Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Printer IT Technology

How a Few Yellow Dots Burned the Intercept's NSA Leaker (arstechnica.com) 308

Posted by msmash from the tech-101 dept.
On Monday, news outlet The Intercept released documents on election tampering from an NSA leaker. The documents revealed that a Russian intelligence operation sent spear-phishing emails to more than 100 local election officials days before the election, which ran through a hack of a U.S. voting software supplier. Hours later, the Department of Justice charged 25-year-old government contractor Reality Leigh Winner with sharing top secret material with the media. The DoJ said it Winner had "printed and improperly removed classified intelligence reporting, which contained classified national defense information" before mailing the materials. But how could the DoJ know that it was Winner who had printed the documents, or that the documents were printed at all? ArsTechnica explains: [...] The Intercept team inadvertently exposed its source because the copy showed fold marks that indicated it had been printed -- and it included encoded watermarking that revealed exactly when it had been printed and on what printer. The watermarks in the scanned document The Intercept published yesterday -- were from a Xerox Docucolor printer. Many printers use this or similar schemes, printing faint yellow dots in a grid pattern on printed documents as a form of steganography, encoding metadata about the document into its hard-copy output. Researchers working with the Electronic Frontier Foundation have reverse-engineered the grid pattern employed by this class of printer; using the tool, Ars (and others, including security researcher Robert Graham) determined that the document passed to The Intercept was printed on May 9, 2017 at 6:20am from a printer with the serial number 535218 or 29535218. Further reading: How The Intercept Outed Reality Winner.
This discussion has been archived. No new comments can be posted.

How a Few Yellow Dots Burned the Intercept's NSA Leaker More

How a Few Yellow Dots Burned the Intercept's NSA Leaker

Comments Filter:

  • Take a photo (Score:4, Interesting)

    by hawguy ( 1600213 ) on Tuesday June 06, 2017 @02:26PM (#54562253)

    If you're going to leak documents, take a photo and crank up the jpeg compression level to help hide the watermarks.

    • Or print on yellow paper.

    • Re: (Score:2)

      by heson ( 915298 )
      What if all originals are unique by different wording? This was sloppy spy work.

      • Re:Take a photo (Score:4, Interesting)

        by green1 ( 322787 ) on Tuesday June 06, 2017 @03:16PM (#54562787)

        That's been standard process for many decades, but it's actually less likely now because it's harder to implement than these technological solutions, even though it's more likely to actually catch the party involved (because even if they take every precaution listed so far here, they'd still be caught simply by the wording used.)

        • Re: (Score:2)

          by Kjella ( 173770 )

          That's been standard process for many decades, but it's actually less likely now because it's harder to implement than these technological solutions, even though it's more likely to actually catch the party involved (because even if they take every precaution listed so far here, they'd still be caught simply by the wording used.)

          These technical solutions only matter if you see the copy somehow, the changing text is for when it is referenced by news media, in reports by foreign agencies and such. IIRC from a previous article usually the base document is the same, but there are summaries that subtly swap words. They're also "juicy" hoping that you'll end up with direct quotes, since actual scans are usually rare because of the reasons above. Unlike say a movie OCR to get a plaintext file is pretty destructive to all other clues.

  • Do not use colour printers.

    • Re:Lesson to learn (Score:4, Informative)

      by s_p_oneil ( 795792 ) on Tuesday June 06, 2017 @02:40PM (#54562413) Homepage

      "The U.S. Government Agency determined that six individuals printed this reporting. WINNER was one of these six individuals. A further audit of the six individuals' desk computers revealed that WINNER had e-mail contact with the News Outlet. The audit did not reveal that any of the other individuals had e-mail contact with the News Outlet."

      Also, don't use your work computer or email account to send/receive emails to the organization you're leaking classified documents to.

  • Yellow, then orange (once convicted) is the new black

  • Okay, who leaked the information about how they spotted the leak source?

    • Okay, who leaked the information about how they spotted the leak source?

