Hacker Factor (Neal Krawetz)

> Citation needed. The best one I remember is this one: https://www.hackerfactor.com/blog/index.php?/archives/929-One-Bad-Appl… > As the latest news suggests the opposite. What news?

> what's going on under the hood Rather simple methods are surprisingly effective [1]. There's sure to be more NN fanciness nowadays (like Apple's proposed NeuralHash), but I've used the algorithms described by [1] to great effect in the not-too-distant past. The HN discussion linked in that article is also worth a read. [1] https://www.hackerfactor.com/blog/index.php?/archives/432-Looks-Like-I…

https://www.hackerfactor.com/blog/index.php Some "behind the scenes" on running an image analysis site where people submit photos to test whether they are fake. https://jvns.ca/ I saw this one recommended on HN in the past, and it's good. She does a lot of deep-dives into various programming topics. https://gru.gq/ grugq does good writing on opsec and other cybersecurity topics.

Im not sure if this has changed since my source was published but according to this article[0], the Tor Blocks in russia are not nation wide and originate from individual ISPs: >"According to OONI, it wasn't all of Russia blocking Tor; it was 15 out of 65 subnets. Moreover, each censorship instance used a different blocking method" >"If the censorship was government-sponsored, as the Tor Project suggested, then I would expect it to be much more widespread and consistent. This looks like individual blocking efforts. As OONI noted, the blocks followed a "recent spike in the use of Tor bridges (used for circumventing Tor blocking) in Russia." Though the situation might be totally different now considering the recent events. [0] https://www.hackerfactor.com/blog/index.php?/archives/944-Tor-0day-Sno…

This criticism makes it seem that Snowflake is a great arrest honeypot: https://www.hackerfactor.com/blog/index.php?/archives/944-Tor-0day-Sno…

Ultimately, you have to trust some photographer or organisation. The camera sensor is not a trusted input. Nothing can prevent somebody pointing their camera at a high resolution screen displaying a manipulated image. Or a staged scene. No image signing mechanism can prevent this kind of attack. There are manipulation detection techniques, but they are imperfect. And even if you verify the image is an unmodified camera original, you still have to analyse the context surrounding the image (what is portrayed in the image, does it line up with other reports, who is the photographer etc.) to determine if it is actually a true. It is trivial to digitally sign text, but a signature on a string doesn't mean that string is telling the truth. It just means someone signed it. Highly recommend http://www.hackerfactor.com/blog/ for in depth digital image forensics content.

There is a site I'd used a while back for exactly this when I was trying to ensure that my writing (and speech) in some fiction was gendered in a particular manner - https://www.hackerfactor.com/GenderGuesser.php#Analyze Playing "guess why" is the fun part :) I'm sure there are other tools available now and I'd love to hear of them if people are aware of them!

I agree that the idea of the AG bringing felony charges against Apple employees because of their approach to dealing with CSAM is pretty far-fetched. But the article you're referring to [0] is correct to point out that Apple will be silently exfiltrating unencrypted data from its users' devices to be reviewed by its employees, meaning that they'll be viewing arbitrary content from Apple users' devices without their knowledge or consent. That's not speculation, it follows directly from Apple's explanation of how the system will work, with the only safeguard being Apple's purported one-in-a-trillion false positive rate for the on-device scanning that causes the data to be sent to Apple. [0] https://www.hackerfactor.com/blog/index.php?/archives/929-One-Bad-Appl…

OK facebook is ?injecting? metadata into images uploaded by users, so reuse reshare or original can be distinguished, and the chain of transmission can be logged, as always to serve you better, but how vulnerable is this? It is possible to forge IPTC for whatever end. either blank it or alter its chain of origin. https://www.reddit.com/r/privacy/comments/ccndcq/facebook_is_embedding… https://stackoverflow.com/questions/31120222/iptc-metadata-automatical… This is a good read about the finer points of the subject. https://www.hackerfactor.com/blog/index.php?/archives/726-Facebook-Tra…

