What You Should Know Before Leaking a Zoom Meeting
theintercept.com
theintercept.com
If watermarking is therefore done at the client stage just before being heard/seen at each endpoint, then there is a good chance that it is hackable and watermarking code could be patched or audio/video extracted before watermarking occurs.
It would still require whistle-blowers to take this more envolved step before leaking a meeting though.
It would be incredibly cost prohibitive to run servers with live transcoding at their scale with a widely used free tier.
Also I don't know if it's a reasonable comparison point but Youtube does transcode server-side into a whole bunch of of different resolutions and video standards, going as high as 8K these days I think. Given the amount of video they receive every single second it's pretty wild how much processing power that must represent.
Maybe in theory even a transcription could be unsafe if the server actually manipulated the words in real-time in some way so that different listeners would hear different word synonyms at certain points, but that seems very convoluted and unlikely.
The stream is a single H264/SVC stream which contains layers of varying quality. It's sent to the Zoom "cloud" where the appropriately sized layer is extracted and forwarded to clients. It's called selective forwarding and it's essentially how all of the WebRTC style video conferencing solutions work once there are more than 2-3 participants.
From the article, it looks like video watermark is only available for a meeting with only signed in users and locked to a particular domain. I don't know their pricing model, but speculating - I wonder if those features mean it's only available on some sort of premium tier and they could live encode only those meetings?
- Privacy (expected for consumers, debatable for domains).
- Willingness to pay (if your stuff is worth protecting, might as well charge for it).
- Decoding the watermarks: I assume this is only done on demand by authenticated users at a very low rate (otherwise if it's freely available to anyone, you give leakers an oracle that lets them determine whether their media scrubbing / fuzzing has indeed removed the watermarks, and these systems are more effective when they have no way to check / must live in fear that they haven't scrubbed it right)
I would, hypothetically, record using my phone, being sure to make it not visible from the camera.
Which seems a little silly, as presumably you could figure out who the sender is by just looking at their face.
[1] https://www.nojitter.com/video-collaboration-av/zoom-takes-v...
[2] https://venturebeat.com/2019/01/22/zoom-is-bringing-ultrason...
Looks to me like the Arbitron system can work with the Universal one... hmmm.
More than one mark at a time should be on the radar.
"...It is a strange thing that the real quality audio is now reserved for the pirates. This industry really knows how to hit a target."
Listening to the samples (I got a nice BeO over-ears headset that has very good performance), I also realized that Spotify gives me some noise, I also thought it's a codec/digital thing.. little do I know..
This isn't a complaint, more an observation: Spotify works really well if you're outside, in a car, or even in an office environment with plenty of low level background noise. It's not so great when you run it through a half-decent hifi in your own home. Still, good enough for casual listening. However, if you're paying attention, you'll notice the flaws easily.
So, some of that noise is probably just that: noise. But some of it will also no doubt be the watermark.
At least you can tell yourself that your setup was worth the money because you can hear the difference ;)
[comment meant to be mostly tongue in cheek - I agree with your comment]
Fortunately I didn't pay that much for my setup. Amp and speakers are about 30 years old and were given to me by my stepdad about 20 years ago. Pretty much everything else is second hand from eBay and 25 - 40 years old (CD player, tuner, tape, EQ).
The biggest expense is the subwoofer, which I did buy new because used prices for a decent subwoofer are still pretty high, especially when you factor in the cost of petrol to go and collect the thing (most people don't want to post because they weigh a lot).
The only other new components are an inexpensive Bluetooth 5.0 receiver, the speaker cable (Bassface, which I want to say was about £2/metre - super-cheap by audiophile standard) and gold-plated banana plugs from RS components. All the interconnects are I think Amazon Basics.
So my total expenditure for the whole system is less than £1,000. Fully half of that is the subwoofer. Admittedly, that's still probably a fair bit by most peoples' standards, especially when it's perfectly possible to get very good sound from a hifi separates system for £250 or so (see Techmoan's video series on the topic, for example: https://www.youtube.com/watch?v=lSY1iZqH118), but it's chickenfeed for most audiophiles. Still, I'm definitely not one of those guys: it sounds more than good enough to me and I've no desire to fall any further into that particular black hole.
Except for one thing... I don't have a turntable. So what I'm probably going to do is buy a pair of SL1210s and a mixer to plug in to the system. I'm lucky enough to have a fair number of 12" singles from a freecycle "barn find" type situation a few years ago, and another time-consuming hobby to get through the rest of this pandemic will be no bad thing.