      Well, this has been public knowledge for a while. Most famously, Tom Clancy wrote about it Patriot Games. It usually comes up in real life when idiots try to print money with a desktop printer.

  • PDFs too? (Score:3)

    by interkin3tic ( 1469267 ) on Tuesday June 06, 2017 @02:28PM (#54562273)
    Dang. Found on the PDF scans even though you can't see them. Lessons learned:
    1. make sure to take really really low quality scans only of senstitive printouts.
    2. Use someone else's printer
    3. The "swamp" being drained is evidently people who are reporting on wildly unethical things the government is doing.

    Obligatory yes the last guy did it too. STFU and focus on the current abomination in office, maligning the last guy doesn't help anything more than you losing sleep at night.

    • 3. The "swamp" being drained is evidently people who are reporting on wildly unethical things the government is doing.

      Pray tell, what "wildly unethical things the government is doing" were uncovered by her leak? Is it unethical to have an ongoing investigation into hack attempts?

    • Re: (Score:2)

      by bongey ( 974911 )

      No there are only very specific "classified approved printers" , which always have the watermarking. You cannot just use any printer. She is idiot for not realizing that.

  • "Reality Winner"?! (Score:3, Interesting)

    by Anonymous Coward on Tuesday June 06, 2017 @02:29PM (#54562283)

    As a non-native english speaker, I ask: is this an actual, socially acceptable name in english-speaking countries? "Reality Winner", just like somebody who won a reality show?!

    • Some parents are cruel.

    • her parents are probably hippies

    • I had a Filipino coworker who named his three kids after the letters X, Y and Z. Unless you were a Filipino, those names were unpronounceable.

    • You'd be surprised what some parents name their kids. I was once responsible for uploading baby photos and one of the names was "Secret Angel" (first and middle name). This was long ago enough that Secret would be a teen now. Knowing how kids are, I can't help but feel sorry for all of the teasing she probably gets over her name.

    • Re: (Score:2)

      by Topwiz ( 1470979 )

      I checked the US Census and as of 2010 there are 3,853 people with the last name Winner. The most babies named Reality in one year has been 17. I'm going to guess she is the only one with that combination.

      They should have given her the middle name Show.

    • Re: (Score:2)

      by Jeremi ( 14640 )

      As a non-native english speaker, I ask: is this an actual, socially acceptable name in english-speaking countries? "Reality Winner", just like somebody who won a reality show?!

      You know those subtle clues that let you know you're actually living in the Matrix? Like the same cat walking by twice in a row?

      This is one of those -- except it's not a clue that we're living in The Matrix -- it's a clue that we're living in Idiocracy. Pass the Brawndo.

    • Re:"Reality Winner"?! (Score:5, Informative)

      by Ungrounded Lightning ( 62228 ) on Tuesday June 06, 2017 @03:24PM (#54562851) Journal

      As a non-native English speaker, I ask: is this an actual, socially acceptable name in English-speaking countries?

      Unlike, say, French, American English does not have a ruling body. It's whatever the speakers of it chose to say.

      That includes names. You can call your child or yourself anything you chose - as long as you do not do so to defraud.

      (My wife's career was blighted by an abusive father - a professor - who solicited name suggestions from his students. Though she is native born and a native speaker of American English, she missed out on a lot of job interviews because HR droids thought, from the name he hung on her, that she was a new immigrant who would have communication problems.)

      If you go through a legal name change you may run into issues with not being able to switch your name to something that amounts to a title of nobility (due to article 1 section 9 paragraph 8: No Title of Nobility shall be granted by the United States: ..."). Immigration had a history of misapplying that to strip things like "von" from immigrants' names as they filled out their paperwork.

      As for "socially acceptable", that depends on the prejudices of the particular social subgroups in question. Regardless of what they might think of neologisms labeling a person, any name from any established cultural group anywhere in the world is necessarily acceptable.

