Police claims to have fingerprinted computer based on printed document

https://www.nrk.no/norge/nye-opplysninger-om-trusselbrevet-i-forsvinningssaken_-_-vet-vi-sa-a-si-alt-om-dette-dokumentet-1.15965322

by chha • 4 years ago

192 126 4 years ago

nrk.no

bryanrasmussen2• 4 years ago

Norwegian - google translate to English https://www-nrk-no.translate.goog/norge/nye-opplysninger-om-...

smilespray• 4 years ago

Most of these forensic findings use publicly known techniques.

What does intrigue me is how they managed to determine the graphics card.

Anyone?

tpmx• 4 years ago

It's odd. If it was from microdots they should know a lot more than about the printer than "most likely an HP inkjet".

rob74• 4 years ago

Or they do know more, but they're not releasing everything? The details they have published are not that useful in pinpointing a suspect - I mean, there are probably thousands of Norwegians who have a PC/laptop with Intel integrated graphics, Windows 8/10, an HP printer and who buy paper and envelopes from Clas Ohlson (a chain with over 200 stores).

sim7c00• 4 years ago

there's a lot of techniques used in such research which is not 'public knowledge' (even though a lot of techies might know them). Hence, information might purposfully be a bit vague, to give the idea they did not reach certain conclusions.

I'd expect they would, as you, know the exact model and make of the printer if it was microdots.

They can also have libraries of things printed with lots of printers to analyse the quality of print etc., and then get an estimate for example by a neural network examining artefacts. in such a case, it would never be 100% certain, but maybe 95-99% range somewhere if they do it good.

I can _imagine_ such techniques might even also get to the point where they can somewhat certainly identify other aspects of the pc like graphics cards, even though they don't know exactly how the network will draw these conclusions.

phire2• 4 years ago

It could theoretically effect font rendering, but I really doubt it.

It's more likely the printer driver have encoded information about the gpu into the yellow microdots [1] that many color printers use to trace pages.

But if they have microdots, then they really should have more information.

[1] https://en.wikipedia.org/wiki/Machine_Identification_Code

cm2187• 4 years ago

What about B&W laser printers?

hoistbypetard2• 4 years ago

What does intrigue me is how they managed to determine the graphics card.

Cheap GDI printers use the PC for rendering. I find it a bit surprising that would give enough to identify a specific card from a printed sample, but it certainly seems plausible.

kuroguro• 4 years ago

There's quite a few papers on browser fingerprinting via canvas / webgl, I assume it's similar. Here's one talking about (among other things) fonts and GPU detection:

https://hovav.net/ucsd/dist/canvas.pdf

1970-01-01• 4 years ago

PCL6 and WYSIWYG is my guess.

https://support.hp.com/us-en/document/c00068221#AbT3

shakna2• 4 years ago

I assume a lot of that information comes from the Machine Identification Code [0], the "yellow dots" emitted by almost all printers.

There's a number of encoding schemes [1], though most of those only identify the printer - they don't go far enough to identify the graphics card or OS where it originated. That's a new capability - if it's being accurately relayed here.

[0] https://en.m.wikipedia.org/wiki/Machine_Identification_Code

[1] https://dl.acm.org/doi/10.1145/3206004.3206019

rospaya• 4 years ago

emitted by almost all printers

I believe it's only by some copiers and laser printers, not inkjets for example.

einr2• 4 years ago

Indeed if they had the identification code they would have been able to pinpoint the model and serial number of the printer, but they haven't released that information -- only that it is a HP printer with HP 302 or 304 model ink cartridges, which I assume is based on analysis of the chemical composition of the ink.

lupire3• 4 years ago

Surely only color printers print yellow dots?

Aachen• 4 years ago

You ever seen a black and white printer printing yellow?

Or do you mean light gray dots or so? Because I haven't heard of such a thing but find it hard to prove this negative.

IshKebab• 4 years ago

Identifying the graphics card/OS doesn't sound impossible.

They figured out it was Wordpad (presumably based on line breaking or similar) which narrows it down to Windows, and the graphics drivers probably subtly affect the font rendering in the same way that can be used for canvas fingerprinting.

That said, Windows 8 or 10 using Wordpad and Intel integrated graphics doesn't exactly narrow it down.

jklinger410• 4 years ago

IIRC the yellow dots just identify the printer, not the computer.

