funsec mailing list archives
Re: [privacy] Digital Camera Fingerprints
From: Michal Zalewski <lcamtuf () dione ids pl>
Date: Mon, 24 Apr 2006 18:39:20 +0200 (CEST)
On Mon, 24 Apr 2006, Justin Polazzo wrote:
Digital cameras have unique "noise" fingerprints? A researcher at SUNY Binghamton reports that he can tell which camera took any given photo by matching the photo's unique "weak noise-like pattern of pixel-to-pixel non-uniformity."
All digital photos are naturally expected to exhibit interesting image irregulaties that can be used for fingerprinting; some noise patterns are purely random and change from one photo to another, but many would be a result of sensor characteristics (including a unique set of dead or hot pixels for this particular unit - virtually all CCD/CMOS sensors have some). Having some experience in photography and photo processing, I'm not sure that this maps to the ability to link a drastically resized photo posted on the web to a particular unit, however. The most useful information is probably lost when a picture is scaled from 6 to 0.5 Mpix, sharpened, and then saved as a 75% JPEG, which is a typical web publication workflow. Even after such a treatment, I have no doubt that noise characteristics can be trivially used to link any photo to a particular make and model of a digital camera. This is not groundbreaking, however - don't forget that even more information is readily available from other sources: EXIF data, file naming scheme, color interpolation artifacts, antialiasing artifacts, noise reduction algorithms, sharpening and compression methods also can be analyzed to identify the model. Heck, some camera models exhibit unique moiré or chromatic aberration patterns. A quick glance at dpreview.com confirms that just about any camera has a distinctive set of image processing glitches. And again, what I'm not so sure about is the claim that photos can be linked to a specific unit so easily, at least in the real world. I'm not dismissing this possibility, but there seems to be too little information available to support that hypothesis: the study mentions an unreasonably small sample of only 9 cameras that were probably different models. The problem with this approach is that we cannot tell if they have a method to merely tell these 9 distinctive makes apart (which is easy), or if they have a tool to differentiate between any number of cameras of a single model. A study on, say, 20 identical Canon Powershot A95 cameras would be far more convincing. On a side note, many cameras embed their unique serial number in all photos, and this behavior is usually well documented. You can expect all Canon EOS digital bodies to do that, for example. /mz ( http://lcamtuf.coredump.cx/photo/current/ for fingerprinting freaks ) _______________________________________________ privacy mailing list privacy () whitestar linuxbox org http://www.whitestar.linuxbox.org/mailman/listinfo/privacy
Current thread:
- [privacy] Digital Camera Fingerprints Justin Polazzo (Apr 24)
- Re: [privacy] Digital Camera Fingerprints Richard M. Smith (Apr 24)
- Re: [privacy] Digital Camera Fingerprints Marius Gheorghescu (Apr 24)
- Re: [privacy] Digital Camera Fingerprints Scott Manley (Apr 24)
- Re: [privacy] Digital Camera Fingerprints Marius Gheorghescu (Apr 24)
- Re: [privacy] Digital Camera Fingerprints Dave Dittrich (Apr 24)
- Re: [privacy] Digital Camera Fingerprints Michal Zalewski (Apr 24)
- <Possible follow-ups>
- Re: [privacy] Digital Camera Fingerprints Fergie (Apr 24)
- Re: [privacy] Digital Camera Fingerprints Justin Polazzo (Apr 24)
- Re: [privacy] Digital Camera Fingerprints Marius Gheorghescu (Apr 24)
- Re: [privacy] Digital Camera Fingerprints Justin Polazzo (Apr 24)
- Re: [privacy] Digital Camera Fingerprints Andrew Blair (Apr 24)
- Re: [privacy] Digital Camera Fingerprints Richard M. Smith (Apr 24)