      If Frank Zappa can name his son "Dweezil" and his daughter "Moon Unit", it's easy to see that anything goes. B-)

    • As a non-native english speaker, I ask: is this an actual, socially acceptable name in english-speaking countries? "Reality Winner", just like somebody who won a reality show?!

      In most English-speaking countries it is considered socially offensive to complain about people's names. It is not socially acceptable to covet the naming of other people's babies, or if they changed their name, their own sense of self.

      That's why the people doing it are also generally engaging in name-calling and other socially abhorrent behaviors. Polite people "don't go there." It is a basic and obvious matter of personal freedom.

  • Trusting The Intercept? (Score:5, Interesting)

    by bill_mcgonigle ( 4333 ) * on Tuesday June 06, 2017 @02:29PM (#54562287) Homepage Journal

    While not everybody knows about the yellow dots, almost everybody involved with infosec does. How can The Intercept can be trusted to hold or publish any leakers' information securely?

    Was this one reporter who screwed up? Didn't he have a second person reviewing his work? Isn't there a team of people at The Intercept who discuss whistleblowing publications? Isn't anybody on such a team aware of digital privacy issues?

    This will be a huge loss if The Intercept becomes useless as it was basically founded to handle stories like this. But given that, how could the outcome have been so bad in this case?

  • Or, get this, they checked the printer logs. You think the NSA doesn't already have a log of every document that every device prints?

    SELECT user FROM printer_logs WHERE document_id = 'greased_up_yoda_doll.pdf'

    • Re: (Score:2)

      by DaHat ( 247651 )

      They did... and noticed 6 people had printed the doc, one of which was Miss Winner... who later confessed to being the one who mailed it.

      • That's my point, they probably didn't need the microdots because they could already easily find which printer and when based on the document.

  • This wasn't the only way (Score:5, Informative)

    by Etcetera ( 14711 ) on Tuesday June 06, 2017 @02:31PM (#54562323) Homepage

    While interesting, and certainly providing confirmation, this wasn't the primary mechanism that was used to track her down according to the affidaivat. Before even IDing a specific printer, they simply looked for someone that had printed it out, period.

    Internal auditing showed that only six employees had printed out the item in question. A search of the six computers showed that she had emailed The Intercept from her work computer (and that no one else had). Coded metadata just backs it up, but it's dumber than that.

    • Re:This wasn't the only way (Score:5, Insightful)

      by Jason Levine ( 196982 ) on Tuesday June 06, 2017 @02:51PM (#54562517) Homepage

      How can someone work for the NSA and NOT be aware that they track everything? If I was an NSA leaker, I certainly wouldn't be e-mailing my leaks from my work computer/e-mail account. I'd set up a throwaway account (and even then would be looking over my shoulder every second).

      • "How can someone work for the NSA and NOT be aware that they track everything?" Maybe she assumed her employer would be OK with it. Such are the times we live in. They did give her a security clearance even though there's a ton of stuff in her background that would have disqualified her back when I went through the process.

      • Re: (Score:2, Insightful)

        by h4ck7h3p14n37 ( 926070 )

        Diversity hire. Someone with her background definitely should not have received a Top Secret clearance.

      • Re:This wasn't the only way (Score:5, Informative)

        by dunkindave ( 1801608 ) on Tuesday June 06, 2017 @04:27PM (#54563503)

        How can someone work for the NSA and NOT be aware that they track everything?

        She didn't work for the NSA; so was employed by a contractor that provides classified translation services, and apparently for that work had access to the NSA's network (either NSANet or JWICS since SIPRnet is only secret). Not realizing they track shows she isn't terribly bright.

        If I was an NSA leaker, I certainly wouldn't be e-mailing my leaks from my work computer/e-mail account. I'd set up a throwaway account (and even then would be looking over my shoulder every second).

        OK, she is VERY dumb. And I agree with your tactics - as a good first measure, but nowhere near all I would do.