93po• 4 years ago

The printer, which was likely bought with a credit card and whose serial number was documented when purchased or when installing drivers that phone home with IP address, location, etc.

xattt• 4 years ago

All the other details are fairly straightforward (toner, envelope, paper, etc) that can be nailed down with enough legwork, but I am wondering how they possibly had figured out the GPU of machine.

- Are there certain rendering artifacts that can be seen on printed glyphs that give clues to the GPU?

- Or, are they going by heuristics here? (I.e. it was XYZ GPU, because it was a common machine that at the time that would be running Win 8 or 10)

shakna2• 4 years ago

Are there certain rendering artifacts that can be seen on printed glyphs that give clues to the GPU?

Most printers will do their own rendering, it's not often that a text document gets pre-rendered by the OS.

If it was printed straight from WordPad without being converted to an image, there's no artefact from the host OS, there.

hoistbypetard2• 4 years ago

Most printers will do their own rendering, it's not often that a text document gets pre-rendered by the OS.

Without surveying the industry, I doubt that's accurate. Most inexpensive home printers sold to purchasers of Windows PCs are GDI printers. Part of the cost savings associated with those comes from using the PC to render the document.

formerly_proven2• 4 years ago

This is an ongoing investigation, the police don't have to be truthful in their releases. It might be a guess, it might be because they're already fairly sure who did it or is an accomplice and want to create pressure. They might know it for entirely different reasons than analyzing a piece of paper.

pilsetnieks• 4 years ago

It's Norwegian police, though, so they might be held to higher standards of accountability.

einr2• 4 years ago

On the surface it seems like a very strange assertion.

Even if there were subtle GDI rendering differences -- which I doubt -- it is hard to believe that a printout would let them positively identify Intel HD Graphics 630 specifically, as opposed to say HD Graphics 610 or 615 which are slightly slower clocked versions of the same GPU released at the same time and which almost definitely use the same drivers and GDI rendering system.

But if the information comes from elsewhere, as in already having a suspect and knowing what computer they used -- they should reasonably have given more information from the same source -- CPU model, etc.

I can't imagine a possible way to leak only GPU info -- unless GDI or the Intel drivers has some secret mechanism for intentionally rendering some sort of subtle identification code onto printer output.

It's just really hard to understand.

at_a_remove• 4 years ago

I was wondering if they weren't working on a parallel construction angle.

Someone3• 4 years ago

Most interesting parts (IMO):

“Program and program settings: When preparing the letter, WordPad for Windows is most likely used. Default settings for font, line spacing and paragraph are used. The page layout has been Letter.”

That, I think, can be inferred with good confidence from precisely measuring various font measurements, looking at how lines got broken, etc, and comparing that with a database of program defaults for a large set of OSes and programs.

“Device, operating system and video card : When designing the threat letter, a Windows PC has been used, with an operating system Windows 10 or 8.”

I guess either WordPad or the font got tweaked somewhat in that Windows version. Maybe WordPad started using ligatures more aggressively, its page width got a tiny bit wider, or, in the font, some letter shape or spacing table changed a tiny bit, or a character was added.

“The PC has had an integrated video card, Intel HD Graphics 630.”

That, for me, is the most intriguing part. Does Windows use the GPU to render fonts even if they get printed, and are there subtle differences between GPUs and their software rendering that, statistically, can be recovered from the somewhat noisy print?

mjbeswick• 4 years ago

Maybe most of this profile is pure speculation based statical probability?

Someone3• 4 years ago

In the end, it’s statistics, yes. Maybe, a Mac running a windows VM could produce similar output, or somebody could run Linux, copy over the specific fonts from Windows 8, tweak font rendering to match Windows (e.g. in when to use type hints), fiddle with line spacing and page width until their LibreOffice or abiword produces the same line breaks and spacing, etc, but that somebody would try to do that is quite unlikely to start with and also may be very hard to accomplish (and that’s something experts could have tried to do. If so, they could testify about the difficulty of pulling it off)

⇒ I don’t think it’s fair to call this speculation, let alone pure speculation.

rmbyrro3• 4 years ago

This is unrealiable and extremely risky to serve as case evidence.

Becomes extremely easy for malicious actors (out or inside the police) to fake evidence and frame anyone they'd like.

vintermann5• 4 years ago

It's probably meant as a lead, not as evidence. Given that this is a kidnapping, likely murder case, there's probably tons of evidence if you're looking at the right guy.

