Slashdot Log In
Hidden Codes in Printers Cracked
Posted by
CmdrTaco
on Tue Oct 18, 2005 07:50 AM
from the big-brother-pwnz-you dept.
from the big-brother-pwnz-you dept.
r84x writes "A research team led by the Electronic Frontier Foundation (EFF) recently broke the code behind tiny tracking dots that some color laser printers secretly hide in every document.
The U.S. Secret Service admitted that the tracking information is part of a deal struck with selected color laser printer manufacturers, ostensibly to identify counterfeiters. However, the nature of the private information encoded in each document was not previously known.
"We've found that the dots from at least one line of printers encode the date and time your document was printed, as well as the serial number of the printer," said EFF Staff Technologist Seth David Schoen."
Related Stories
[+]
Hardware: Secret Printer ID Codes May Be Illegal In the EU 229 comments
I Don't Believe in Imaginary Property writes "In response to a query from a member of the EU Parliament, an EU commissioner issued an official statement (.DOC) saying that, while they do not violate any laws, secret printer tracking dot codes may violate the human right to privacy guaranteed by the EU's Convention of Human Rights and Fundamental Freedoms. If you don't remember what these are, Slashdot has discussed the issue before. In short, most color printers print small yellow dots on every sheet in a code that identifies the printer and, potentially, its owner. The EFF is running an awareness campaign, and a couple of years back made a start on deciphering the yellow dot code."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Maybe its not a weakness (Score:5, Funny)
Re:Maybe its not a weakness (Score:5, Funny)
Parent
Printer Friendly Version? (Score:5, Funny)
Re:Printer Friendly Version? (Score:5, Funny)
=Smidge=
Parent
Re:Printer Friendly Version? (Score:5, Insightful)
That is true in an uncorrupted system. The question remains what would happen if someone did use their power like J. Edgar Hoover did, and others in history that have got away with abuse of power in such a manner.
And there is the case of just because something is illegal, that doesn't mean that something is a wrong thing to do.
Parent
My country right or wrong is WRONG (Score:5, Insightful)
The "if you have nothing to hide" apologists for elimination of freedoms is a slippery slope to totalitarianism. Orwell would snicker!
Parent
Re:Freedom DOES mean PRIVACY (Score:5, Interesting)
Ahh. Spoken like a true facist. You are taking the right of free expression in a democratic society and chaining it to the dungeon wall with the use of another as yet to be defined term, "antisocial stuff". Would that be "antisocial" as defined by the ruling political party, whichever religious sect is currently in vogue, or perhaps as determined by a public poll?
"Free speech is not free *anonymous* speech."
What a crock! One of the basic rights any citizen of a democracy has is the right to vote, PRIVATELY. No other person, group of persons, or government entity is granted the right to know how an individual votes -- without such privacy protections the entire foundation of democracy is open to the social, political or financial pressure to vote a particular way.
And only in a democracy falling to the continued pressures of fascist stateism would the government redefine the ephemeral and undefined term "free press" only as persons engaged in journalistic activities employed by corporate media moguls.
I would suggest that you spend a few years in the "new and improved" fascist USSR, being run by an ex-KGB general, and experience the fruits of your specious argument firsthand.
Parent
Re:Printer Friendly Version? (Score:5, Insightful)
The people that do not want their houses randomly searched must be hiding something, after all, why would they not want searched? I know, point taken to the extreme but where do you draw the line?
Parent
Re:Printer Friendly Version? (Score:5, Funny)
Parent
Re:Printer Friendly Version? (Score:5, Interesting)
Or even worse...you buy and register a printer, and six months later sell it to some registered sex offender. It's a cash deal with no records. Six months and one day later that printer is used for some kidnapping randsom note or some shit. Who would believe it wasn't you? Your mom?