      • Perhaps she wasn't in a technical role, which would explain layers upon layers of horribad opSec.

      • How can someone work for the NSA and NOT be aware that they track everything?

        One, she was a linguist, not a spook. Highly specialized individuals are often obtuse in matters outside their areas of expertise. If I needed brain surgery, I'd eagerly seek out the brilliant neurosurgeon Dr. Ben Carson. Likewise, I'd probably trust Ms. Winner to accurately translate a five-party Farsi dialogue in real time. I wouldn't want either of them advising me on matters of, say, agricultural food storage or information security.

        Two, she was a contractor. The curriculum and rigor of the on-boarding

  • Once they figured out that the document was taken all they had to do was look and see who accessed the document. They did that and showed that 6 people printed the document. They did a forensic scan of all 6 desktops and found that one had a record of emailing the Intercept.

    She was busted without needing the microdots at all. The only thing the microdots did was nail her ass to the wall. It was her own stupidity that put her against the wall to begin with.

    • Re: (Score:2)

      by amiga3D ( 567632 )

      And to think she worked for an Intel contractor. No wonder Russia, China and all these other people eat our lunch. The entire Intel community is incompetent. They leak like a sieve.

  • This story makes quite a bit about "hidden" printer steganography. But the real way this idiot got caught was from server access and printer logs. The spooks narrowed it down to six people, only one of which had contact with the Intercept.

    How is it this person had a top secret clearance in the first place? She is "nice to look at"...

    • I agree with you. She made plenty of really basic mistakes. I find it hard to believe a contractor for the NSA would be that degree of uninformed / ignorant to the consequences and / or security.
    • Part of it is that the NSA collects so much data that they have to lower their standards to get enough manpower to handle all of it.

    • Re: (Score:2)

      by gweihir ( 88907 )

      The mistake is not hers. The mistake is on the side of the Intercept. Sources usually do not know and cannot reasonably be expected to know how to protect themselves.

  • If she had just put the documents down her pants like the Sandy Burger did, this would be a much more interesting story!

  • People never got caught because of them.
    They share the whole thing and even work with newspapers that stab them in the back.

  • The Intercept team inadvertently exposed its source because the copy showed fold marks that indicated it had been printed -- and it included encoded watermarking that revealed exactly when it had been printed and on what printer. T

    Failed to protect a source?!

    Could have run it through GIMP, or a POS copier, converting to black-and-white, and messing with contrast settings, cropping out anywhere not needed, and vetting the images with a team of in-house experts before publication.

    Could have faxed it low-rez,

    • Re: (Score:2)

      by gweihir ( 88907 )

      Indeed. But these are all low-cost, low security approaches, as more sophisticated watermarks exist. What you want to do is manually copy the text by typing it in again if you want to be really sure. Even OCRing it has risks as some watermarks can survive that.

      The really bad thing is that the yellow dots are a really old and well-known security measure introduced with digital color copiers to allow the tracing of counterfeit paper money to the machine it was printed on.

  • The worst thing is not only that the Intercept was exceptionally careless, the worst thing is that this specific attack technique has been known for decades. It is used in color-printers to detect what machine paper-money (e.g.) was copied or printed on. My guess is this use here was just a side-effect.

    Lets hope the Intercept fixes their act and goes back to manual copying (i.e. typing it in) for things where their sources really need to be protected.

  • For those who don't already know about it (Score:3)

    by Trogre ( 513942 ) on Tuesday June 06, 2017 @08:23PM (#54564907) Homepage

    Here is the EFF's guide on yellow dots [eff.org].

    And it's not in any way limited to Xerox [eff.org].

    You can test it yourself by photographing a piece of paper from a suspect printer, loading it into the GIMP and showing just the blue channel. The "yellow" dots will show up as a darker shade of blue than the surrounding page.

Slashdot Top Deals

Top Ten Things Overheard At The ANSI C Draft Committee Meetings: (1) Gee, I wish we hadn't backed down on 'noalias'.

Close