There is both a danger and a satisfaction to mostly cobbling together a nice sounding system from lots of second-hand parts though. The temptation for me is to do the same again with one or two of the other rooms in the house.
Is that a brand or are they actually putting beryllium oxide in headphones these days?
[0] https://www.bang-olufsen.com/en/headphones/filter/over-ear
[1] https://blog.masterdynamic.com/article/know-your-sound-tool-...
Reasonably effective stream watermarking happens every day and is done in the human vocal range with almost no listener impact.
In radio, Arbitron has a system working well within the lower audio range, even AM radio. AM is typically 5Khz bandwidth.
They use a spectral masking technique able to encode ID bits into streams that can be decoded with portable devices.
PPM Portable People Meter
Frankly, this kind of thing would go unnoticed by pretty much all listeners.
From the PDF I linked:
[...]all watermarking technologies use the well-known perceptual principle of “masking,” which was first reported in the early 20th century and is a core technical basis for mp3, AAC, and a host of data-rate reduction schemes.
In simple language, a loud burst of energy at one frequency will deafen the human auditory system to certain other audio components at nearby frequencies for a period of time before, during, and after the loud signal.
Consider the following illustration: A tone burst at 1.1 kHz with an intensity of 0 dB will hide (make imperceptible) an added signal at 1.11 kHz with a level of -30 dB for a period of about 10 ms before the burst and as much as 50 ms after the burst. However, modern signal-processing techniques can still detect the existence of this added 1.11 kHz component even though the ear cannot.
This is the basis of PPM and other similar watermarking technologies that use masking for determining the frequencies and intensity of the data that can be added for the station-identifying watermark.
The PPM system constructs 10 spectral channels in the region from 1.0 kHz to 3.0 kHz. The original program audio energy in each channel is evaluated for its ability to mask an added component. If that masking energy is insufficient, nothing is added. Conversely, if the energy in a channel is large enough, a tone is injected, chosen from one of four possible frequencies within the channel. For example, the channel centered at 1058 Hz might have one of the following four frequencies injected: 1046, 1054, 1062, or 1070 Hz.
Each of the four frequencies represents 2 bits of information. If we assume that this process repeats at a 500 ms rate, using all channels provides 40 bits per second or 2400 bits per minute of watermark code. Let’s further assume that a radio station is credited for a listener if any code is correctly detected within a 3-minute interval. With the very large number of encoded bits generated in 3 minutes (2400 x 3 = 7200 bits) and a station’s identification data needing perhaps only 50 bits, there is massive excess capacity for redundancy, error correction, and for audio that does not have enough high-frequency content for masking.
https://blogalytics.typepad.com/files/a-technical-look-at-ar...
Interestingly, that literally means fake signals on the receiving end above 8 to 10Khz! Was as low, and may still be as low as 5khz when used for AM. I have not kept up.
I could tell early on. It has improved a lot since then.
The Arbitron system appears robust. Noise, low signal quality, etc... do not generally impact it much. The effective bitrate needed is very low.
Given a larger sample of audio, it is likely to work.
The first step is to ID marks successfully.
Only then can means and methods to evade the mark be trusted.
I would look really hard at what the radio industry has done. They faced very significant challenges as internet advertising rose up to dominate.
The incentives to get this right and be super robust are all there and are time tested, production proven today.
A purpose built algorithm designed to thwart watermarking however is far more likely to be successful than a compression algorithm that is designed to maintain the integrity of the audio.
Does the human auditory system work in "batches" or do we "forget" the other signal once the burst comes in?
Temporal masking widely exploited in all kinds of lossy audio compression (MP3, AAC etc), to remove the data that cannot be perceived anyway.
Could mean extreme subtlety too.
Literal meaning here is, "beyond hearing"
> ultra-, prefix:
> 1. Signifying ‘lying spatially beyond or on the other side of’
> 2a. With adjectives, signifying ‘going beyond, surpassing, or transcending the limits of’ (the specified concept).
> Etymology: Latin ultrā beyond, employed as a prefix in the post-classical ultrāmundānus ultramundane, and the later ultrāmarīnus ultramarine, and ultrāmontānus ultramontane.
- Oxford English Dictionary Online
It may be worth a suggestive talk to expand how people take words.
A pop culture reference would be Daniel Jackson from the series, "SG-1"
We may often be constrained in our ability to understand and assess by our own preconceptions relating to language.
"Ultrasonic" was interpreted very differently by any number of us having this watermarking discussion. How often do we make assumptions about the possible field of play based on language basics?
How often do those fail to be sufficiently inclusive?
I bet it happens more than we realize.
