9 ms·

The Photographic Science of Detecting Fake Lottery Tickets

254 points by ecaron 15y ago

Bud 15y ago
What's funny about this to me is that the "04 02" reveals the fake without any kind of photographic analysis whatsoever. The numbers are supposed to be sorted smallest to largest. A valid ticket would read "02 04".
- deleted 15y ago
  [deleted]
- bri3d 15y ago
  The author mentions that anomaly in the article, but goes on to assume that the sorting is picked by the state printing the ticket (probably for the benefit of being able to continue the case study). I also noted that the differing color of the "04 02" in that image can be spotted with the naked eye if zoomed in - no advanced analysis techniques necessary. I think the techniques used were far more interesting than the particular case study - while the media and non-camera-original nature of the images made the author's most basic techniques somewhat ineffective, the fakes were overall very poorly executed.
  - scoot 15y ago
    If it were the case that the numbers on this ticket were unsorted, you would expect all of the rows to be unsorted, whereas everything except 04 & 02 are in order, including the numbers that follow in the same row. Still interesting to see the "forensic" approach to this.
FaceKicker 15y ago
Slightly related, I was wondering how the actual lottery tells if your ticket is real - do the machines record your ticket's serial number and number(s) chosen and then send the info to the lottery HQ? Or do the lottery machines compute an HMAC of some kind and encode it in the serial number on the ticket itself?
- excuse-me 15y ago
  I don't know about this US lottery specifically but in most systems everything is recorded at HQ. Not just the numbers, but the place, the date and time, serial number etc That way they can also check with CCTV. It's an interesting topic in database design because the link to the store may fail at any time (remember lotteries started years ago on dialup) and you must not have an issued-unrecorded ticket at any point in the process
  - simcop2387 15y ago
    From my own experience with buying them, they solve that by saying "machine is down, i can't print any tickets". Not a very high tech solution but it certainly solves that problem completely.
  - kijin 15y ago
    Then why did it take so long for them to announce how many winners there were? First they said "at least one", and then they said "three". If everything was stored in a central database, they could have found out the exact figures (and a lot more) as soon as the last winning number was announced. Maybe it's due to lack of coordination between states? Or maybe they need to do fraud checking, etc. by watching CCTV footage from the point of sale?
    - excuse-me 15y ago
      Most of these lotteries date from the late 80s/early 90s and there isn't a lot of profit in updating them. I went to some talks about the database design for the UK lottery where they admitted they didn't think it would be so popular and so hadn't really considered sharding. They also were surprised that the number weren't uniformly distributed. They assumed numbers would be picked totally randomly while the first win was all numbers that could be birthdays and so there was an unusual number of winners and it took several days to work out how many.
    - tantalor 15y ago
      I doubt they use recordings for fraud prevention. I'd be pretty upset if my winning lottery ticket were denied because the store lost the recording, or never had them. It's just too costly to record every purchase.
K2h 15y ago
not directly related, but this made me remember some reading I did awhile ago on EXIF analysis. a really cool tool for EXIF http://www.sno.phy.queensu.ca/~phil/exiftool/ http://www.sno.phy.queensu.ca/~phil/exiftool/
hardy263 15y ago
Can you use Photoshop filters to do this, or are there more professional programs to do so?
biot 15y ago
Is it possible to reverse engineer the image such that it passes all tests? Knowing the various algorithms that could be used, what would be involved in constructing the modification such that it doesn't reveal evidence of any modifications? One thought would be to actually render an entire scene in something like POV-Ray. Imagine if something like this rendering http://www.povray.org/community/hof/chado.php http://www.povray.org/community/hof/chado.php contained a winning lottery ticket on the table. If you save the rendered image using the same compression algorithm and same EXIF heading information as a camera, how would one tell the difference?
- cuu508 15y ago
  I imagine it would be hard for renderer to fake all subtle qualities digital camera introduces. Things like "colors too clean", "noise too uniform", "geometric distortion doesn't match any existing lens" would turn up. In this specific case I think I'd print a fake ticket with dot matrix printer and take photos of it.
  - sneak 15y ago
    I imagine that getting one's hands on blank lotto ticket paper stock roll is probably beyond the scope of this "hack".
  - K2h 15y ago
    I have worked so hard to completely replace dot matrix that I am actually trying to think were I could get access to one and am coming up blank! Many receipts are now the crappy thermal paper that magically disappers from being left on the dash.. Its like magic in the retailers favor...and just about everything else is laser. Where would you get the dot matrix?
- gigantor 15y ago
  From the comments, you can reprint the ticket with a receipt/laser printer and take pictures of the copy, losing the artifacts. Depends on the length of trouble you would want to go through to reproduce a hard copy document.
kapgoals 15y ago
Not for nothing, but if you merely zoom in on the picture you can tell that the 'winning' line is a different color with the naked eye. And if you want to 'prove' this, a 10-second color replacement in photoshop does the job: http://i.imgur.com/7Mg4z.png http://i.imgur.com/7Mg4z.png
delinka 15y ago
To fake a lottery ticket for posting online, it'd be much easier just to print a fake ticket and then photograph it. I suppose, however, that the purpose of doing it digitally is to practice skills and "because I can." To fake a lottery ticket for claiming a prize ... well, that'd be fraudulent and would result in loss of freedom for quite some time.
- deleted 15y ago
  [deleted]
greendestiny 15y ago
There is nothing scientific about any of these tests. What's a 'high' ELA or 'low'? The thing that triggers a 'positive' seems to be only the authors intuition. While some of the tests might show something, I'm pretty sure ELA is absolute garbage - you can't separate the number of needed resaves because of the content frequencies from number of times it has already been resaved.
- sliverstorm 15y ago
  What, may I ask, makes a test scientific?
  - greendestiny 15y ago
    You don't need to get technical about it, but I think most people would expect any test described as scientific to be objective.
    - tantalor 15y ago
      Do you mean free of bias or reproducible? I think the author was clearly free from bias, and his results are easily reproduced by applying the same algorithms. The subjectivity which you complain about may be the conclusions drawn from the results of the tests, which I think are distinct. Specifically, you cite his "intuition" as the origin of the conclusion. I think the author's intuition is reliable because, like "real" scientists, he's an expert and speaks publicly about his work.[1] Or at least he appears to be. Are you prepared to challenge him as an expert? [1] http://www.hackerfactor.com/papers/bh-usa-07-krawetz-wp.pdf http://www.hackerfactor.com/papers/bh-usa-07-krawetz-wp.pdf
      - greendestiny 15y ago
        I could, but shouldn't we demand he show some proof for his claims? It seems to me that if you pull a bit of maths and technical magic out the normal skepticism the tech community melts away into a compliant bundle of gullibility.
  - 15y ago
jonah 15y ago
Simply blowing the contrast out in Photoshop makes the fakery pretty apparent too: http://i.imgur.com/6niwJ.png http://i.imgur.com/6niwJ.png
deleted 15y ago
[deleted]
user0398 15y ago
I find it utterly frustrating that a scientific seeming article would end with this conclusion: "A single algorithm can trigger false-positive or false-negative results... if something is really real, then it should pass everything." How you going to be so thorough about detecting a crappy photoshop job and then trip over your own words in the conclusion?
deleted 15y ago
[deleted]
morsch 15y ago
This site has a GIMP script for doing Error Level Analysis: http://sites.google.com/site/elsamuko/forensics/ela http://sites.google.com/site/elsamuko/forensics/ela (After saving it to your ~/.gimp-2.6/scripts folder, the tool hides in the Image menu.) I just tried it on a couple of my own images, the results are very interesting.