Parent
Re:Printer Friendly Version? (Score:5, Interesting)
Just wait until you get your ass hauled-in by an overzealous cop while you were doing something perfectly innocent or legal (like photographing old buses at a busy intersection - I know, it happenned to me. Two hours of vacation down the drain because some shit-brained bitch thought I was a terrorist - no, don't ask what happenned in her sorry neurons to think that).
Cops think they are above normal civilians and do not hesitate to abuse their powers. For them, making a lowly civilian life hell is just what swatting a fly for you.
The easier it is to abuse their power (like finding out where one photocopy was made), the more likely they will do it.
Now that the EFF has published the "secret" code, everyone can do it, including that jealous spouse, screwey boss or suspicious business associate.).
Cops think they are above normal civilians and do not hesitate to abuse their powers. For them, making a lowly civilian life hell is just what swatting a fly for you.
The easier it is to abuse their power (like finding out where one photocopy was made), the more likely they will do it.
Now that the EFF has published the "secret" code, everyone can do it, including that jealous spouse, screwey boss or suspicious business associate.
Parent
Re:Printer Friendly Version? (Score:5, Insightful)
or acting indignent because they got pulled over for speeding;
Or driving while black. Or a personal favorite, driving on the wrong side of the road - On a lineless back road barely wide enough for a single car (the sort where you literally stop and one car pulls totally off the road if you meet another car coming the opposite way).
or drunk and screaming obscenities in public places;
Or ordered to step outside a bar, given a sobriety test, and charged with public drunkenness.
or involved in horrible accidents and shootings.
You mean like when a cop panics over a 2YO kid with a cap gun, and ventilates him? Or when they zealously chase a gas station drive-off at 110mph leading to three deaths over $30 in fuel?
It's even more unlikely that the government is going to use this against you, unless you do something to draw the attention of say, the FBI.
You mean like anonymously distributing a (legal) pamphlet critical of the wrong politician, who wants revenge and has convenient connections?
I appreciate what police do. They keep a bunch of unruly domesticated primates from killing one another.
But don't glorify them - They chose that job because they get to act the most like unruly domesticated primates, and justify it as part of the job. Politicians chose their job because they like power (or money, or both). WE all need to do our part to keep the police, and the government in general, in check.
Parent
Before... (Score:5, Insightful)
Just realize that 99.9% of the world doesn't give a shit about anything you do, and all that paranoia just slips away. That's what I did.
Re:Before... (Score:5, Informative)
Most laser printers are rather expensive items. If you paid with a credit card, then yes, they have it in a database. (All stores record the serial number of high-ticket items they sell. I've actually gotten recall notices this way, so I know the store shares it with the manufactorer.) Even if you paid in cash, if you filled in the warranty card, they have it. Got a mail-in rebate? On file. Ever had to have it serviced? You're on file.
Parent
Re:Before... (Score:4, Insightful)
If you paid with a credit card, then yes, they have it in a database.
The retailer or manufacturer may have it in a database, but whatever shadowy organisations the parent was alluding to probably doesn't. Government agencies have enough trouble keeping track of where people live without having to track their posessions too.
Parent
Re:Before... (Score:5, Insightful)
Who's to say what it takes for them to obtain this information and how they use it? I'm personally not satisfied to just think "they'll only obtain it when they need it, and they will only use it for a Good Cause". It's not paranoia, it's like Murphy's law: if it can be abused, it probably will be.
Parent
Re:Before... (Score:5, Insightful)
Parent
Re:Before... (Score:5, Interesting)
I hear the argument over and over again that "just because they're allowed to, the government doesn't have time to spy on little old you, so quit being paranoid". This is true, and the government realizes it, which is why they are striving for "Total Information Awareness". The idea is that all the information the feds could ever desire is already collected in outrageous detail by private organizations like the phone company, ISPs, bookstores, etc. - so why not just pass laws granting the Feds unrestricted, secret access to this info? That way, the government doesn't have to have been spying on you your whole life. The moment you get caught up in some "suspicious" incident like looking around too much on the subway or criticizing the American government while in an American airport, your whole history is at the government's fingertips (including, now, what documents you printed!), and believe me, they'll find reasons for suspicion.
