News for hackers. Stuff that matters.
Re:Police claims to have fingerprinted computer based on pri... by Someone on Friday May 13, 2022 @04:18AM (#31364719)
Most interesting parts (IMO):

“Program and program settings: When preparing the letter, WordPad for Windows is most likely used. Default settings for font, line spacing and paragraph are used. The page layout has been Letter.”

That, I think, can be inferred with good confidence from precisely measuring various font measurements, looking at how lines got broken, etc, and comparing that with a database of program defaults for a large set of OSes and programs.

“Device, operating system and video card : When designing the threat letter, a Windows PC has been used, with an operating system Windows 10 or 8.”

I guess either WordPad or the font got tweaked somewhat in that Windows version. Maybe WordPad started using ligatures more aggressively, its page width got a tiny bit wider, or, in the font, some letter shape or spacing table changed a tiny bit, or a character was added.

“The PC has had an integrated video card, Intel HD Graphics 630.”

That, for me, is the most intriguing part. Does Windows use the GPU to render fonts even if they get printed, and are there subtle differences between GPUs and their software rendering that, statistically, can be recovered from the somewhat noisy print?

Re:Police claims to have fingerprinted computer based on pri... by dagw on Friday May 13, 2022 @05:31AM (#31365150)
Does Windows use the GPU to render fonts even if they get printed

Most cheaper printers (esp. on Windows) use the GDI protocol for printing. These printers only know how to print rasterised images, so the document is rasterised by the OS/Print driver and only this final rasterised image is sent to the printer. This is different from higher end PCL/PS printers where the document is translated into a page description language and the printer is (partially) responsible for rasterising the final document for print.

Since Windows uses the GPU to render fonts I wouldn't be surprised if the same code is used to rasterise the fonts for GDI printing.

That being said I'm very surprised they can identify the GPU just from that, unless there is some specific bug in the driver for the card which produces an obvious font rendering artefact.

Re:Police claims to have fingerprinted computer based on pri... by noduerme on Friday May 13, 2022 @06:02AM (#31365331)
Brilliant comment. Coming at this as a typographer/graphic artist and erstwhile coder, I'd bet it comes down to reverse engineering anti-aliasing algorithms. I'm not sure how it's done in Windows, but on Macs there are various levels of crispness you can set in default type as it's rasterized and if you zoom in a bit they have very clearly recognizable differences. Take the four bottom-left pixels of a capital A at 300 ppi, and compare their ink value ratios with different anti-aliasing techniques, and I bet you could get a signature of what card did the rasterization.

Gaussian blur is your friend if you wanna send a death note, I guess.

Re:Police claims to have fingerprinted computer based on pri... by Someone on Friday May 13, 2022 @06:55AM (#31365755)
I don’t think printer drivers do anti-aliasing on text. The hardware of a printer does anti-aliasing for free.

Also, I doubt you can get conclusive evidence from a single letter. Luckily, your average random note has lot of them, even duplicated ones. I would carefully align and average out as many capital A’s as I had, and work with that.

Re:Police claims to have fingerprinted computer based on pri... by zinekeller on Friday May 13, 2022 @08:58AM (#31366990)
> I don’t think printer drivers do anti-aliasing on text. The hardware of a printer does anti-aliasing for free.

You missed the explanation above why you're wrong, at least on consumer non-PostScript printers. Most cheap printers nowadays passes the buck of rasterisation to Windows (and its horrible, security headache spooler). You can even check if which is which: in Windows 10, open Settings, then Devices, select Printers & scanners, select [your name of printer], press Manage, press Printer Options (not Printing options), open the Advanced tab and then click on the Print Processor... button. If it says "winprint" then Windows handles the rasteriser.

Re:Police claims to have fingerprinted computer based on pri... by kevin_thibedeau on Friday May 13, 2022 @11:40AM (#31369045)
Anti-aliasing text is of limited value at the resolutions printers can achieve. 1200+ DPI inkjets and lasers have been commonplace for over 20 years. That doesn't mean GDI variations won't influence pixels due to small numeric differences.
Re:Police claims to have fingerprinted computer based on pri... by _Microft on Friday May 13, 2022 @09:03AM (#31367042)
> The hardware of a printer does anti-aliasing for free.

I think they meant something like "ink smears".