Seems like a good basis for a DEFCON talk. "Where is Daniel Jackson when your team needs him?"
Worthwhile point still, though I wouldn't have responded had the commenter not stated a specific incorrect definition. How does this connect to OPSEC though?
The relation goes right to threat and solution scopes. In this case, someone working from an incomplete definition may well also work within an incomplete set of greater assumptions.
There is what it could mean, what we take it to mean, and what it does mean.
Where those overlap or not could have a significant impact on behavior.
> It means "above hearing". Beyond (through, across) is "trans".
Where'd you get that from? Ultra is indeed "beyond"; "above" would be super.
And the Latin root for "hearing" is audi- (audience / audible / auditorium / etc.); son- is "sound".
Wikipedia's definition has it explicitly higher. https://en.wikipedia.org/wiki/Ultrasound
That page says:
> Ultrasound is defined by the American National Standards Institute as "sound at frequencies greater than 20 kHz".
'Ultraviolet' means only higher-than-violet.
We have another word 'infrasound' for lower-than-audible frequencies.
I'm a native English speaker technically interested in sound for 40 years and I have never heard the 'subtlety' usage.
My mind works differently when it comes to language and the scope of possible meanings is something I always consider relevant.
What concerned me here was someone taking the colloquial definition of "ultrasound" literally, and making assumptions that are not valid in this context at all.
What the word actually conveys is both a matter of subtlety and frequency.
Turns out, having read the entire discussion, both are relevant in terms of threat assessment, and thinking about what is said more deeply can have a positive impact on a discussion of this nature.
All of which is why I chose to point out what "ultrasound" actually does mean linguistically.
Edit: In my experience, such uses can and do happen. I personally allow for it and use context to parse. Where there is ambiguity, I generally won't dismiss it out of hand.
Subsonic comes to mind here. As does the question why the word did not appear regarding these watermarks.
The answer may just be someone with far less domain expertise attempting to communicate.
[1] https://blog.benjojo.co.uk/post/encoding-data-into-dubstep-d...
Do they also talk about the process for identifying the participant who leaked the content based on the leaked recording? Do they need to retain the original copy of the recording to be able to extract the watermark?
An more conservative approach would be to transcribe the audio into text, and only offer the audio to (more) trusted parties for verification.
When you leak something it needs to be credible. Removing watermarks also reduces the fidelity and therefore the credibility. If 99% of the screen is blurred and the audio has been transcribed then how does the receiver know this is a real leak at all?
The answer lies in reputation. Leak high fidelity material to a trusted third party, usually a journalist. This can include just showing them the material though that involves meeting in person. They will verify the source material, summarise and down sample it to conceal the source actor, and maybe even destroy the source material itself.
The economics are simple: if you get a reputation for revealing sources then people will stop leaking secrets to you. Newsrooms that rebroadcast Zoom caps verbatim are revealing sources and need to clean up their act if we are to continue to rely on what’s left of The Fourth Estate.
Though I haven't seen them post an article describing in detail how watermarks on color laser printers work, that would be a bit too on-the-nose.
There is probably a way to eliminate the possibility of revealing the source without compromising any significant amount of fidelity.
If the covert signal (the employee ID of the leaker) is encoded with tiny dots then it could be filtered in or out with a band pass filter. Filtering out the data can be done with a fax machine if you can find one.
But if the covert data is embedded in the original signal at frequencies close to the signal “frequency” then you don’t stand a chance. The information band of written English provides a huge number of options for hiding other signals: spelling, choice of words, spacing, key phrases, capitalisation, the ordering of items in a list.
The government agency from where you are leaking — your adversary — has the original signal from which they adapted your slightly different copy that you leaked. All they have to do is hide 6 to 16 bits of data in 2kb of English language. This is trivial because they have the original plaintext with which to encode and later extract the signal.
How do you effectively tackle this, as a leaker? A journalist is the one type of filter capable of obscuring covert traffic at these frequencies. They read the document, summarise the implications, and then write that up. I probably wouldn’t let them keep the original text though.
That said, if you don’t work for a three letter government agency, in finance (especially at an investment bank) or at a corporation with tens of thousands of employees (and ideally, a tech company), there are plenty of non-technical reasons that leaking can be considered a relatively low-risk activity. The biggest reason is that the IT person tasked with finding a leaker, assuming it was from a meeting that many people attended, often isn’t paid enough and has a lot more valuable things to do than to try to play audio forensics. I know of several instances where companies have threatened to release the hounds, so to speak, to find a leaker, only for those hounds to be people who are either about to be laid odd or who have just lost a sizable portion of their team. Not a lot of motivation for those people to really care, so they just tell the angry executive they tried but couldn’t figure it out, the executive is placated by trying, and everyone moves on to another crisis.
