Hidden Codes in Printers Cracked 562
r84x writes "A research team led by the Electronic Frontier Foundation (EFF) recently broke the code behind tiny tracking dots that some color laser printers secretly hide in every document.
The U.S. Secret Service admitted that the tracking information is part of a deal struck with selected color laser printer manufacturers, ostensibly to identify counterfeiters. However, the nature of the private information encoded in each document was not previously known.
"We've found that the dots from at least one line of printers encode the date and time your document was printed, as well as the serial number of the printer," said EFF Staff Technologist Seth David Schoen."
more links (Score:5, Informative)
More information can be found on the EFF's printer-privacy webpage. [eff.org]
Also interesting is Andrew Bunnie's flat bed page scanner mod [bunniestudios.com] to use blue light instead of white. This made the yellow tracking dots easier to see, and the whole page could be seen at once to determine the pattern they made.
Re:Before... (Score:5, Informative)
Most laser printers are rather expensive items. If you paid with a credit card, then yes, they have it in a database. (All stores record the serial number of high-ticket items they sell. I've actually gotten recall notices this way, so I know the store shares it with the manufactorer.) Even if you paid in cash, if you filled in the warranty card, they have it. Got a mail-in rebate? On file. Ever had to have it serviced? You're on file.
Er, huh? (Score:1, Informative)
The best they could do is identify which store the item was shipped to. And really, even that is a stretch. In all likelihood a company has no idea which stores got products with which serial numbers. They probably know which serial numbers went to which regional distribution centre, but thats it.
If you honestly think that companies have the time and money to track things to that ability, you are crazy. It would cost them *millions*, and benefit them zero. They would be fighting tooth and nail against any request by the government to do that.
The thing serial numbers are used for is to identify the date and batch of the item (so they can track it back to the plant and workers if there are an unusually high number of defects in a batch), and also to track warrantys. That is it. Unless you file a warranty claim a company has no way to correltate that back to you, and really, they have no reason to waste money on that either.
Re:Conspiracy math (Score:5, Informative)
Even if all the database can tell them reliably is that HP ColorLaserJet Model 55 Serial Number 89928798734 was distributed to a certain Best Buy store, that goes a long way. When the Secret Service finds counterfeit bills, they know from the serial what store it was originally purchased in. Chances are it didn't move far, and chances are that Best Buy's records can lead to a very short list of potential buyers. Even if it was resold by one of them, the investigation becomes fairly trivial at that point.
But perhaps more importantly, even if you can't use it (embedded serial numbers in documents) as a primary method of tracking down the counterfeiter, you can certainly use it as court evidence once you do catch them by other means. It's pretty damning evidence if they can show that they seized a printer with serial number 89928798734 at your home address, and they can also show conterfiet currency or documents with the same serial number embedded that showed up elsewhere.
Re:Old Communist ploy gets updated (Score:5, Informative)
That's in the article:
http://www.eff.org/Privacy/printers/list.php [eff.org]
The hardware involved... (Score:4, Informative)
Re:How much is in the driver? (Score:5, Informative)
My bet is on the rasterizer.
-molo
Re:more links (Score:2, Informative)
Re:Er, huh? (Score:4, Informative)
And yes, stores can be required to scan those S/Ns if the feds so desire, and it can be made to stick. Bank tellers don't get paid all that much more than Best Buy clerks, but the threat of 20 years in the federal pen gives them a bit of incentive to follow the money-laundering reporting procedures. Heck, I heard a discussion between two entry-level postal clerks the other day about how much fun they had spotting drug dealers and reporting them.
sPh
Re:Before...what? (Score:3, Informative)
Thanks largely to the invention of this nifty thing called a microprocessor adding the serial number on a sticker on each box costs tenths of pennies, not millions, and saves thousands if not millions in dealing with the distribution & maintenance channels.
My Toshiba laptop box not only had the serial number on the box, but when it went in for service the Tohiba rep knew which retailer it was sold through...
feel free to mod this down (-1 mod angry).
Re:How much is in the driver? (Score:1, Informative)
Re:Er, huh? (Score:2, Informative)
Yes actually I do (I have worked in the print industry). You don't from your comments. Barcodes do in fact have serial numbers on them. Normally the actual serial number is printed below the barcode in question.
Printing custom serial numbers to boxes is very easy to do and does not have a huge major factor on the pricing of the box. Even if the printer company don't do the boxes in house they can have a conveyor type system that scans the serial on the printer and drops a label onto the box with the serial number. That serial number would have a batching number (so they can determine what load went where).
>The best they could do is identify which store the item was shipped to.
From there they can track where the printer was sold from there. Shops keep records of sales which can be cross referenced against Credit card, CCTV or interviewing people on the day.
>If you honestly think that companies have the time and money to track
> things to that ability, you are crazy. It would cost them *millions*,
> and benefit them zero
Actually any company that doesn't track is stock it probably costing themselves millions.
Do you even work? o_O
Re:How much is in the driver? (Score:4, Informative)
If that is true, then no amount of dirver manipulation will help, with the possible exception of a driver that "adds" extra dots to make the message meaningless. In theory, you could add extra dots, but in practice it would be ineffective unless you could gurantee perfect alignment (or the extra dots would be easy to filter out). Since some dots would come from software, and others come from hardware control programs, it's not a simple task to gurantee alignment.
