NYT journalist hacked with Pegasus after reporting on previous hacking attempts

Re:NYT journalist hacked with Pegasus after reporting on pre... by tablespoon on Sunday October 24, 2021 @09:08PM (#28983498)

> I really hope the blur on the picture (https://citizenlab.ca/wp-content/uploads/2021/10/Hubbard-Ima...) isn't hiding anything actually important because that can almost certainly be de-blurred with the right tooling.

Yeah, the right way to use blurring is to mockup a lookalike for content you want to hide, then blur the mockup.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by Stupulous on Sunday October 24, 2021 @09:36PM (#28983643)

You don't even need this. I searched "unblur" in Google Play Store, downloaded the first result, tweaked the settings a touch, and I could make out the characters. The whole process took a couple minutes. If the data actually needs to be hidden, this picture should be taken down.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by notyourwork on Sunday October 24, 2021 @10:54PM (#28984063)

It sounds like you didn’t read the post you are replying to. They indicated a mock copy should be made to avoid techniques reconstructing the data.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by Stupulous on Sunday October 24, 2021 @11:18PM (#28984177)

Yeah, I replied to the wrong comment, sorry. I navigated away and skimmed to figure out where I was when I came back.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by deserted on Thursday October 28, 2021 @02:31AM (#29023050)

if you generate a lookalike full of UUIDs, you don't really need to blur except for dramatic effect I guess.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by fabianhjr on Sunday October 24, 2021 @10:01PM (#28983781)

I just go solid opaque bar. Way easier to do and harder to screw up.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by johnfn on Sunday October 24, 2021 @10:58PM (#28984083)

Amusingly enough, people have even screwed this up. I recall some government agency trying to censor data with a black bar, but the problem was that the data was in a SVG-like document, so people could just delete the bars from the document and see the apparently-censored text.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by mjevans on Monday October 25, 2021 @02:46AM (#28985061)

I built a redaction process for a small company once.

My critical security step was rendering out the PDF as individual flat image files, then re-assembling it like a traditionally photo-copied document.

That way the loss-full operation is enforced, at the cost of forcing end users to OCR unsearchable image-scan (like) PDFs.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by hyper_dynamics on Monday October 25, 2021 @05:36AM (#28985954)

It's the only way to be sure!

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by raxxorrax on Monday October 25, 2021 @08:15AM (#28986910)

You could replace the censored text with gibberish before blacking it out. Or some secret message for QAnons to find.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by pvillano on Monday October 25, 2021 @07:20PM (#28994444)

well if you had an open (.odf) or openable (.doc≈xml) format you could replace strings and be sure something was gone

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by eeegnu on Monday October 25, 2021 @01:05AM (#28984629)

It would be funny to place fake data behind the removable bars for tech savvy people to find.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by geoduck14 on Monday October 25, 2021 @11:33AM (#28988980)

> It would be funny to place fake data behind the removable bars for tech savvy people to find.

Tech savvy people, but also journalists

https://arstechnica.com/tech-policy/2021/10/missouri-gov-cal...

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by tait on Sunday October 24, 2021 @11:40PM (#28984286)

I remember a version of this happening with PDFs

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by lelandfe on Monday October 25, 2021 @04:30AM (#28985657)

Yep - Apple wound up adding a “Redact” tool to Preview.app for PDFs, likely in response to all the people who just drew shapes over selectable sensitive text.

https://eclecticlight.co/2020/12/11/how-effective-and-safe-i...

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by franga2000 on Monday October 25, 2021 @02:05AM (#28984879)

The EU has redacted PDFs this way a number of times, but I don't think anything truly sensitive ever leaked.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by ghostly_s on Monday October 25, 2021 @01:08AM (#28984642)

This has happened with PDFs many, many times.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by rincebrain on Monday October 25, 2021 @12:32AM (#28984524)

I believe the US government did this at least once, by implementing the black bars in a PDF as a separate object, so the unredacted item was intact in the files they shared.

Whoops.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by bayindirh on Monday October 25, 2021 @02:26AM (#28984965)

I remember that. Unredacted versions were also circulated.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by stronglikedan on Monday October 25, 2021 @10:08AM (#28987975)

> just delete the bars

I think you mean "illegally hack the black bars".

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by tablespoon on Monday October 25, 2021 @09:23PM (#28995320)

> I just go solid opaque bar. Way easier to do and harder to screw up.