Re:Police claims to have fingerprinted computer based on pri... by zinekeller on Friday May 13, 2022 @09:08AM (#31367089)
In that case, then it'll be purely a mechanical thing. Another thing that is still handled by the printer (unless its drivers are sophisticated, winprint isn't) is halftoning, but I'm not sure if that counts as anti-aliasing.
Re:Police claims to have fingerprinted computer based on pri... by noduerme on Friday May 13, 2022 @08:29AM (#31366665)
IDK. In the olden days, desktop printers sometimes had embedded font faces or PS1 fonts would be sent to the printer, but any vector file for large/high-res print quality had to be "ripped" or rasterized first, usually with a dedicated card. These cards definitely had signature looks and feels to them, but so did the fonts. There were differences between the way an Adobe Times New Roman would rip versus the one that came stock on your Apple IIsi.

Pinpointing a version of Windows, if it was printed from a stock OS font, could be as simple as comparing tiny differences in the vector files and knowing if one pixel would rasterize at 60% black versus 50%. To the extent that the rip goes through a graphics card, it would be knowing whether that card rendered the 60% as 58% or 62%.

I'm pretty sure if you scale it down, the printer driver will do an extra layer of downsampling and add its own anti-aliasing; but the printer hardware doesn't do that, it just sprays the dots it's told to spray, and in general the drivers replicate the pixels that are sent from Photoshop or in this case, MS Word, which uses something like QuickDraw used to be on a Mac, an embedded system process, to rasterize the fonts.

Re:Police claims to have fingerprinted computer based on pri... by lupire on Friday May 13, 2022 @08:08AM (#31366478)
Gaussian blur is mostly invertible. Need more randomness.
Re:Police claims to have fingerprinted computer based on pri... by noduerme on Friday May 13, 2022 @08:36AM (#31366746)
Depends on the tolerance of what you're trying to hide. If the goal is just to obliterate the way something was previously anti-aliased, or make it trigger tons of false-positives, then a small blur and not relying on the inbuilt rasterization would probably do the trick.

Prior to this it had never occurred to me. But yeah, more randomness. Noise filter and blur, then a bit more noise, then photograph it, print the photo, scan it on another device, put it in the washing machine, leave it on the porch for a week and repeat.

Re:Police claims to have fingerprinted computer based on pri... by sdenton4 on Friday May 13, 2022 @10:13AM (#31367900)
Mostly... It's a low pass filter, so if the information - anti aliasing techniques in this case - is concentrated in high frequency, it'll be wiped out.
Re:Police claims to have fingerprinted computer based on pri... by flutas on Friday May 13, 2022 @12:22PM (#31369539)
> unless there is some specific bug

Could also be by design, similar to printer identification dots. Have the artifacting vary every so slightly from one GPU to another. Then again, I feel (emotional statement, not of fact) that this would be known by now if it was a thing.

Re:Police claims to have fingerprinted computer based on pri... by mike_hock on Friday May 13, 2022 @01:07PM (#31370142)
I thought it was known that printers all leave a unique fingerprint (device-specific, not just model-specific).
Re:Police claims to have fingerprinted computer based on pri... by Ferrotin on Friday May 13, 2022 @02:30PM (#31371014)
Color printers are known to.
Re:Police claims to have fingerprinted computer based on pri... by hermitdev on Friday May 13, 2022 @12:23PM (#31369560)
I was reading these comments while simultaneously trying to get some work done. I was taking a screenshot of some settings to show to a coworker for verification and immediately noticed something was off about the screenshot. It looked nothing like the screen! Apparently screenshots on Win10 with HDR is kind of funny. It looks like everything is neon. Like the standard HN orange banner looks like a yellow highlighter. Funny thing is, if I take the screenshot from my non-HDR monitor, it looks as expected.

So...evidently from a sample of me, I can tell from which monitor a screenshot was taken...

Re:Police claims to have fingerprinted computer based on pri... by phkahler on Friday May 13, 2022 @09:49AM (#31367568)
This could all be deflection. All name-brand printers (in the US at least and probably everywhere) watermark printed pages with yellow dots that identify the printer serial number. If the printer is purchased with a credit card and the SN is scanned, there is a perfect trail from your printed page to the person who bought it. I suspect if that method was used they still may want to claim these other fingerprinting methods to avoid spreading the word about printers.
Re:Police claims to have fingerprinted computer based on pri... by reset-password on Friday May 13, 2022 @12:39PM (#31369765)
One other way this trail can be made is simply by installing the drivers. For example I noticed that when you complete the driver installation for a Brother color laser printer, the installer opens the default browser and navigates to brother.com/something/SERIAL_NO_OF_PRINTER. I am assuming that on the other end they're capturing the IP, fingerprinting the browser, and logging it all forever.
Re:Police claims to have fingerprinted computer based on pri... by joering2 on Friday May 13, 2022 @05:27PM (#31372711)
Brother is same level evil as Canon. I was proud to learn even my new Xerox Phaser 8550 is not fingerprinting paper.

https://www.eff.org/pages/list-printers-which-do-or-do-not-d...

