Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New information extracted from Snowden PDFs through metadata version analysis

libroot.org

Post reply on HN
Print view View original

61–70 of 139 posts

Re: New information extracted from Snowden PDFs through metadata version analysis

#61

Post by layer8 »

ajross wrote: post #57
layer8 wrote: post #50

These PDFs apparently used the “incremental update” feature of PDF, where edits to the document are merely appended to the original file. It’s easy to extract the earlier versions, for example with a plain text editor. Just search for lines starting with “%%EOF”, and truncate the file after that line. Voila, the resulting file is the respective earlier PDF version. (One exception is the first %%EOF in a so-called lin…

It's hilarious the extent to which Adobe Systems's ridiculously futile attempt to chase MS Word features ended up being the single most productive espionage tool of the last quarter century.

I don’t think this was particularly modeled on MS Word. The incremental update feature was introduced with PDF 1.2 in 1996. It allows to quickly save changes without having to rewrite the whole file, for example when annotating a PDF.

Incremental updates are also essential for PDF signatures, since when you add a subsequent signature to a PDF, you couldn’t rewrite the file without breaking previous signatures. Hence signatures are appended as incremental updates.

Re: New information extracted from Snowden PDFs through metadata version analysis

#62

Post by jeffbee »

sincerely wrote: post #60
jeffbee wrote: post #49

Earlier quoted context omitted.

It could still be identifiable, for example if the document has been prepared such that the intended recipient's identity is encoded into subtle modulation of the widths of spaces.

Print and re-scan wouldn’t fix that though.

That was my point. If you want to erase its origin you need to semantically extract the contents and reduce them to their most basic representation.

Re: New information extracted from Snowden PDFs through metadata version analysis

#63

Post by Andrex »

dfreel wrote: post #20
Andrex wrote: post #14

Earlier quoted context omitted.

The best way to fix a problem is to bring it into the light, not pretend it doesn't exist. "Security by obscurity" has been debunked for decades. If our system is so flawed Snowden's leaks would have blown everything up, maybe the system deserves to be blown up. Otherwise we're just papering over flaws which likely will be discovered and exploited eventually.

[flagged]

"Snowden's aim was to damage the US and its allies, and he succeeded in this."

I doubt it but if you have a source I'll check it out. Third party speculation doesn't count, obviously.

Re: New information extracted from Snowden PDFs through metadata version analysis

#64

Post by contingencies »

cookiengineer wrote: post #58
everdrive wrote: post #41

Earlier quoted context omitted.

>Note that all printers have "invisible to the human eye" yellow dotcodes, which contain their serial number, and in some cases even the public IP address when they've already connected to the internet (looking at you, HP and Canon). I've got a black and white brother printer which uses toner. Is there something similar for this printer?

> black and white brother printer excellent choice, that's what I am using. Also it's Linux / CUPS compatible and without a broken proprietary rasterizer.

Same thing here. A few years ago I bought three brands of printer-scanner combos for our R&D office, returned the others. Brother was the least broken despite still not being perfect. Issues include broken scanning drivers and fake toner warnings at ~1/3 level.

Re: New information extracted from Snowden PDFs through metadata version analysis

#65

Post by cubefox »

layer8 wrote: post #61
ajross wrote: post #57

Earlier quoted context omitted.

It's hilarious the extent to which Adobe Systems's ridiculously futile attempt to chase MS Word features ended up being the single most productive espionage tool of the last quarter century.

I don’t think this was particularly modeled on MS Word. The incremental update feature was introduced with PDF 1.2 in 1996. It allows to quickly save changes without having to rewrite the whole file, for example when annotating a PDF. Incremental updates are also essential for PDF signatures, since when you add a subsequent signature to a PDF, you couldn’t rewrite the file without breaking previous signatures. Hence…

I'm pretty sure you can change various file formats without rewriting the entire file and without using "incremental updates".

Re: New information extracted from Snowden PDFs through metadata version analysis

#66

Post by [deleted] »

cubefox wrote: post #65
layer8 wrote: post #61

Earlier quoted context omitted.

I don’t think this was particularly modeled on MS Word. The incremental update feature was introduced with PDF 1.2 in 1996. It allows to quickly save changes without having to rewrite the whole file, for example when annotating a PDF. Incremental updates are also essential for PDF signatures, since when you add a subsequent signature to a PDF, you couldn’t rewrite the file without breaking previous signatures. Hence…

I'm pretty sure you can change various file formats without rewriting the entire file and without using "incremental updates".

[deleted]

Re: New information extracted from Snowden PDFs through metadata version analysis

#67

Post by 1317 »

pfisherman wrote: post #2

Can someone spell out how this is possible? Do pdfs store a complete document version history? Do they store diffs in the metadata? Does this happen each time the document is edited?

https://hackerfactor.com/blog/index.php?/archives/1085-A-Typ...

Re: New information extracted from Snowden PDFs through metadata version analysis

#68

Post by tester756 »

jeffbee wrote: post #49
tester756 wrote: post #38

Earlier quoted context omitted.

Why not just make screenshoot of every PDF page?

It could still be identifiable, for example if the document has been prepared such that the intended recipient's identity is encoded into subtle modulation of the widths of spaces.

Sure, but all those not-essential information hidden in PDFs format are removed

Re: New information extracted from Snowden PDFs through metadata version analysis

#69

Post by echelon »

c-c-c-c-c wrote: post #51

> We contacted Ryan Gallagher, the journalist who led both investigations, to ask about the editorial decision to remove these sections. After more than a week, we have not received a response. Hopefully we'll hear something now that the Christmas holidays are over.

Why are the journalists redacting the docs? That's incredibly puzzling.

Is there something in here so damaging that they refuse to publish it?

Did the government tell them they'd be in trouble if they published it?

Are the journalists the only ones with access to the raw files?

Re: New information extracted from Snowden PDFs through metadata version analysis

#70

Post by mattzito »

cubefox wrote: post #65
layer8 wrote: post #61

Earlier quoted context omitted.

I don’t think this was particularly modeled on MS Word. The incremental update feature was introduced with PDF 1.2 in 1996. It allows to quickly save changes without having to rewrite the whole file, for example when annotating a PDF. Incremental updates are also essential for PDF signatures, since when you add a subsequent signature to a PDF, you couldn’t rewrite the file without breaking previous signatures. Hence…

I'm pretty sure you can change various file formats without rewriting the entire file and without using "incremental updates".

No, if you are going to change the structure of a structured document that has been saved to disk, your options are:

1) Rewrite the file to disk 2) Append the new data/metadata to the end of the existing file

I suppose you could pre-pad documents with empty blocks and then go modify those in situ by binary editing the file, but that sounds like a nightmare.

Post reply on HN