God bless the PATRIOT Act, my friend.
Parent
Re:Before... (Score:5, Insightful)
Parent
Re:Before... (Score:5, Interesting)
Yes, they must, otherwise this tracking information is useless, right? They can't be that dumb. And most high-end color printers are sold to businesses and often have service contracts. It's not that hard. How many people buy a printer for cash?
And many networked printers "phone home" to the manufacturer via email or web. My Xerox phaser 7750 (great printer, btw) tries to send an email every month to Xerox. They're blocked now.
Just realize that 99.9% of the world doesn't give a shit about anything you do, and all that paranoia just slips away.
I know that. But I prefer that my printer doesn't track what I print.
Parent
Re:Before... (Score:4, Insightful)
I don't know that the lack of a database would make the information useless. It may work like running ballistics tests on a shell casing found at a crime scene and matching it to a weapon seized from a suspect.
Even if there ability to find a suspect is limited, they may have the ability to prove, within a court of law, that a document came from the printer in your basement.
Parent
Re:Before... (Score:4, Funny)
Parent
Re:Before... (Score:5, Interesting)
Modern asset tracking systems use the serial number of each big-ticket item to track it (if it is serialised - most expensive kit is). The asset, whatever it is, is tracked from entry to the system through to exit - with an EPOS transaction being recorded against it as it leaves if sold.
It is pretty damn easy for a database coder to write a bit of SQL to say 'give me the credit card number that bought this item'. I could do it in minutes.
Provided the Feds wanted to track a given machine, and it had been bought with plastic, there's no reason they shouldn't be able to find that info very easily, given the cooperation of the vendors. Your last para relies on you not being someone the Feds are interested in - and that relies on you assuming they won't be interested in people who haven't broken the law. I hope you are right, but recent events suggest otherwise to me...
Justin.
Parent
Re:Before... (Score:5, Insightful)
Then along came Senator Joseph McCarthy...
Parent
Re:Before... (Score:5, Insightful)
Oh, so there's only 0.1% of the world who is interested in what I'm doing?
I'm glad it works out for you, but 6 million people snooping around in my private life doesn't make my paranoia go away.
Parent
Re:Before... (Score:5, Interesting)
Buy a printer and fail to send the warranty card in and there is no entry in any list.
The reason they have this stuff is so that they can match the printer to the document in the courtroom after they catch you. It's not a tracking system.
Parent
Re:Er, huh? (Score:4, Informative)
And yes, stores can be required to scan those S/Ns if the feds so desire, and it can be made to stick. Bank tellers don't get paid all that much more than Best Buy clerks, but the threat of 20 years in the federal pen gives them a bit of incentive to follow the money-laundering reporting procedures. Heck, I heard a discussion between two entry-level postal clerks the other day about how much fun they had spotting drug dealers and reporting them.
sPh
Parent
Re:Er, huh? (Score:5, Informative)
This is also true of the mid-range color laser printers you purchase at your local Best Buy or Micro Center. In fact, if you open your eyes at the checkout and actually pay attention, you would notice that after they scan the bar-code, their register prompts them to either scan the serial number bar-code, or hand-key in the serial number. Now, they may not be required to record your name and address, but they most certainly can trace it back to your credit card.
The whole point of this is to catch counterfeiters. It's useless to know the serial-number of a device if you don't know where it was sold.
Parent
Re:Checkout scanners... (Score:5, Informative)
If they track it, everyone does. Everything I mail order has the barcode scanned and printed on the packing slip.
Get a clue.
Parent
more links (Score:5, Informative)
More information can be found on the EFF's printer-privacy webpage. [eff.org]
Also interesting is Andrew Bunnie's flat bed page scanner mod [bunniestudios.com] to use blue light instead of white. This made the yellow tracking dots easier to see, and the whole page could be seen at once to determine the pattern they made.