And of course, many of these leaks only matter if the recording itself is widely shared or published. If something is recorded but given to a news organization who is instructed (or does their own due diligence and decides not to publish the audio/video/document) not to publish the recording but to use it as a source, well, good luck. In the US, shield laws typically prevent a news organization from turning over their sources.
It’s like with screeners for the Oscars. The screeners will be watermarked with your name and that’s usually enough to keep them off of torrent sites, but that doesn’t mean you don’t have a Dropbox or Plex account full of them that you share with your close friends and family. Like, sharing my WGA screeners with my mom is about as low-risk as it gets.
Can you explain more why you doubt this? Zoom has the financial and other resources to be state-of-the-art here if they wanted to be.
Presumably preventing things to be stolen at all is more important than finding who did it after the fact.
Radio has had this tech for a decade.
Watermarking may or may not survive that kind of process - depending on the kind of watermark it might be designed to still be detectable even in low-quality copies.
That is, maybe you can use video and audio filtering/manipulation to push the watermark bandwidth down to one bit of watermark per 1 GB of data, but with 100 participants and 7 GB of data, 7 bits is enough to identify the leaker.
Much of the works that makes up good journalism is the summarisation in a comprehensible manner of the full data they gathered.
Any number of techniques like this could be used, such that you can't be sure the "watermark" is gone without making the document functionally useless - especially if you don't know what the watermark is. e.g. maybe you take a black and white photo of the document above, but they also changed some of the wording on the page in each version.
+1 to my sibling comment's point about how each digital device you use to cover your trail will do its best to leave a new trail.
Thinking about this starts to border on paranoia, but if the document is written by a sufficiently determined organization, it's all possible.
It removes metadata (in the dumbest way possible - convert to raster and back) and also inserts random noise to defeat straightforward stego.
At the NYT mistakes like that get brushed under the carpet. Their personal professional integrity is why you can trust The Intercept.
Not so sure about that.
https://www.praxisfilms.org/open-letter-from-laura-poitras/
https://www.startribune.com/justice-dept-charges-minnesota-f... (german) https://www.heise.de/newsticker/meldung/USA-Dritter-Whistleb...
Including Reality Winner, that makes 3 in total.
> First Look Media’s decision to fire me after I raised concerns about source protection and accountability – rather than to demote or seek the resignation of anyone responsible for the journalistic malpractice, cover-up, and retaliation – speaks to the priorities of The Intercept’s Editor-in-Chief Betsy Reed and First Look Media’s CEO Michael Bloom.
This is plainly false.
Neither of them worked directly on the Reality Winner story, especially including handling the leaked material.
My statement was pretty bad, since it is very simplified and can be misunderstood (since the "they" is ambiguous). I posted the relevant links below, these explain the whole story way better.
Maybe something like mu-law, which only has 3 kHz bandwidth centered on human speech (as opposed to mp3 with usually 44.1 kHz) would perform best.
I also noticed that zoom corrects for lag in my connection by speeding up and slowing down speech. (I noticed that when my counterpart was running a metronome.)
Zoom could artificially introduce micro-lags to encode data. Eg as a human I can't really tell whether some sound starts on an even or an odd milli-second.
Not really. And if a user does, they will hear rather mundane codec artifacts, and or noise that is basically like other noise.
Given a redundant mark, and the system I linked has multiple, concurrent redundancy, the chance of the mark surviving grows with the amount of audio.
They can literally drop marks during speech the entire time.
Sort of like the content recognition systems in use:
https://en.wikipedia.org/wiki/Automatic_content_recognition
on the other hand, I found this interesting:
In January 2018, a YouTube uploader who created a white noise generator received copyright notices about a video he uploaded which was created using this tool and therefore contained only white noise.
You lose the "voice" in the process, but in some situations it might actually be fine
POTS is a few KHz. So less, but without looking into Nielsen's fingerprinting methods I wouldn't say you could assume that the fingerprint wouldn't be preserved running it through a phone line first.
I must be too far detached from large companies to know/care about this.
Yeah, exactly.
Zoom meetings are like those, but with the sharing of sensitive information transmitted over the Internet. Someone could easily record their screen and audio and capture said sensitive information for subsequent sharing -- or "leaking"-- with someone else.
If this kind of thing is now done on a Zoom call, how is it any different than prior to Zoom being in the meeting, hearing the information and passing it on via another means, like a phone call? What value would leaking the call as in your example have?