> Is he sure it's Googlebot and not somebody spoofing headers? In the author's previous post on the subject [0], he verified that the request were coming from Google IPs. > Is he sure Google is generating the queries, as opposed to Google just following URL's coming from elsewhere? From the URLs quoted in the article, it looks more like some sort of (machine learning-y?) system trying to infer his site's canonical URL scheme. [0] https://www.hackerfactor.com/blog/index.php?/archives/484-Google-Abuse…

Possibly worth noting Talos is owned by Cisco, and there has been discussion around their neutrality in disclosing vulnerabilities: https://www.hackerfactor.com/blog/index.php?/archives/801-The-Truth-Hu…

Some great blogposts about exactly this: https://www.hackerfactor.com/blog/index.php?/archives/654-FC-Net-Neutr… https://www.hackerfactor.com/blog/index.php?/archives/665-Oh-FCC.html

https://hackerfactor.com A blog on security, privacy and (foto) forensics.

From the actual complaint: As early as 2007, Dr. Neal Krawetz of Hacker Factor Solutions published a white paper entitled "Point-of-Sale Vulnerabilities" (the "White Paper"). According to the White Paper, POS systems "provide virtually no security" and few POS systems "implement best practices for handling sensitive information, such as the Visa standards for credit card management."6 and Thereafter, at least 17 copies of the White Paper were downloaded to a domain owned by Target, the most recent download occurring in May 2013. Target personnel used the search term "POS vulnerability" to locate and download the White Paper. As is now apparent, Target did not heed the White Paper or implement its suggestions. [edit] link to the Dr. Krawetz paper: http://www.hackerfactor.com/papers/cc-pos-20.pdf

The guy actually got a ticket for riding a vehicle which is not conform with the local legislation ;-) http://chameaudacier.free.fr/pv.jpg That pic is so funny, don't miss it: http://chameaudacier.free.fr/moto8.html That would be a great subject for analysis by the owner of this blog I like to read: http://www.hackerfactor.com/blog/

Here's a followup post also: http://www.hackerfactor.com/blog/index.php?/archives/401-Picture-Perfe…

Follow-up: http://www.hackerfactor.com/blog/index.php?/archives/329-The-Secret-is…

These are two articles I liked that are referenced in the Python ImageHash library on PyPi, second article is a follow-up to the first. Here's paraphrased steps/result from first article for hashing an image: 1. Reduce size. The fastest way to remove high frequencies and detail is to shrink the image. In this case, shrink it to 8x8 so that there are 64 total pixels. 2. Reduce color. The tiny 8x8 picture is converted to a grayscale. This changes the hash from 64 pixels (64 red, 64 green, and 64 blue) to 64 total colors. 3. Average the colors. Compute the mean value of the 64 colors. 4. Compute the bits. Each bit is simply set based on whether the color value is above or below the mean. 5. Construct the hash. Set the 64 bits into a 64-bit integer. The order does not matter, just as long as you are consistent. The resulting hash won't change if the image is scaled or the aspect ratio changes. Increasing or decreasing the brightness or contrast, or even altering the colors won't dramatically change the hash value. https://www.hackerfactor.com/blog/index.php?/archives/432-Looks-Like-I… https://www.hackerfactor.com/blog/index.php?/archives/529-Kind-of-Like…

So when you run SIFT on an image, one gets dozens (maybe hundreds) of SIFT features back. The trouble with SIFT features is that each individual SIFT feature is a local image descriptor -- it describes a single point in the image. One can't just append the two lists of SIFT descriptors together and do a Hamming comparison on them, because it's not guaranteed that both images will have all of the same SIFT descriptors, nor that they would be in the same order. When you want to do image comparison on image descriptors, one must compare every local feature with every local feature in every other image. This is great for comparing two images together, or for finding where one image is located in another image (homography matching), but this does not scale for large image sets. In contrast, descriptors like perceptual hashes look at the entire image, and so are a _global_ image descriptor. There are ways to convert local SIFT image descriptors into a single global image descriptor for doing more rapid lookup (Bag of Visual Words is one technique that comes to mind), but SIFT and pHash really are in two categories all their own. More info on pHash: https://hackerfactor.com/blog/index.php%3F/archives/432-Looks-Like-It.… Example of SIFT for fine-grained image matching: https://docs.opencv.org/3.4/d1/de0/tutorial_py_feature_homography.html