254 points by ecaron 15y ago

Bud 15y ago

What's funny about this to me is that the "04 02" reveals the fake without any kind of photographic analysis whatsoever. The numbers are supposed to be sorted smallest to largest. A valid ticket would read "02 04".

deleted 15y ago
[deleted]
bri3d 15y ago
The author mentions that anomaly in the article, but goes on to assume that the sorting is picked by the state printing the ticket (probably for the benefit of being able to continue the case study). I also noted that the differing color of the "04 02" in that image can be spotted with the naked eye if zoomed in - no advanced analysis techniques necessary. I think the techniques used were far more interesting than the particular case study - while the media and non-camera-original nature of the images made the author's most basic techniques somewhat ineffective, the fakes were overall very poorly executed.
- scoot 15y ago
  If it were the case that the numbers on this ticket were unsorted, you would expect all of the rows to be unsorted, whereas everything except 04 & 02 are in order, including the numbers that follow in the same row. Still interesting to see the "forensic" approach to this.

FaceKicker 15y ago

Slightly related, I was wondering how the actual lottery tells if your ticket is real - do the machines record your ticket's serial number and number(s) chosen and then send the info to the lottery HQ? Or do the lottery machines compute an HMAC of some kind and encode it in the serial number on the ticket itself?

excuse-me 15y ago
I don't know about this US lottery specifically but in most systems everything is recorded at HQ. Not just the numbers, but the place, the date and time, serial number etc That way they can also check with CCTV. It's an interesting topic in database design because the link to the store may fail at any time (remember lotteries started years ago on dialup) and you must not have an issued-unrecorded ticket at any point in the process
- simcop2387 15y ago
  From my own experience with buying them, they solve that by saying "machine is down, i can't print any tickets". Not a very high tech solution but it certainly solves that problem completely.
- kijin 15y ago
  Then why did it take so long for them to announce how many winners there were? First they said "at least one", and then they said "three". If everything was stored in a central database, they could have found out the exact figures (and a lot more) as soon as the last winning number was announced. Maybe it's due to lack of coordination between states? Or maybe they need to do fraud checking, etc. by watching CCTV footage from the point of sale?
  - excuse-me 15y ago
    Most of these lotteries date from the late 80s/early 90s and there isn't a lot of profit in updating them. I went to some talks about the database design for the UK lottery where they admitted they didn't think it would be so popular and so hadn't really considered sharding. They also were surprised that the number weren't uniformly distributed. They assumed numbers would be picked totally randomly while the first win was all numbers that could be birthdays and so there was an unusual number of winners and it took several days to work out how many.
  - tantalor 15y ago
    I doubt they use recordings for fraud prevention. I'd be pretty upset if my winning lottery ticket were denied because the store lost the recording, or never had them. It's just too costly to record every purchase.

