- only that it is a HP printer with HP 302 or 304 model ink cartridges, which I assume is based on analysis of the chemical composition of the ink.
- dhosek 4y agoThey also say, “Ink cartridge type HP 302 or HP 304 color cartridges are used.” [italics mine]. In that case, they may have the yellow watermark and just aren’t saying so.
- jcrawfordor 4y agoTo my knowledge only laser printers participate in the MIC scheme. While the boundaries of the program are somewhat unknown, just from a technical perspective inkjets generally struggle to produce low enough coverage for the marks to not be pretty visible to the eye (bleed of inkjet inks prevents high-pitch halftoning performed by laser printers to produce very low coverage).
- xattt 4y agoAll the other details are fairly straightforward (toner, envelope, paper, etc) that can be nailed down with enough legwork, but I am wondering how they possibly had figured out the GPU of machine. - Are there certain rendering artifacts that can be seen on printed glyphs that give clues to the GPU? - Or, are they going by heuristics here? (I.e. it was XYZ GPU, because it was a common machine that at the time that would be running Win 8 or 10)
- shakna 4y ago> Are there certain rendering artifacts that can be seen on printed glyphs that give clues to the GPU? Most printers will do their own rendering, it's not often that a text document gets pre-rendered by the OS. If it was printed straight from WordPad without being converted to an image, there's no artefact from the host OS, there.
- hoistbypetard 4y ago> Most printers will do their own rendering, it's not often that a text document gets pre-rendered by the OS. Without surveying the industry, I doubt that's accurate. Most inexpensive home printers sold to purchasers of Windows PCs are GDI printers. Part of the cost savings associated with those comes from using the PC to render the document.
- formerly_proven 4y agoThis is an ongoing investigation, the police don't have to be truthful in their releases. It might be a guess, it might be because they're already fairly sure who did it or is an accomplice and want to create pressure. They might know it for entirely different reasons than analyzing a piece of paper.
- pilsetnieks 4y agoIt's Norwegian police, though, so they might be held to higher standards of accountability.
- Someone 4y agoMost interesting parts (IMO): “Program and program settings: When preparing the letter, WordPad for Windows is most likely used. Default settings for font, line spacing and paragraph are used. The page layout has been Letter.” That, I think, can be inferred with good confidence from precisely measuring various font measurements, looking at how lines got broken, etc, and comparing that with a database of program defaults for a large set of OSes and programs. “Device, operating system and video card : When designing the threat letter, a Windows PC has been used, with an operating system Windows 10 or 8.” I guess either WordPad or the font got tweaked somewhat in that Windows version. Maybe WordPad started using ligatures more aggressively, its page width got a tiny bit wider, or, in the font, some letter shape or spacing table changed a tiny bit, or a character was added. “The PC has had an integrated video card, Intel HD Graphics 630.” That, for me, is the most intriguing part. Does Windows use the GPU to render fonts even if they get printed, and are there subtle differences between GPUs and their software rendering that, statistically, can be recovered from the somewhat noisy print?
- mjbeswick 4y agoMaybe most of this profile is pure speculation based statical probability?
- Someone 4y agoIn the end, it’s statistics, yes. Maybe, a Mac running a windows VM could produce similar output, or somebody could run Linux, copy over the specific fonts from Windows 8, tweak font rendering to match Windows (e.g. in when to use type hints), fiddle with line spacing and page width until their LibreOffice or abiword produces the same line breaks and spacing, etc, but that somebody would try to do that is quite unlikely to start with and also may be very hard to accomplish (and that’s something experts could have tried to do. If so, they could testify about the difficulty of pulling it off) ⇒ I don’t think it’s fair to call this speculation, let alone pure speculation.
- rmbyrro 4y agoThis is unrealiable and extremely risky to serve as case evidence. Becomes extremely easy for malicious actors (out or inside the police) to fake evidence and frame anyone they'd like.
- sundvor 4y agoThis reads so much like Lee Child's Without Fail / Jack Reacher (2008) - which I'm currently re-reading. Analysing a printed threat: ‘It’s a Hewlett-Packard laser. They can tell by the toner chemistry. Can’t tell which model, because all their black-and-white lasers use the same basic toner powder. The typeface is Times New Roman, from Microsoft Works 4.5 for Windows 95, fourteen point, printed bold.’ ’Typefaces tend to change very subtly between different word processors. The software writers fiddle with the kerning, which is the spacing between individual letters, as opposed to the spacing between words. If you look long enough, you can kind of sense it. Then you can measure it and identify the program. ...’ (Edit: Limited the amount of quoted text a bit; I believe a few lines is fine/fair use. Loving the series re-read after the TV show, and that I bought them on Kindle originally!).
- jimcsharp 4y agoI wonder how many writers write about word processors when they get writer's block. A bit like devs making dev tools.