Blue light scanner mod ? (Score:5, Funny)
A1. scan as normal
A2. separate the channels into CMYK in Photoshop/whathaveyou
A3. inspect the Yellow channel.
B1. scan as normal
B2. separate the channels into RGB in GIMP/whathaveyou
B3. do a difference matte between the channels
B4. inspect the result
C1. replace the yellow toner cartridge with a black one
C2a. stock the other holders with empty cartridges
C2b. or if that causes a printer error/warning, block the cartridges' output
C3. print
D1. get a sheet of blue filter plastic
D2. scan through that
But I guess the array of blue LEDs with soldering involved is a lot more geeky
Parent
Re:more links (Score:5, Funny)
Right. So now, in order to ensure that we remain safe from terrorists, paedophiles, and liberals, we need to compel scanner manufacturers to make sure their products will refuse to show the secret codes we already compelled the printer manufacturers to install.
Don't worry, citizen. We have it all under control.
Parent
Message decoded (Score:4, Funny)
Date and time? (Score:5, Funny)
Conspiracy math (Score:5, Insightful)
Anyway, so the government requires each printer manufacturer to maintain a database of all printers sold, so that if needed, they can subpeona the records? No wonder printer ink costs so much
I'm thinking that this would only go so far, and not be much more useful than a database of gun rifling marks?
Re:Conspiracy math (Score:5, Informative)
Even if all the database can tell them reliably is that HP ColorLaserJet Model 55 Serial Number 89928798734 was distributed to a certain Best Buy store, that goes a long way. When the Secret Service finds counterfeit bills, they know from the serial what store it was originally purchased in. Chances are it didn't move far, and chances are that Best Buy's records can lead to a very short list of potential buyers. Even if it was resold by one of them, the investigation becomes fairly trivial at that point.
But perhaps more importantly, even if you can't use it (embedded serial numbers in documents) as a primary method of tracking down the counterfeiter, you can certainly use it as court evidence once you do catch them by other means. It's pretty damning evidence if they can show that they seized a printer with serial number 89928798734 at your home address, and they can also show conterfiet currency or documents with the same serial number embedded that showed up elsewhere.
Parent
Quit being clueless. (Score:5, Interesting)
Let's assume you take that home and hook it up to your Windows XP Home Edition printer.
Now, that printer is installed and it requests you "Register" the printer. You decline to do so.
During the normal course of use, a little dialog box pops up stating that there is an update to download from your color laser printer manufacturer's website and the printer application will be more then happy to do so.
How does your application know that it needs to be updated? Well, it checked with a central server.
If that application checks with a central server, would it be difficult to imagine that the central server would be able to obtain the following?
IP Address, Printer Serial number, timestamp of communication.
With just the timestamp and the IP Address your PC used to communicate with the central server, you can be easily traced. It's easier if you are on broadband, slightly more difficult if you are on a service like AOL or MSN.
I am not being a tinfoil hat wearer here. I am just pointing out that it is actually easier to track down a user of a particular printer then you believe it to be.
The only way to be more anonymous with such a cash paid color laser printer purchase would be to never connect it to a PC that has Internet Access.
Parent
Old Communist ploy gets updated (Score:5, Interesting)
The theory of course being that they would use it to try and track down any subversive content.
And now the US government has made it quick, easy and automated to do the same.
I want to know who the bastards are that are adding this technology to their printers so I can avoid them like the plague.
Yes, I know I could just not send in the registration card, but what if the government decided to crack down on those who critisize the war? Suddenly when they confiscate my printer, they can find out if any of the documents they've declared subversive came from my printer.
This is too Big Brother for my tastes.
Re:Old Communist ploy gets updated (Score:4, Funny)
Parent
Re:Old Communist ploy gets updated (Score:5, Informative)
That's in the article:
http://www.eff.org/Privacy/printers/list.php [eff.org]
Parent
pacman to the rescue (Score:5, Funny)
How much is in the driver? (Score:5, Interesting)
I can only imagine the time and date are passed from the host PC - most printers don't know what time/date it is - at least on those I jsut glanced at I can't set it myself. Of course the network attached ones could have an NTP client but that'd be easily blocked at the firewall.
