EFF reverses color laser printer fingerprints

Posted Oct 17th 2005 4:21AM by Eliot Phillips

The EFF has broken the tracking code for the Xerox DocuColor. The DocuColor prints a faint 15x8 grid of yellow dots on every page. To see these dots you need a magnifying glass. You can also use a blue light to make the dots appear black. The EFF page has a built in application for decoding the dots which hide the time, date, and serial number of the printer. The EFF also maintains a list of printers which do or don't have this "feature".

Andrew "bunnie" Huang helped out a lot with this research. To speed up analysis of submitted printer samples he modified a scanner to use blue light. The scanner does a white balance calibration before each page scan so the blue lights need to be turned off during that period otherwise the scanner will compensate. bunnie also opened up his HP 2600N to determine where the watermark was implemented. Studying the boards he decided that most color laser printers are probably using Canon engine boards. By coercing one manufacturer the government was able to get watermarking into a majority of the laser printers sold.

[via BoingBoing]

Reader Comments

(Page 2)

21. Since most of us are presumably not using our printers to commit crimes, yeah... I guess the real issue here is what jwstolk mentioned: hacking the drivers to alter the dots. Or would the dot code be burnt into a ROM somewhere inside the printer? Whichever, there's gotta be a way to alter or remove the fingerprinting. So who will be first to find it? ;)

Posted at 3:09PM on Sep 3rd 2006 by furtim

22. oddsends: while your point is well taken, my intent was to say that it is *possible* to skirt serial # tracking; the purchase itself can be anonymous, thereby breaking the link between the serial and your name. by all means hack your printer hardware. for most, however, that wont be necessary.

Posted at 3:09PM on Sep 3rd 2006 by steve

23. Steve, If newegg tracks what your serial number is on many of the items they sell, it probably wouldn't be that hard for best buy to do the same without telling you. At least newegg lets me know they have my SN# on my wrt54g instead of doing it behind my back.

Posted at 3:09PM on Sep 3rd 2006 by oddsends

24. If you were counterfitting money, couldn't you just get rid of the one bill that would print with the pattern on it? If you know it's there, it's not a big deal, right?

Posted at 3:09PM on Sep 3rd 2006 by flaunt_dzx

25. You're all forgetting the big issue here -- the picture on hackaday isn't in b&w. :P

Posted at 3:09PM on Sep 3rd 2006 by Theblunderbuss

26. put the tinfoil hats aside for a moment and think. 90% of us buy our printers via the huge electronic superstores a la Best Buy. even under the assumption that printer manufacturers keep track of serial numbers, consider the extreme difficulties in tracking down a person who purchased printer X in cash at one such retailer. outside of the market buying printers for home use, we can primarily assume businesses are playing the role of consumer. even then, these devices are sold routinely through resellers, auctions, asset liquidations, ebay, etc. those truly concerned with privacy need not bypass the tracking system of their printers; they must merely practice some intelligent purchasing. that said, this becomes a nonissue - albeit one that is annoying and foreshadows the further erosion of privacy in the future.

Posted at 3:09PM on Sep 3rd 2006 by steve

27. You could theoretically, with this information, get a clean printer (one without tracking) and create an image with forged serial information to frame someone else

Posted at 3:09PM on Sep 3rd 2006 by ben

28. now all we need is a printer which does not make these dots by itself and a modified driver that adds the dots just before printing, so every sheet can have a random date, time and serial number....

Posted at 3:09PM on Sep 3rd 2006 by jwstolk

29. Poster #5 (brandon) hit the nail on the head. At my work we have this crazy high tech Imagistics document station (printer, scanner, photocopier, etc. on steroids). Before the guy at my work bought it he went to see a demonstration of it, and they explicitly warned everyone to tell their employees not to try to counterfeit money with it, because it would be traced directly back to the individual printer. Guess this is how they do it.

Posted at 3:09PM on Sep 3rd 2006 by tiuk

30. I think the primary push behind the fingerprinting was to deter against counterfeiting of American currency, since ostensibly these machines are sophisticated enough to print something believeable if you have access to cotton paper. You may also notice that the new $20 bills have an "anti-piracy" patten on the back; Photoshop is supposed to prevent you from editing pictures with that 5-circle pattern.

Posted at 3:09PM on Sep 3rd 2006 by Brandon

31. i indeed have a printer with the dots, but my question is, and i will have to find a blue light or a magnifying glass to check, is will it print these dots while printing black and white? There is a mode with the HP's to print all color as black and white and it significantly speeds up printing (doesnt rotate all the color drums to the paper). Think they put a way to print these dots in for that case?

Posted at 3:09PM on Sep 3rd 2006 by Mike

32. FIRST!

Posted at 3:09PM on Sep 3rd 2006 by Chris

33. Wtf is with you people and the need to say FIRST! its ridiculous. You dont even have anything to say, you just want to be at the top of the pile. Reminds me of kids in kindergarten who ran to be first in line.

Posted at 3:09PM on Sep 3rd 2006 by brian

34. I was previously unaware of such fingerprinting. Is this included solely for the purpose of being able to track a particular document to a particular printer and moment in time? Have the fingerprints ever been used in a conviction? My tinfoil hat is as tightly secured as anybody's so if I can stay away from printers that will refuse to disavow any knowledge of my actions, I will.

Posted at 3:09PM on Sep 3rd 2006 by billytheimpaler

35. FIRST!

Posted at 3:09PM on Sep 3rd 2006 by Chris

Previous 20 Comments

Add your comments

Please keep your comments relevant to this blog entry: inappropriate or purely promotional comments may be removed. Email addresses are never displayed, but they are required to confirm your comments. To create a live link, simply type the URL (including http://) or email address and we will make it a live link for you. You can put up to 3 URLs in your comments. Line breaks and paragraphs are automatically converted — no need to use <p> or <br> tags.