And I'm wondering about that, because we know the criminal must have been a pretty hard-core cryptocurrency nut. There aren't THAT many of them in Norway (they've already concluded they are a fluent Norwegian speaker).

greggsy2• 4 years ago

If there’s only one PC in a sea of Macs then it’s a good way to narrow it down. Even better if you can use the application characteristics to determine that someone was using a particular app at a particular time, then initiated a print. It’s not irrefutable evidence, but it’s someone that tells police that a specific event occurred, for which the suspect would be compelled to provide a reasonable response.

II2II• 4 years ago

Presumably it is to aid in finding the equipment used. Once they find the equipment and can positively identify it, they can use other evidence to establish to probable user of that equipment.

As for malicious actors, wouldn't that be a risk for most forms of evidence? Likewise, wouldn't many of the techniques used to establish the validity of other forms of physical evidence be applicable when these techniques are used?

_jal• 4 years ago

That seems to be the norm with a lot of, um, creative criminal forensics.

Bite mark identification was used forever until blown up by particularly shameless grifting, and has never been shown to work as practiced. [1]

Tennessee still uses dowsing rods. [2]

Fingerprinting as practiced is a bundle of folk practice, guesses, and some science. Quality varies wildly. [3]

Fiber analysis, lie detectors, spatter analysis and many more techniques are all crap. When one bogus method is finally found legally unreliable, cops and prosecutors find a new one.

[1] https://innocenceproject.olemiss.edu/radley-balko-reports-on...

[2] https://www.themarshallproject.org/2022/03/17/witching-dowsi...

[3] https://www.aaas.org/resources/latent-fingerprint-examinatio...

dagw3• 4 years ago

Does Windows use the GPU to render fonts even if they get printed

Most cheaper printers (esp. on Windows) use the GDI protocol for printing. These printers only know how to print rasterised images, so the document is rasterised by the OS/Print driver and only this final rasterised image is sent to the printer. This is different from higher end PCL/PS printers where the document is translated into a page description language and the printer is (partially) responsible for rasterising the final document for print.

Since Windows uses the GPU to render fonts I wouldn't be surprised if the same code is used to rasterise the fonts for GDI printing.

That being said I'm very surprised they can identify the GPU just from that, unless there is some specific bug in the driver for the card which produces an obvious font rendering artefact.

noduerme3• 4 years ago

Brilliant comment. Coming at this as a typographer/graphic artist and erstwhile coder, I'd bet it comes down to reverse engineering anti-aliasing algorithms. I'm not sure how it's done in Windows, but on Macs there are various levels of crispness you can set in default type as it's rasterized and if you zoom in a bit they have very clearly recognizable differences. Take the four bottom-left pixels of a capital A at 300 ppi, and compare their ink value ratios with different anti-aliasing techniques, and I bet you could get a signature of what card did the rasterization.

Gaussian blur is your friend if you wanna send a death note, I guess.

flutas• 4 years ago

unless there is some specific bug

Could also be by design, similar to printer identification dots. Have the artifacting vary every so slightly from one GPU to another. Then again, I feel (emotional statement, not of fact) that this would be known by now if it was a thing.

hermitdev• 4 years ago

I was reading these comments while simultaneously trying to get some work done. I was taking a screenshot of some settings to show to a coworker for verification and immediately noticed something was off about the screenshot. It looked nothing like the screen! Apparently screenshots on Win10 with HDR is kind of funny. It looks like everything is neon. Like the standard HN orange banner looks like a yellow highlighter. Funny thing is, if I take the screenshot from my non-HDR monitor, it looks as expected.

So...evidently from a sample of me, I can tell from which monitor a screenshot was taken...

oneoff786• 4 years ago

I had to chuckle at the first part.

Ah yes, I see they’re using the default formatting options. That narrows down our search to 99.9999% of the population.

dagw3• 4 years ago

Letter paper size isn't the default paper size for most Windows computers in Norway, so that could be something.

bryanrasmussen2• 4 years ago

I would guess there must be forensic tools to detect this stuff, that the Norwegian police don't just have the best experts in Windows and printers in the world who then went through all the various systems, but that there should be a database of these variations somewhere and tools you can use to analyze a printed output to figure out where and what it was produced by, so what are these tools is my question.

sokoloff• 4 years ago

HD630 is the integrated GPU on Intel’s Kaby Lake line of processors.

