3 ms·

Interestingly even Adobe doesn't know what it is, the detection software was supplied to them as a binary. I messed around with it in a similar way to the autho

by 13 12y ago

Interestingly even Adobe doesn't know what it is, the detection software was supplied to them as a binary. I messed around with it in a similar way to the author out of sheer curiosity and ended up completely baffled by the whole thing, even trying to eliminate parts that aren't triggers is impossible by my measure. I should make it clear I have no desire whatsoever to thwart the system (as others point out, simply using different software does that), but the methods it is using seem to completely defy all of the fingerprinting systems I'm aware of and is therefor incredibly interesting as a result.

toothbrush 12y ago
This sounds like a job for an approach like [0]! Reminds me of [1]. 0. http://lcamtuf.blogspot.fr/2014/11/pulling-jpegs-out-of-thin-air.html http://lcamtuf.blogspot.fr/2014/11/pulling-jpegs-out-of-thin..., http://lcamtuf.coredump.cx/afl/ http://lcamtuf.coredump.cx/afl/, american fuzzy lop 1. http://news.cornell.edu/stories/2015/03/images-fool-computer-vision-raise-security-concerns http://news.cornell.edu/stories/2015/03/images-fool-computer..., Images that fool computer vision
- 13 12y ago
  Doesn't AFL rely on being able to compile the application with it's hooks? It's been a long time since I've messed with Photoshop, but it's a complete mess of random dead code inside (even includes poems about a dead dog believe it or not), chances are you're looking for a completely obfuscated bunch of assembly in the hundred plus megabyte binary. I love Hopper, but not that much.
  - toothbrush 12y ago
    Yes, you're right. I'm admittedly not at all an expert on this type of thing, but surely some randomised testing, starting from a real banknote and making small mutations, would be doable.
    - 13 12y ago
      Oh sure, you could make a quick imagemagick script to make random variations and get a pass/fail with AppleScript, or even do some exploring with a debugger while opening one. Main barrier is motivation, I have no desire to counterfeit money (and who would use PhotoShop for that anyway), so I decided to let that rest.
      - toothbrush 12y ago
        It wouldn't be about counterfeiting, but about learning more about the detection algo :)
        13 12y ago
        I'm mostly concerned about experimenting straying into "reverse engineering".
        JonnieCache 12y ago
        Indeed, the FBI are known to lack a sense of humor when it comes to funny money.
        mml 12y ago
        The secret service, even less so.
        pakled_engineer 12y ago
        Just make sure you counterfeit so many bills they offer you a tiny punishment in exchange for helping them track them down http://www.dailymail.co.uk/news/article-2624697/Master-counterfeiter-printed-250million-fake-bills-walks-jail-just-month-half.html http://www.dailymail.co.uk/news/article-2624697/Master-count...
  - semi-extrinsic 12y ago
    According to wikipedia [0], the code that recognizes money was given to Adobe as a binary blob. So no go even if you have acces to the Photoshop source code. [0] http://en.m.wikipedia.org/wiki/EURion_constellation http://en.m.wikipedia.org/wiki/EURion_constellation
  - TheLoneWolfling 12y ago
    You could run PS within QEMU or something, perhaps. Would be slow though.
TazeTSchnitzel 12y ago
It's obviously a binary because no matter what program, the error message looks identical. It's weird.
- Karunamon 12y ago
  Which means this entire thing can be defeated by Software Cracking 101 - look for the error message that gets triggered when you do the thing you're trying to change, work backwards, and change the JE/JNE assembly instruction or NOP it out. Somehow I think it's not that simple, but also somehow I think that real counterfeiters will not be deterred by this manner of weak DRM.
  - derekp7 12y ago
    It's not meant to deter "real" (professional) counterfeiters -- this, along with the copy machine code, is meant to stop casual counterfeiting. Which is a good thing, as there are quite a number of people who are normally honest, yet could be overcome with a strong enough temptation (getting a free $20 bill), if it appears easy enough. And of course they will get caught and have their lives ruined. So by making the act of falling into the temptation a bit harder, you are keeping more honest people honest.

by 13 12y ago

toothbrush 12y ago

This sounds like a job for an approach like [0]! Reminds me of [1]. 0. http://lcamtuf.blogspot.fr/2014/11/pulling-jpegs-out-of-thin-air.html http://lcamtuf.blogspot.fr/2014/11/pulling-jpegs-out-of-thin..., http://lcamtuf.coredump.cx/afl/ http://lcamtuf.coredump.cx/afl/, american fuzzy lop 1. http://news.cornell.edu/stories/2015/03/images-fool-computer-vision-raise-security-concerns http://news.cornell.edu/stories/2015/03/images-fool-computer..., Images that fool computer vision

13 12y ago
Doesn't AFL rely on being able to compile the application with it's hooks? It's been a long time since I've messed with Photoshop, but it's a complete mess of random dead code inside (even includes poems about a dead dog believe it or not), chances are you're looking for a completely obfuscated bunch of assembly in the hundred plus megabyte binary. I love Hopper, but not that much.
- toothbrush 12y ago
  Yes, you're right. I'm admittedly not at all an expert on this type of thing, but surely some randomised testing, starting from a real banknote and making small mutations, would be doable.
  - 13 12y ago
    Oh sure, you could make a quick imagemagick script to make random variations and get a pass/fail with AppleScript, or even do some exploring with a debugger while opening one. Main barrier is motivation, I have no desire to counterfeit money (and who would use PhotoShop for that anyway), so I decided to let that rest.
    - toothbrush 12y ago
      It wouldn't be about counterfeiting, but about learning more about the detection algo :)
      - 13 12y ago
        I'm mostly concerned about experimenting straying into "reverse engineering".
        JonnieCache 12y ago
        Indeed, the FBI are known to lack a sense of humor when it comes to funny money.
        mml 12y ago
        The secret service, even less so.
        pakled_engineer 12y ago
        Just make sure you counterfeit so many bills they offer you a tiny punishment in exchange for helping them track them down http://www.dailymail.co.uk/news/article-2624697/Master-counterfeiter-printed-250million-fake-bills-walks-jail-just-month-half.html http://www.dailymail.co.uk/news/article-2624697/Master-count...
- semi-extrinsic 12y ago
  According to wikipedia [0], the code that recognizes money was given to Adobe as a binary blob. So no go even if you have acces to the Photoshop source code. [0] http://en.m.wikipedia.org/wiki/EURion_constellation http://en.m.wikipedia.org/wiki/EURion_constellation
- TheLoneWolfling 12y ago
  You could run PS within QEMU or something, perhaps. Would be slow though.

TazeTSchnitzel 12y ago

It's obviously a binary because no matter what program, the error message looks identical. It's weird.

Karunamon 12y ago
Which means this entire thing can be defeated by Software Cracking 101 - look for the error message that gets triggered when you do the thing you're trying to change, work backwards, and change the JE/JNE assembly instruction or NOP it out. Somehow I think it's not that simple, but also somehow I think that real counterfeiters will not be deterred by this manner of weak DRM.
- derekp7 12y ago
  It's not meant to deter "real" (professional) counterfeiters -- this, along with the copy machine code, is meant to stop casual counterfeiting. Which is a good thing, as there are quite a number of people who are normally honest, yet could be overcome with a strong enough temptation (getting a free $20 bill), if it appears easy enough. And of course they will get caught and have their lives ruined. So by making the act of falling into the temptation a bit harder, you are keeping more honest people honest.