Barium Meal Tests

[Cathal Garvey]

 > there was this laywer in .no who lost his license because he leaked
 > photos of anders behring brevik to the press. and police watermarked 
a set of bait-photos and gave it to the laywers of the families with
 > dead kids. the press made a photo of the pictures, printed the photo
 > in a test news paper, took a photo again, and printed that. So a lot
 > of adc-dac conversions in betweeen. the size also got significantly
 > smaller. yet the watermark was clearly identifiable. it turned out
 > later, that this was some kind of photoshop plugin, which is
 > "primarily for tracking copyright violations"

This is the classic "Barium Meal Test", a highly effective way to find a 
mole.

I have been meaning for some time to write a quick pythons script which 
implements the Barium Meal Test on plain text, perhaps even in a 
distributed way; by making common misspellings, by replacing whitespace 
with unicode equivalents (bit too obvious?), by making synonymous 
punctuation modifications - a dash rather than a semicolon as in this 
sentence couplet, for example.

Part of the idea is to help identify "moles" in follower networks of 
"private users" in P2P social networks, when people "retweet" private 
messages. If you could divide your followers into groups and give each 
group a different barium meal'd message, then after a few "leaks" you'd 
be able to identify likely leakers.

The other part was to point out how easy such identifying substitutions 
are to make, and to make people acutely aware of the risks involved in 
sharing potentially watermarked information.

On 01/02/15 09:41, stef wrote:
> On Sat, Jan 31, 2015 at 04:06:13PM -0800, coderman wrote:
>>> via use of many ‘conversion’ tools (Calibre comes to mind instantly) or are
>>> these embedded organisms a persistent across any automated conversion
>>> routine?
>>
>> consider a watermark, that resized half, still persists. this is the
>> kind of meta leval manipulation of structure you may see in a rich
>> document (PDF) that could still persist in some transformations.
>
> there was this laywer in .no who lost his license because he leaked photos of
> anders behring brevik to the press. and police watermarked a set of
> bait-photos and gave it to the laywers of the families with dead kids. the
> press made a photo of the pictures, printed the photo in a test news paper,
> took a photo again, and printed that.  so a lot of adc-dac conversions in
> betweeen. the size also got significantly smaller. yet the watermark was
> clearly identifiable. it turned out later, that this was some kind of
> photoshop plugin, which is "primarily for tracking copyright violations"
>

-- 
Twitter:  @onetruecathal
Phone: +353876363185
miniLock: JjmYYngs7akLZUjkvFkuYdsZ3PyPHSZRBKNm6qTYKZfAM
peerio.com: Use email or phone. Uses above miniLock key.