That narrows it down to coming from 10s of millions of computer perhaps?

ridgered4• 4 years ago

I'm actually surprised they could narrow it down even that much. The skylake and coffeelake iGPUs always seemed basically identical to the kabylake one.

chipsa• 4 years ago

I'd be surprised if there was any noticeable difference between the HD630, and any of the other Gen9 architecture iGPUs.

phkahler• 4 years ago

This could all be deflection. All name-brand printers (in the US at least and probably everywhere) watermark printed pages with yellow dots that identify the printer serial number. If the printer is purchased with a credit card and the SN is scanned, there is a perfect trail from your printed page to the person who bought it. I suspect if that method was used they still may want to claim these other fingerprinting methods to avoid spreading the word about printers.

abakker• 4 years ago

Got a source for this claim?

Edit: Specifically, what about printers that only print black and white?

reset-password• 4 years ago

One other way this trail can be made is simply by installing the drivers. For example I noticed that when you complete the driver installation for a Brother color laser printer, the installer opens the default browser and navigates to brother.com/something/SERIAL_NO_OF_PRINTER. I am assuming that on the other end they're capturing the IP, fingerprinting the browser, and logging it all forever.

not2b• 4 years ago

Color printers must do this; black-and-white printers do not (and cannot, there's no yellow ink).

thewebcount• 4 years ago

are there subtle differences between GPUs and their software rendering that, statistically, can be recovered from the somewhat noisy print?

I'm not sure these days when most GPUs are IEEE-754-compliant. But back in the mid to late 2000's I worked on a GPU renderer for video editing and we had a few filters that gave noticeably different results on different GPUs. One filter did a hard black and white threshold, then blurred the result, did another hard threshold, etc., in a loop. Because of differences in precision of the floating point values (24-bit on AMD at the time, if I recall correctly), the thresholds could produce minor differences that got magnified by the blurring, and then created new thresholds with minor differences, etc.

Even if all the GPUs are using IEEE-754 floats, there are driver differences that can cause the results to be slightly different, too. Like a simple GLSL mix() function could be implemented as result = x * a + y * (1 - a) (where x and y are 2 input pixels and a is the alpha of x). Or it could be implemented more efficiently as result = a * (x - y) + y. Doing the same math in a slightly different way can sometimes lead to slight differences in intermediate results which compound in the final result. So yeah, it may be possible to tease out some of these things by examining something like font rendering.

mmcgaha• 4 years ago

This is why I always write my threats and ransom requests in pure TeX.

Seriously though, I thought printers have been using microdots as identifiers for years. Is this just an old wives tale?

joering23• 4 years ago

So it looks like both printer's fingerprinting and windows "fingerprinting" can both be fooled by simply making a B/W photocopy at local FedEx. Perhaps do copy of a copy of a copy 5 times and you should be good to go!

Just make sure you pay with cash.

sundvor• 4 years ago

This reads so much like Lee Child's Without Fail / Jack Reacher (2008) - which I'm currently re-reading. Analysing a printed threat:

‘It’s a Hewlett-Packard laser. They can tell by the toner chemistry. Can’t tell which model, because all their black-and-white lasers use the same basic toner powder. The typeface is Times New Roman, from Microsoft Works 4.5 for Windows 95, fourteen point, printed bold.’

’Typefaces tend to change very subtly between different word processors. The software writers fiddle with the kerning, which is the spacing between individual letters, as opposed to the spacing between words. If you look long enough, you can kind of sense it. Then you can measure it and identify the program. ...’

(Edit: Limited the amount of quoted text a bit; I believe a few lines is fine/fair use. Loving the series re-read after the TV show, and that I bought them on Kindle originally!).

jimcsharp• 4 years ago

I wonder how many writers write about word processors when they get writer's block. A bit like devs making dev tools.

greggsy2• 4 years ago

Or William S. Burrows creating a fantasies around his Clark Nova typewriter in Naked Lunch.

quickthrower2• 4 years ago

Like the blog post about why I switched from Jekyll to Hugo

boomboomsubban• 4 years ago

I somewhat wonder if this is a non-story and they concluded that the note was printed inside the house. Or they have a suspect in mind and they want someone close to them to call in that their computing is suspicious.

dmix• 4 years ago

They might just be trying to convince the public they are trying hard or maybe a cop bragged too much to a journo which is more likely.

chiefalchemist3• 4 years ago

My assumption - unfounded? paranoid? - is that:

1) Printers leave a unique "invisible" watermark; similar to the way you can hide an image within an image. The naked eye can see it, but it's there.