Re:Police claims to have fingerprinted computer based on pri... by abakker on Friday May 13, 2022 @10:03AM (#31367754)
Got a source for this claim?

Edit: Specifically, what about printers that only print black and white?

Re:Police claims to have fingerprinted computer based on pri... by k1t on Friday May 13, 2022 @10:14AM (#31367910)
https://en.m.wikipedia.org/wiki/Machine_Identification_Code

https://www.eff.org/press/archives/2005/10/16

The implication is that only color printers are affected.

"The U.S. Secret Service admitted that the tracking information is part of a deal struck with selected color laser printer manufacturers, ostensibly to identify counterfeiters."

Re:Police claims to have fingerprinted computer based on pri... by macksd on Friday May 13, 2022 @10:35AM (#31368205)
People are really using consumer printers in counterfeiting?
Re:Police claims to have fingerprinted computer based on pri... by bragr on Friday May 13, 2022 @10:58AM (#31368523)
No because most will refuse to print anything with the EURion constellation.

https://en.m.wikipedia.org/wiki/EURion_constellation

Re:Police claims to have fingerprinted computer based on pri... by badwolf on Friday May 13, 2022 @01:41PM (#31370472)
Huh. Fascinating.
Re:Police claims to have fingerprinted computer based on pri... by joering2 on Friday May 13, 2022 @05:29PM (#31372722)
Same with photoshop. Try to open this in PS:

https://upload.wikimedia.org/wikipedia/commons/7/7b/Obverse_...

Re:Police claims to have fingerprinted computer based on pri... by bombcar on Friday May 13, 2022 @01:37PM (#31370435)
People will try anything, and I suspect more "counterfeiting" is prevented by the EURion constellation than we'd expect.

Probably just idiots playing around with the copier rather than dedicated gangs, but if it worked they might be tempted to say "Well ..."

https://old.reddit.com/r/mildlyinteresting/comments/1s8rl9/i...

Re:Police claims to have fingerprinted computer based on pri... by Ferrotin on Friday May 13, 2022 @02:32PM (#31371029)
This at least massively reduces anti-counterfeiters’ caseload.
Re:Police claims to have fingerprinted computer based on pri... by bombcar on Friday May 13, 2022 @07:10PM (#31373496)
IIRC some of the very early dollar bill acceptors on vending machines were perfectly happy with a black and white photocopy.
Re:Police claims to have fingerprinted computer based on pri... by loopback_device on Friday May 13, 2022 @10:21AM (#31367998)
It is quite well known these days, check the EFF [1] and Wikipedia [2] pages, there's info on the what, how, when and why

[1] https://www.eff.org/pages/list-printers-which-do-or-do-not-d... [2] https://en.m.wikipedia.org/wiki/Machine_Identification_Code

Re:Police claims to have fingerprinted computer based on pri... by shirleyquirk on Friday May 13, 2022 @10:14AM (#31367914)
https://en.m.wikipedia.org/wiki/Machine_Identification_Code but idk about how many printers do this or whether similar techniques are used for black+white printers (i.e. gray-scale modulation)
Re:Police claims to have fingerprinted computer based on pri... by not2b on Friday May 13, 2022 @06:22PM (#31373147)
Color printers must do this; black-and-white printers do not (and cannot, there's no yellow ink).
Re:Police claims to have fingerprinted computer based on pri... by thewebcount on Friday May 13, 2022 @01:51PM (#31370568)
> are there subtle differences between GPUs and their software rendering that, statistically, can be recovered from the somewhat noisy print?

I'm not sure these days when most GPUs are IEEE-754-compliant. But back in the mid to late 2000's I worked on a GPU renderer for video editing and we had a few filters that gave noticeably different results on different GPUs. One filter did a hard black and white threshold, then blurred the result, did another hard threshold, etc., in a loop. Because of differences in precision of the floating point values (24-bit on AMD at the time, if I recall correctly), the thresholds could produce minor differences that got magnified by the blurring, and then created new thresholds with minor differences, etc.