At least if you can make every printout say it happened three decades ago you don't need to worry about proving you were not in the office at the time the printout was made.
Re:How much is in the driver? (Score:5, Informative)
My bet is on the rasterizer.
-molo
Parent
Re:How much is in the driver? (Score:4, Informative)
If that is true, then no amount of dirver manipulation will help, with the possible exception of a driver that "adds" extra dots to make the message meaningless. In theory, you could add extra dots, but in practice it would be ineffective unless you could gurantee perfect alignment (or the extra dots would be easy to filter out). Since some dots would come from software, and others come from hardware control programs, it's not a simple task to gurantee alignment.
Parent
Re:How much is in the driver? (Score:5, Informative)
The basic conclusion is that many of the watermarked printers share a Canon print engine -- he suspects it is this engine that is doing the watermarking. The US Government just had to convince the critical-equipment supplier to add the tracking - not all the printer companies. He also notes that the Tek Phaser printers don't have this because they were developed before the Canon engine. (Oh, how I longed for a phaser back in the day!)
Parent
Watermark with extra random patterns (Score:5, Interesting)
Re:Watermark with extra random patterns (Score:5, Funny)
Parent
The hardware involved... (Score:4, Informative)
Re:Investigate printer ink price-gouging instead? (Score:4, Insightful)
Parent
Re:Printers have RTC and CMOS battery? (Score:5, Informative)
The DocuColor printers in question are very high end printer/copiers that are installed and maintained by trained technicians known by Xerox as Customer Service Engineers or CSEs. When it breaks or needs parts, you call your CSE. Think "on-site support" but on steroids. You pay a ton for this.
The system clock is set by the installer CSE and possibly updated as needed on subsequent service calls, and there are MANY of those as DocuColors require frequent maintenance and upkeep. It is not uncommon to have service once a week for some models. Or worse. They can be touchy beasts. The machines, I mean. The CSEs can be your pal or your worst nightmare. I like the ones my bosses hate. Go fig.
So what is the clock for? Among other things, time stamps are used by the printshop for tracking when every single print was made including which operator made it. So no more late night "free copies" for your pals. Xerox also uses the logs for all sorts of legit reasons. Nothing evil there.
So what about resetting the clock? First you'd have to get the machine open. This is not like a computer with handy access panels and common PCBs, er, that's PWBs in Xerox-speak. You'd have to know the machine inside-out, have the tools and the skill to take it apart (God help you), and hope that the battery is resettable rather that buried inside a chip. Xerox is very, very aware of people trying to cheat the machine meters to make free copies so stuff like counters and clocks are already armored and protected from prying hands.
Assuming you managed to do all those things and got the machine back together, then it has to be recalibrated because taking it apart will have wrecked the system setup. So you have to call your CSE, who resets the clock straight away, probably by pushing the keys with the bones he removed from your hands for messing with his machine. If you're still alive at this point, you are right back where you started!
Side notes: the vast majority of DocuColors are leased out by Xerox rather than sold, so the machine is normally Xerox property from assembly to reman to reman to reman to junkyard. Why? Some of them can cost half a million and up for new, less for used, but either way these are not something people "buy" when they can simply lease. GE Credit is happy to finance the leases and end users find it much cheaper and they don't end up stuck with obsolete machines.
Many of the older machines can and do end up on the sale market and it is possible to buy one and own it, but it will still require service (lots for an old machine), toner, supplies, parts, and preventive maintenance. Xerox controls almost all the DocuColor parts, supplies, ink, and most of the trained CSEs so you pretty much have no choice but to sign on for a Xerox service contract even when you own the thing free and clear.
Yes, there ARE trained key operators who can get in and do SOME maintenance chores but only Xerox can get parts and has the technical knowledge to use them.
Parent