Re:How much is in the driver? (Score:5, Informative)
The basic conclusion is that many of the watermarked printers share a Canon print engine -- he suspects it is this engine that is doing the watermarking. The US Government just had to convince the critical-equipment supplier to add the tracking - not all the printer companies. He also notes that the Tek Phaser printers don't have this because they were developed before the Canon engine. (Oh, how I longed for a phaser back in the day!)
These are the printers found so far (Score:2, Informative)
Yes, there are many on that list.
Re:Before... (Score:2, Informative)
Maybe 99% of the world doesn't give a shit about anything you do. You're obviously not important.
Re:Checkout scanners... (Score:5, Informative)
If they track it, everyone does. Everything I mail order has the barcode scanned and printed on the packing slip.
Get a clue.
Re:Checkout scanners... (Score:3, Informative)
Re:Printer Friendly Version? (Score:3, Informative)
So it could be argued that this is simply taking us back to the good old days of Miss Marple and Columbo
Re:Printers have RTC and CMOS battery? (Score:5, Informative)
The DocuColor printers in question are very high end printer/copiers that are installed and maintained by trained technicians known by Xerox as Customer Service Engineers or CSEs. When it breaks or needs parts, you call your CSE. Think "on-site support" but on steroids. You pay a ton for this.
The system clock is set by the installer CSE and possibly updated as needed on subsequent service calls, and there are MANY of those as DocuColors require frequent maintenance and upkeep. It is not uncommon to have service once a week for some models. Or worse. They can be touchy beasts. The machines, I mean. The CSEs can be your pal or your worst nightmare. I like the ones my bosses hate. Go fig.
So what is the clock for? Among other things, time stamps are used by the printshop for tracking when every single print was made including which operator made it. So no more late night "free copies" for your pals. Xerox also uses the logs for all sorts of legit reasons. Nothing evil there.
So what about resetting the clock? First you'd have to get the machine open. This is not like a computer with handy access panels and common PCBs, er, that's PWBs in Xerox-speak. You'd have to know the machine inside-out, have the tools and the skill to take it apart (God help you), and hope that the battery is resettable rather that buried inside a chip. Xerox is very, very aware of people trying to cheat the machine meters to make free copies so stuff like counters and clocks are already armored and protected from prying hands.
Assuming you managed to do all those things and got the machine back together, then it has to be recalibrated because taking it apart will have wrecked the system setup. So you have to call your CSE, who resets the clock straight away, probably by pushing the keys with the bones he removed from your hands for messing with his machine. If you're still alive at this point, you are right back where you started!
Side notes: the vast majority of DocuColors are leased out by Xerox rather than sold, so the machine is normally Xerox property from assembly to reman to reman to reman to junkyard. Why? Some of them can cost half a million and up for new, less for used, but either way these are not something people "buy" when they can simply lease. GE Credit is happy to finance the leases and end users find it much cheaper and they don't end up stuck with obsolete machines.
Many of the older machines can and do end up on the sale market and it is possible to buy one and own it, but it will still require service (lots for an old machine), toner, supplies, parts, and preventive maintenance. Xerox controls almost all the DocuColor parts, supplies, ink, and most of the trained CSEs so you pretty much have no choice but to sign on for a Xerox service contract even when you own the thing free and clear.
Yes, there ARE trained key operators who can get in and do SOME maintenance chores but only Xerox can get parts and has the technical knowledge to use them.
Re:Blue light scanner mod ? (Score:3, Informative)
With a 600DPI scanner, those work just fine.
Personally, I used the following steps, and ended up with glaringly obvious black dots (~10-30 pixels) on a white background:
1) Print a supplies status page (or anything with a lot of empty space)
2) Scan at 1200DPI (but 600 works, just takes more care in doing the next few steps)
3) Drop the red and green channels to nothing (you can probably stop here, but as a perfectionist...)
4) Shift the hue 50% toward red (or green, doesn't matter)
5) Convert to greyscale (or saturation to zero)
6) Brighten the image by 80% and boost the contrast 20%
7) Repeat step 6 until satisfied (took me about 5 passes to get basically a black-and-white image)
And there you have it. If you can't see the dots now, you don't have them.
Interestingly enough, the printer I used doesn't appear to conform to the same layout described on the EFF's page.
Re:Er, huh? (Score:5, Informative)
This is also true of the mid-range color laser printers you purchase at your local Best Buy or Micro Center. In fact, if you open your eyes at the checkout and actually pay attention, you would notice that after they scan the bar-code, their register prompts them to either scan the serial number bar-code, or hand-key in the serial number. Now, they may not be required to record your name and address, but they most certainly can trace it back to your credit card.
The whole point of this is to catch counterfeiters. It's useless to know the serial-number of a device if you don't know where it was sold.
Re:Maybe its not a weakness (Score:1, Informative)
It was the British Intellgience primarily that indicated Iraq had those WoMD.
Re:Serious Question (Score:2, Informative)
Re:Er, huh? (Score:2, Informative)
It is astoundingly rare for cashiers to actually scan the serial numbers off product boxes, even when they're available as barcodes. Far more often they simply scan the normal UPC a second time or scan the model number UPC.
If they have to actually read the serial number and type it in they generally either skip the serial or fat finger the keyboard to make it look as if they've entered a serial number, creating no end of problems for warranty reimbursement.
If the security of the nation is coming down to cashiers who make six dollars an hour... well then, I guess we're up the creek.