Even if all the GPUs are using IEEE-754 floats, there are driver differences that can cause the results to be slightly different, too. Like a simple GLSL mix() function could be implemented as result = x * a + y * (1 - a) (where x and y are 2 input pixels and a is the alpha of x). Or it could be implemented more efficiently as result = a * (x - y) + y. Doing the same math in a slightly different way can sometimes lead to slight differences in intermediate results which compound in the final result. So yeah, it may be possible to tease out some of these things by examining something like font rendering.

Re:Police claims to have fingerprinted computer based on pri... by rmbyrro on Friday May 13, 2022 @05:14AM (#31365050)
This is unrealiable and extremely risky to serve as case evidence.

Becomes extremely easy for malicious actors (out or inside the police) to fake evidence and frame anyone they'd like.

Re:Police claims to have fingerprinted computer based on pri... by _jal on Friday May 13, 2022 @12:35PM (#31369711)
That seems to be the norm with a lot of, um, creative criminal forensics.

Bite mark identification was used forever until blown up by particularly shameless grifting, and has never been shown to work as practiced. [1]

Tennessee still uses dowsing rods. [2]

Fingerprinting as practiced is a bundle of folk practice, guesses, and some science. Quality varies wildly. [3]

Fiber analysis, lie detectors, spatter analysis and many more techniques are all crap. When one bogus method is finally found legally unreliable, cops and prosecutors find a new one.

[1] https://innocenceproject.olemiss.edu/radley-balko-reports-on...

[2] https://www.themarshallproject.org/2022/03/17/witching-dowsi...

[3] https://www.aaas.org/resources/latent-fingerprint-examinatio...

Re:Police claims to have fingerprinted computer based on pri... by vintermann on Friday May 13, 2022 @06:32AM (#31365548)
It's probably meant as a lead, not as evidence. Given that this is a kidnapping, likely murder case, there's probably tons of evidence if you're looking at the right guy.

And I'm wondering about that, because we know the criminal must have been a pretty hard-core cryptocurrency nut. There aren't THAT many of them in Norway (they've already concluded they are a fluent Norwegian speaker).

Re:Police claims to have fingerprinted computer based on pri... by rmbyrro on Friday May 13, 2022 @11:38AM (#31369016)
My main concern is that this seems to be a precise lead. It might be unconsciously considered close to a real fingerprint.

Instead of facing it just as a lead, it might influence investigators to, consciously or not, build confidence in framing a (wrong) person and and end up building a compelling case against them.

Re:Police claims to have fingerprinted computer based on pri... by dagw on Friday May 13, 2022 @10:01AM (#31367712)
they've already concluded they are a fluent Norwegian speaker

The person who wrote the ransom they believe to be fluent in Norwegian, there could easily be other people involved who're foreign.

Re:Police claims to have fingerprinted computer based on pri... by alophawen on Friday May 13, 2022 @06:47AM (#31365683)
> because we know the criminal must have been a pretty hard-core cryptocurrency nut

Do we?

I was still under the impression everybody was blaming her husband for the disappearance.

Re:Police claims to have fingerprinted computer based on pri... by vintermann on Friday May 13, 2022 @07:22AM (#31365977)
I'm thinking of the actual kidnapper/killer. The husband has an alibi for the time of the disappearance. The suspicion against him was that he commissioned the disappearance of his wife, not that he did it himself.
Re:Police claims to have fingerprinted computer based on pri... by II2II on Friday May 13, 2022 @08:44AM (#31366830)
Presumably it is to aid in finding the equipment used. Once they find the equipment and can positively identify it, they can use other evidence to establish to probable user of that equipment.

As for malicious actors, wouldn't that be a risk for most forms of evidence? Likewise, wouldn't many of the techniques used to establish the validity of other forms of physical evidence be applicable when these techniques are used?

Re:Police claims to have fingerprinted computer based on pri... by rmbyrro on Friday May 13, 2022 @11:36AM (#31368985)
Fingerprints and DNA, for instance, are significantly less trivial to fake.
Re:Police claims to have fingerprinted computer based on pri... by greggsy on Friday May 13, 2022 @07:44AM (#31366225)
If there’s only one PC in a sea of Macs then it’s a good way to narrow it down. Even better if you can use the application characteristics to determine that someone was using a particular app at a particular time, then initiated a print. It’s not irrefutable evidence, but it’s someone that tells police that a specific event occurred, for which the suspect would be compelled to provide a reasonable response.
Re:Police claims to have fingerprinted computer based on pri... by oneoff786 on Friday May 13, 2022 @07:44AM (#31366227)
I had to chuckle at the first part.