K2h 15y ago

not directly related, but this made me remember some reading I did awhile ago on EXIF analysis. a really cool tool for EXIF http://www.sno.phy.queensu.ca/~phil/exiftool/ http://www.sno.phy.queensu.ca/~phil/exiftool/

hardy263 15y ago

Can you use Photoshop filters to do this, or are there more professional programs to do so?

biot 15y ago

Is it possible to reverse engineer the image such that it passes all tests? Knowing the various algorithms that could be used, what would be involved in constructing the modification such that it doesn't reveal evidence of any modifications? One thought would be to actually render an entire scene in something like POV-Ray. Imagine if something like this rendering http://www.povray.org/community/hof/chado.php http://www.povray.org/community/hof/chado.php contained a winning lottery ticket on the table. If you save the rendered image using the same compression algorithm and same EXIF heading information as a camera, how would one tell the difference?

cuu508 15y ago
I imagine it would be hard for renderer to fake all subtle qualities digital camera introduces. Things like "colors too clean", "noise too uniform", "geometric distortion doesn't match any existing lens" would turn up. In this specific case I think I'd print a fake ticket with dot matrix printer and take photos of it.
- sneak 15y ago
  I imagine that getting one's hands on blank lotto ticket paper stock roll is probably beyond the scope of this "hack".
- K2h 15y ago
  I have worked so hard to completely replace dot matrix that I am actually trying to think were I could get access to one and am coming up blank! Many receipts are now the crappy thermal paper that magically disappers from being left on the dash.. Its like magic in the retailers favor...and just about everything else is laser. Where would you get the dot matrix?
gigantor 15y ago
From the comments, you can reprint the ticket with a receipt/laser printer and take pictures of the copy, losing the artifacts. Depends on the length of trouble you would want to go through to reproduce a hard copy document.

kapgoals 15y ago

Not for nothing, but if you merely zoom in on the picture you can tell that the 'winning' line is a different color with the naked eye. And if you want to 'prove' this, a 10-second color replacement in photoshop does the job: http://i.imgur.com/7Mg4z.png http://i.imgur.com/7Mg4z.png

delinka 15y ago

To fake a lottery ticket for posting online, it'd be much easier just to print a fake ticket and then photograph it. I suppose, however, that the purpose of doing it digitally is to practice skills and "because I can." To fake a lottery ticket for claiming a prize ... well, that'd be fraudulent and would result in loss of freedom for quite some time.

deleted 15y ago
[deleted]

greendestiny 15y ago

There is nothing scientific about any of these tests. What's a 'high' ELA or 'low'? The thing that triggers a 'positive' seems to be only the authors intuition. While some of the tests might show something, I'm pretty sure ELA is absolute garbage - you can't separate the number of needed resaves because of the content frequencies from number of times it has already been resaved.

sliverstorm 15y ago
What, may I ask, makes a test scientific?
- greendestiny 15y ago
  You don't need to get technical about it, but I think most people would expect any test described as scientific to be objective.
  - tantalor 15y ago
    Do you mean free of bias or reproducible? I think the author was clearly free from bias, and his results are easily reproduced by applying the same algorithms. The subjectivity which you complain about may be the conclusions drawn from the results of the tests, which I think are distinct. Specifically, you cite his "intuition" as the origin of the conclusion. I think the author's intuition is reliable because, like "real" scientists, he's an expert and speaks publicly about his work.[1] Or at least he appears to be. Are you prepared to challenge him as an expert? [1] http://www.hackerfactor.com/papers/bh-usa-07-krawetz-wp.pdf http://www.hackerfactor.com/papers/bh-usa-07-krawetz-wp.pdf
    - greendestiny 15y ago
      I could, but shouldn't we demand he show some proof for his claims? It seems to me that if you pull a bit of maths and technical magic out the normal skepticism the tech community melts away into a compliant bundle of gullibility.
- 15y ago

jonah 15y ago

Simply blowing the contrast out in Photoshop makes the fakery pretty apparent too: http://i.imgur.com/6niwJ.png http://i.imgur.com/6niwJ.png

deleted 15y ago

[deleted]

user0398 15y ago

I find it utterly frustrating that a scientific seeming article would end with this conclusion: "A single algorithm can trigger false-positive or false-negative results... if something is really real, then it should pass everything." How you going to be so thorough about detecting a crappy photoshop job and then trip over your own words in the conclusion?

deleted 15y ago

[deleted]

morsch 15y ago

This site has a GIMP script for doing Error Level Analysis: http://sites.google.com/site/elsamuko/forensics/ela http://sites.google.com/site/elsamuko/forensics/ela (After saving it to your ~/.gimp-2.6/scripts folder, the tool hides in the Image menu.) I just tried it on a couple of my own images, the results are very interesting.