- greggsy 4y agoOr William S. Burrows creating a fantasies around his Clark Nova typewriter in Naked Lunch.
- quickthrower2 4y agoLike the blog post about why I switched from Jekyll to Hugo
- boomboomsubban 4y agoI somewhat wonder if this is a non-story and they concluded that the note was printed inside the house. Or they have a suspect in mind and they want someone close to them to call in that their computing is suspicious.
- dmix 4y agoThey might just be trying to convince the public they are trying hard or maybe a cop bragged too much to a journo which is more likely.
- chiefalchemist 4y agoMy assumption - unfounded? paranoid? - is that: 1) Printers leave a unique "invisible" watermark; similar to the way you can hide an image within an image. The naked eye can see it, but it's there. 2) Aside from that the printer itself has a unique fingerprint, similar to how keyboards do (i.e., AI can pick the difference in the sound of each key and with that audio can translate your typing into letters / words). 3) Networked printers phone home; with snippets. Again, similar to the way some smart TVs send screenshots. Perhaps not every printer does all of the above, and some not at all, but enough do or might. Finally, law enforcement explanations like the article's to me are suspect. For example, how often do we hear that a random-y car stop led to a sizable drug bust? So of all the thousands of car going up Rt 95 the police randomly picked one with loads of drugs? What are the odds? Moral of the story, if (federal) law enforcement has "insider information" they're not going to share that with the public.
- InCityDreams 4y ago>Moral of the story, if (federal) law enforcement has "insider information" they're not going to share that with the public. I agree: all I've learned is to make a doc on my oldest laptop, multi-paged and-fonted, have it printed at different public (paid or library) sources and then cobble them together and post them from a random place (not taking my phone there, either). From what I've anec-heard, those 'rando' car stop/ mega busts are politely arranged so the cops get their bust, but the real mega-shipments sail on by, untouched. Everybody gets a payday, even the Prison system! *the captured mules get to live rent free for a whilem so there's that, for them.
- ComputerGuru 4y ago> have it printed at different public (paid or library) sources and then cobble them together That feels like it exposes your attack surface enormously! More witnesses, more cameras, more data to cross reference, etc. Buy a cheap laptop and printer at Goodwill or a garage sale, print, destroy them, then mail your manifesto or whatever.
- 4y ago
- DevX101 4y agoPolice have been doing this since the days of typewriters. If you're a whistleblower with sensitive information, assume your printing device has a unique identifier. This is how Reality Winner was caught, when she leaked info about Russian interference in US elections. If you're in a highly secure environment, it's even possible the content itself may be a unique identifier. I could imagine a sensitive document having grammatical alterations unique to each recipient. Journalists should consider this before publishing unredacted copies of leaked documents.
- hutzlibu 4y ago"Police have been doing this since the days of typewriters." Well, that the typewriters and today the printers are unique, sure. But here they seem to claim(I do not speak the articles language) that they could identify the computer that send the document. Which is a very bold and new claim, I think.
- treesknees 4y agoZoom does something like this. They'll embed unique information into the meeting and meeting audio. I've also heard that the arrangement of the participants can also be a watermark but I don't have a source for that. https://theintercept.com/2021/01/18/leak-zoom-meeting/ https://theintercept.com/2021/01/18/leak-zoom-meeting/
- el-salvador 4y agoIt's a feature found on the zoom admin panel: https://support.zoom.us/hc/en-us/articles/360021839031-Adding-audio-watermark https://support.zoom.us/hc/en-us/articles/360021839031-Addin...
- treesknees 4y agoYep, the article I linked includes screenshots of the Admin panel and hyperlinks to a few Zoom support pages. I wonder how well the audio fingerprint works over telephone. On one hand, it certainly won't have the same frequency range as a laptop speaker, but on the other hand so few people join by dialing in, it may end up obvious who the leaker is.
- tux1968 4y agoIt is fascinating to see what information can be deduced from such an artifact. Not exactly the same, but it reminded me of a story from the early days of the internet, where a serial killer was caught because a map he sent police, showing the location of a body, was generated online before being printed. https://murderpedia.org/male.T/t/travis-maury.htm https://murderpedia.org/male.T/t/travis-maury.htm
- yobbo 4y agoThis is not quite fingerprinting, since there's nothing unique about the alleged setup. There's quite a lot required for them to credibly show that the letter could only have been produced on a pc with "Intel HD Graphics 630". I suspect the argument is on the level of "we tried to duplicate it with some random PCs and the one with Intel HD graphics looked most similar". But even if it is true, integrated intel GPUs are in (maybe?) a third of all windows PCs.
- type0 4y agoHow likely could it be a Gone Girl scenario?
- bombcar 4y agoReminds me of the Dan Rather memo, though that was a simpler "show it couldn't be that old" style investigation.