Re: [privacy] Digital Camera Fingerprints

[Michal Zalewski <lcamtuf () dione ids pl>]

On Mon, 24 Apr 2006, Justin Polazzo wrote:

> Digital cameras have unique "noise" fingerprints? A researcher at SUNY
> Binghamton reports that he can tell which camera took any given photo by
> matching the photo's unique "weak noise-like pattern of pixel-to-pixel
> non-uniformity."

All digital photos are naturally expected to exhibit interesting image
irregulaties that can be used for fingerprinting; some noise patterns are
purely random and change from one photo to another, but many would be a
result of sensor characteristics (including a unique set of dead or hot
pixels for this particular unit - virtually all CCD/CMOS sensors have
some).

Having some experience in photography and photo processing, I'm not sure
that this maps to the ability to link a drastically resized photo posted
on the web to a particular unit, however. The most useful information is
probably lost when a picture is scaled from 6 to 0.5 Mpix, sharpened, and
then saved as a 75% JPEG, which is a typical web publication workflow.

Even after such a treatment, I have no doubt that noise characteristics
can be trivially used to link any photo to a particular make and model of
a digital camera. This is not groundbreaking, however - don't forget that
even more information is readily available from other sources: EXIF data,
file naming scheme, color interpolation artifacts, antialiasing artifacts,
noise reduction algorithms, sharpening and compression methods also can be
analyzed to identify the model. Heck, some camera models exhibit unique
moiré or chromatic aberration patterns. A quick glance at dpreview.com
confirms that just about any camera has a distinctive set of image
processing glitches.

And again, what I'm not so sure about is the claim that photos can be
linked to a specific unit so easily, at least in the real world. I'm not
dismissing this possibility, but there seems to be too little information
available to support that hypothesis: the study mentions an unreasonably
small sample of only 9 cameras that were probably different models. The
problem with this approach is that we cannot tell if they have a method to
merely tell these 9 distinctive makes apart (which is easy), or if they
have a tool to differentiate between any number of cameras of a single
model.

A study on, say, 20 identical Canon Powershot A95 cameras would be far
more convincing.

On a side note, many cameras embed their unique serial number in all
photos, and this behavior is usually well documented. You can expect all
Canon EOS digital bodies to do that, for example.

/mz
( http://lcamtuf.coredump.cx/photo/current/ for fingerprinting freaks )
_______________________________________________
privacy mailing list
privacy () whitestar linuxbox org
http://www.whitestar.linuxbox.org/mailman/listinfo/privacy