2) Aside from that the printer itself has a unique fingerprint, similar to how keyboards do (i.e., AI can pick the difference in the sound of each key and with that audio can translate your typing into letters / words).

3) Networked printers phone home; with snippets. Again, similar to the way some smart TVs send screenshots.

Perhaps not every printer does all of the above, and some not at all, but enough do or might.

Finally, law enforcement explanations like the article's to me are suspect. For example, how often do we hear that a random-y car stop led to a sizable drug bust? So of all the thousands of car going up Rt 95 the police randomly picked one with loads of drugs? What are the odds?

Moral of the story, if (federal) law enforcement has "insider information" they're not going to share that with the public.

InCityDreams• 4 years ago

Moral of the story, if (federal) law enforcement has "insider information" they're not going to share that with the public.

I agree: all I've learned is to make a doc on my oldest laptop, multi-paged and-fonted, have it printed at different public (paid or library) sources and then cobble them together and post them from a random place (not taking my phone there, either).

From what I've anec-heard, those 'rando' car stop/ mega busts are politely arranged so the cops get their bust, but the real mega-shipments sail on by, untouched. Everybody gets a payday, even the Prison system!

*the captured mules get to live rent free for a whilem so there's that, for them.

ComputerGuru3• 4 years ago

have it printed at different public (paid or library) sources and then cobble them together

That feels like it exposes your attack surface enormously! More witnesses, more cameras, more data to cross reference, etc.

Buy a cheap laptop and printer at Goodwill or a garage sale, print, destroy them, then mail your manifesto or whatever.

trompetenaccoun2• 4 years ago

similar to the way some smart TVs send screenshots

Wtf! Just when I thought I'd heard it all.

chiefalchemist3• 4 years ago

Yup. Look it up. It's come up on HN before. Tbh i bet it doesn't need to full screen shot to "fingerprint" what you're watching.

If you want to take the deep dive read "The Age of Surveillance Capitalism."

DevX101• 4 years ago

Police have been doing this since the days of typewriters. If you're a whistleblower with sensitive information, assume your printing device has a unique identifier. This is how Reality Winner was caught, when she leaked info about Russian interference in US elections.

If you're in a highly secure environment, it's even possible the content itself may be a unique identifier. I could imagine a sensitive document having grammatical alterations unique to each recipient.

Journalists should consider this before publishing unredacted copies of leaked documents.

hutzlibu• 4 years ago

"Police have been doing this since the days of typewriters."

Well, that the typewriters and today the printers are unique, sure.

But here they seem to claim(I do not speak the articles language) that they could identify the computer that send the document. Which is a very bold and new claim, I think.

treesknees2• 4 years ago

Zoom does something like this. They'll embed unique information into the meeting and meeting audio. I've also heard that the arrangement of the participants can also be a watermark but I don't have a source for that.

https://theintercept.com/2021/01/18/leak-zoom-meeting/

el-salvador• 4 years ago

It's a feature found on the zoom admin panel:

https://support.zoom.us/hc/en-us/articles/360021839031-Addin...

tux1968• 4 years ago

It is fascinating to see what information can be deduced from such an artifact. Not exactly the same, but it reminded me of a story from the early days of the internet, where a serial killer was caught because a map he sent police, showing the location of a body, was generated online before being printed.

https://murderpedia.org/male.T/t/travis-maury.htm

yobbo• 4 years ago

This is not quite fingerprinting, since there's nothing unique about the alleged setup.

There's quite a lot required for them to credibly show that the letter could only have been produced on a pc with "Intel HD Graphics 630". I suspect the argument is on the level of "we tried to duplicate it with some random PCs and the one with Intel HD graphics looked most similar".

But even if it is true, integrated intel GPUs are in (maybe?) a third of all windows PCs.

type02• 4 years ago

How likely could it be a Gone Girl scenario?

bombcar4• 4 years ago

Reminds me of the Dan Rather memo, though that was a simpler "show it couldn't be that old" style investigation.

Police claims to have fingerprinted computer based on printed document

Related Stories