Ah yes, I see they’re using the default formatting options. That narrows down our search to 99.9999% of the population.

Re:Police claims to have fingerprinted computer based on pri... by dagw on Friday May 13, 2022 @08:16AM (#31366565)
Letter paper size isn't the default paper size for most Windows computers in Norway, so that could be something.
Re:Police claims to have fingerprinted computer based on pri... by iampivot on Friday May 13, 2022 @11:29AM (#31368902)
It's however the default size for most printer drivers, so it's often selected as default when trying to print for the first time.
Re:Police claims to have fingerprinted computer based on pri... by bombcar on Friday May 13, 2022 @01:39PM (#31370449)
Huh you'd think Windows EU edition or whatever would be smart enough to default to A4.
Re:Police claims to have fingerprinted computer based on pri... by moistly on Friday May 13, 2022 @01:43PM (#31370492)
Europe doesn’t use letter-sized paper, they use A4. I rather doubt that printer drivers installed on a Norwegian computer default to an unusable paper size.
Re:Police claims to have fingerprinted computer based on pri... by vegardlarsen on Friday May 13, 2022 @02:01PM (#31370703)
We use the same printers and printer drivers as everyone else in the world. So it does actually default to Letter, and you usually have to change it upon first install. I guess it all comes down to who wrote the printer driver.
Re:Police claims to have fingerprinted computer based on pri... by cure on Friday May 13, 2022 @05:31PM (#31372731)
I have news for you - the "PC LOAD LETTER" meme works all around the world. Printers and drivers a generally quite dumb about this, and default to Letter format (and this does not make any sense, obviously).
Re:Police claims to have fingerprinted computer based on pri... by sokoloff on Friday May 13, 2022 @08:52AM (#31366916)
HD630 is the integrated GPU on Intel’s Kaby Lake line of processors.

That narrows it down to coming from 10s of millions of computer perhaps?

Re:Police claims to have fingerprinted computer based on pri... by ridgered4 on Friday May 13, 2022 @09:30AM (#31367338)
I'm actually surprised they could narrow it down even that much. The skylake and coffeelake iGPUs always seemed basically identical to the kabylake one.
Re:Police claims to have fingerprinted computer based on pri... by chipsa on Friday May 13, 2022 @01:40PM (#31370464)
I'd be surprised if there was any noticeable difference between the HD630, and any of the other Gen9 architecture iGPUs.
Re:Police claims to have fingerprinted computer based on pri... by bryanrasmussen on Friday May 13, 2022 @07:52AM (#31366307)
I would guess there must be forensic tools to detect this stuff, that the Norwegian police don't just have the best experts in Windows and printers in the world who then went through all the various systems, but that there should be a database of these variations somewhere and tools you can use to analyze a printed output to figure out where and what it was produced by, so what are these tools is my question.
Re:Police claims to have fingerprinted computer based on pri... by mjbeswick on Friday May 13, 2022 @05:12AM (#31365038)
Maybe most of this profile is pure speculation based statical probability?
Re:Police claims to have fingerprinted computer based on pri... by Someone on Friday May 13, 2022 @07:08AM (#31365866)
In the end, it’s statistics, yes. Maybe, a Mac running a windows VM could produce similar output, or somebody could run Linux, copy over the specific fonts from Windows 8, tweak font rendering to match Windows (e.g. in when to use type hints), fiddle with line spacing and page width until their LibreOffice or abiword produces the same line breaks and spacing, etc, but that somebody would try to do that is quite unlikely to start with and also may be very hard to accomplish (and that’s something experts could have tried to do. If so, they could testify about the difficulty of pulling it off)

⇒ I don’t think it’s fair to call this speculation, let alone pure speculation.

Re:Police claims to have fingerprinted computer based on pri... by mmcgaha on Friday May 13, 2022 @04:22PM (#31372146)
This is why I always write my threats and ransom requests in pure TeX.

Seriously though, I thought printers have been using microdots as identifiers for years. Is this just an old wives tale?

Re:Police claims to have fingerprinted computer based on pri... by joering2 on Friday May 13, 2022 @05:36PM (#31372772)
So it looks like both printer's fingerprinting and windows "fingerprinting" can both be fooled by simply making a B/W photocopy at local FedEx. Perhaps do copy of a copy of a copy 5 times and you should be good to go!

Just make sure you pay with cash.