There's actually been some work to reverse the original PhotoDNA hash, with much more precise results than for Apple's NeuralHash: https://www.hackerfactor.com/blog/index.php?archives/931-PhotoDNA-and-… https://anishathalye.com/inverting-photodna/

Considering [1], I’m going to challenge that their techniques are currently even mildly effective. Given the absolute academic malpractice these papers are pushing, I’m calling BS; while they want to watermark it, they clearly aren’t actually able to. For images. Which are drastically easier than text. Their interest is irrelevant in the face of technical impossibility. And that’s before you get into other people who don’t care and will just build adversarial tools to bypass the attempted watermarks. It’s a losing useless battle. Google and OpenAI engage in it to try to catch competitors when there’s a lawsuit or to try to clean their datasets clean. But it’s absolutely unusable for something like “did someone cheat”. [1] https://hackerfactor.com/blog/index.php?/categories/1-Image-Analysis

C2PA has lots of problems. https://www.hackerfactor.com/blog/index.php?%2Farchives%2F1073-What-C2…

Neal Krawetz of fotoforensics (and others probably) disagree that C2PA "is a well thought out solution" https://www.hackerfactor.com/blog/index.php?%2Farchives%2F1073-What-C2… (search his blog if you want more of his thoughts on it) I don't have a know enough bout this but I've been reading his blog for other topics a while and he does seem to know a lot about photo authenticity.

THIS https://www.hackerfactor.com/blog/index.php?/archives/625-Dear-Getty-I… is how you are supposed to proceed.

Yes, my mistake. I assumed common sense. https://pico-8.fandom.com/wiki/P8PNGFileFormat Actual cases of proprietary chunks include iDOT from Apple (apparently a performance optimization for plain images) https://www.hackerfactor.com/blog/index.php?/archives/895-Connecting-t… and the Macromedia Fireworks save files https://stackoverflow.com/questions/4242402/the-fireworks-png-format-a…

Attacked Over Tor [2017] https://www.hackerfactor.com/blog/index.php?/archives/762-Attacked-Ove…

Exactly - the price of that particular image switched to a higher tier just because they found a copyright infringement. This is the shady part. Back then I recall reading other threads about people in very similar situations. Unfortunately I'm not able to find those threads anymore, but I've found a Reddit post mentioning that Getty stopped with these shady practices when their CEO changed. Edit: found something similar to what I mean [1], [2] [1]: https://www.hackerfactor.com/blog/index.php?/archives/625-Dear-Getty-I… [2]: https://ryanhealy.com/getty-images-extortion-letter/

Now that such a model exists, I think we can expect lobbying for making this mandatory. For the children... Once adopted this will lead to an increase in randomly locked out accounts due to model false positives, because looking for something very rare will lead to most items flagged being false positives (Bayes statistics etc.). This blog had a few interesting articles on the limitations of these technologies https://www.hackerfactor.com/blog/index.php?/archives/971-FB-TMK-PDQ-W… While this is comparing the currently used hash based approaches a classification model will have similar problems.

Yeah Hacker Factor's multi-post critiques are where I first saw it analyzed. For reference they run the popular fotoforensics.com image analysis site. They also have scathing critique (eg [1]) about the Adobe-led C2PA digital provenance signing, having themselves been part of various groups that seek solutions to the provenance problem. [1] https://www.hackerfactor.com/blog/index.php?/archives/1013-C2PAs-Worst…