There may be graphic design reasons you don't want to do that. A big black redaction bar isn't much of an illustration.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by csomar on Sunday October 24, 2021 @07:33PM (#28982922)

What's even worse is that he blurred "ts/" from "attachments", kinda to give you a hint on how to de-blurr.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by flatiron on Monday October 25, 2021 @07:26AM (#28986565)

https://en.m.wikipedia.org/wiki/Christopher_Paul_Neil

Pedo who used to swirl his face not knowing people can unswirl.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by peanut_worm on Sunday October 24, 2021 @06:44PM (#28982626)

man why do people even take the gamble of using a blur just use a opaque box

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by warent on Sunday October 24, 2021 @07:48PM (#28983037)

Life imitates art I suppose! You don't see opaque boxes used in Hollywood productions. Blur matches a popular fantasy aesthetic

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by qqtt on Sunday October 24, 2021 @08:58PM (#28983453)

Opaque boxes have been issues before, when they end up being "semi-transparent" and you can up the brightness to beat them.

Safest is probably just to cut/crop the sensitive bits out.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by Breza on Thursday November 04, 2021 @07:59AM (#29106005)

This is how I get FOIA responses. Agencies just remove the pieces they don't want me to see, sometimes with a code to tell me why it was excised. I use the redaction feature built into Acrobat.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by raxxorrax on Wednesday October 27, 2021 @06:37AM (#29011442)

The information is lost if you have a flat image without any layers. You should take additional steps for other formats of course. Granted, it has to be completely opaque of course.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by geoduck14 on Monday October 25, 2021 @11:39AM (#28989050)

I've used blur in the past. I assumed it was just as secure (please don't hate me!).

I did blur over black box because the blur was less visually obtrusive

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by samstave on Sunday October 24, 2021 @08:28PM (#28983279)

Perhaps 'someone' wanted it blurred for exactly the reason they want to de-blur it later....

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by smoldesu on Sunday October 24, 2021 @06:48PM (#28982660)

A certain subset of hackers have had a Gaussian-blur fetish for half a decade now, at least.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by booleandilemma on Sunday October 24, 2021 @07:21PM (#28982846)

Those strings in the center look like UUIDs.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by boppo1 on Sunday October 24, 2021 @05:59PM (#28982320)

Really? Seems blurred enough to me that even some sort of ML would spit out wrong characters.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by generalizations on Sunday October 24, 2021 @06:02PM (#28982350)

Known font, known range of possible characters (almost certainly ascii), and probably several blurred characters in there that we know (like the t in attachment). If the blur is differentiable per-character, it's probably reversible.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by warent on Sunday October 24, 2021 @07:52PM (#28983063)

Even without automation. Just make a list of blurred alphanumerics, then match every blurred character in the picture against the character list. with some patience probably doable in a single day

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by ansgri on Monday October 25, 2021 @07:50AM (#28986748)

That’s called generative recognition, and it’s the best way to do it (probably can be formally proved under some noise model assumptions) if you have a good model of the data and enough computational resources.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by boppo1 on Thursday November 04, 2021 @10:27PM (#29114818)

What tools do people use for stuff like this? A python library? C++?

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by spicybright on Sunday October 24, 2021 @08:44PM (#28983371)

Probably the most time efficient way to do it tbh.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by derac on Sunday October 24, 2021 @06:43PM (#28982622)

You don't need ml. If you know the font and blurring algorithm (or a close approximation), you blur all letters of the font at that size and compare output.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by dan-robertson on Sunday October 24, 2021 @07:41PM (#28982981)

Most of the time, blurring is down with a Gaussian blur and this is, in theory, reversible. In practice what is actually done is round_to_fraction_over_256(gaussian_blur(point, image, …)) so there is an error in the unblurring process. But this error is often not insurmountable, especially with extra information.

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by lmilcin on Sunday October 24, 2021 @07:49PM (#28983042)

Actually, if you can identify the exact font and exact location of each letter (as is in this case) it doesn't matter what kind of blur it is.

If you assume the photo was made with one of the consumer applications, there are only so many popular bluring algorithms. You can brute force it quite easily by testing each character and each type of blur until you get exact match (and in many cases even inexact will suffice).

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by birdyrooster on Sunday October 24, 2021 @06:06PM (#28982373)

Not at all, I can already make out the characters and recognized quickly that all but the last 4 blurred characters are hexadecimal and the last appear to be [a-z][A-Z]

[ Parent | on HN ]

Re:NYT journalist hacked with Pegasus after reporting on pre... by seba_dos1 on Monday October 25, 2021 @04:26PM (#28992701)

It's blurred lightly enough for me to be able to tell at least some characters just with my eyes.

[ Parent | on HN ]