I'm struggling a bit to think of any examples of private information being leaked that have really changed because of Zoom. Trusted employees are able to leak private corporate information, always have been.
I personally doubt it’s particularly sophisticated at all. But the fear of getting caught it creates would be enough to deter a significant portion of potential leakers.
Why is any watermarking necessary at all? Because DLP (which includes anti-leaking control) is a huge concern for most businesses, and working from home makes the problem even more serious. Zoom is trying very hard to position themselves in this market (and doing a rather good job of it), so in that context the feature makes perfect sense.
Happy to get bits from A to B. Go make doing shady things easier/safer on your own time.
It's basically impossible to be sure, though if you had multiple endpoint recordings you could probably identify likely deltas.
Examining the state of the zoom client might also be useful, because it is free to do this client side. Unless the IDs are cryptographically generated server side, you could tweak the client side to show someone else's client ID.
I would think this to be the case of blurring the watermarks in a video feed, but since every zoom feed on a single is so different that might not work. Most of the deltas are not intentional.
i think i presented this paper for a course journal club from two decades ago, a decade ago on the topic:
https://www.sciencedirect.com/science/article/abs/pii/S01651...
"The basic principle borrows from spread spectrum communications. It consists of addition of an encrypted, pseudo-noise signal to the video that is invisible, statistically unobtrusive, and robust against manipulations."
https://www.sciencedirect.com/science/article/pii/S016516849...
Not only is watermarking not that effective it can more easily be retro performed on anything; when such incriminating evidence is required.
And we are in the digital domain, and all digital can be faked; everyone here made sure of that.
Just reread. Very interesting conclusions.
Shouldn't we assume there are all kinda of steganography being employed? It feels like enough information could easily be hidden in PDFs, images, videos, and you wouldn't know unless you're doing bit-comparison to others' versions of the same.
They might also be using a small number of range of methods and you won't know which methods you haven't seen yet so you can't make assumptions about the next file based on the previous one.
Show HN: zoom-dewatermarker (github.com)
Seriously though, I doubt what Zoom is adding (specifically for audio) is anything that new. Does anyone have experience removing this type of stuff? Would something like a bandpass filter for say, 100 Hz-15 kHz work?
Probably need to do this several times for different participants and meetings to get an idea of what the watermark looks like and where in the spectrum it sits.
Even things like background electrical hum have been used in audio forensics.
But wouldn't doing something like that make the recording seem like a deepfake, potentially reducing it's credibility? To an outside observer, it may make a genuine recording appear to be fake.
I'm reminded of the controversy over the faked Bush Texas ANG documents. They were discovered by randos on the internet realizing the text looked like the output of a modern version of Word than the 70s typewriter they should have been written on if genuine. Imagine a similar but genuine document where the content was deliberately retyped using anachronistic equipment to obscure the leaker's identity.
[1] https://en.wikipedia.org/wiki/Killian_documents_controversy
Why not do speech to text at that point?
Leakers need some fidelity to prove their credibility. But fidelity also identifies them.
A real world example is GPS, which uses a spreading code to provide about 30 dB of gain. GPS signals aren't directly observable relative to the noise floor in many receivers. It's not until after the signal is "de-spread" that it becomes observable in a spectrogram. This process requires prior knowledge of the signal structure.
In short, if you don't need to send data at high rate there are many ways to hide your signal.
We're also dealing with only 48KHz, which is 2-3 magnitudes less than what SDR people are accustomed to dealing with.
And we can also make our own detection systems by having a 3 person "meeting" with fake audio, with this fingerprinting on, and then comparing the 3 recordings.
Link to the video? Searches aren't coming up with anything useful.
https://www.youtube.com/watch?v=z9RkPt6uVQ4
Note, it's not from the official Def Con channel, so some fuckery is afoot.
The visual watermark is more tricky, but thanks to streaming video piracy, we have a bunch of out-of-the-box watermark removal techniques.
Interesting arms race :)
Regarding hi/low pass, theoretically this should be fairly simple to defeat by spreading the information across multiple frames.
Note: I know next to nothing about watermarking, my comment is just a purely hypothetical attack on your trivial assumption. The trivial work around has trivial work around work around... ;) <insert that scene from the big hit>
I bet the system in use looks a lot like Arbitrons system.
It is near impossible to hear. And when someone does, it basically sounds like very minor league codec artifacts.
Someone very familiar with a given voice, or other content, may possibly be able to tell. But an A / B test of this VS. codec artifacts will likely prove inconclusive. It is hard given clean audio to compare against.
Once things have gone through a codec, all bets are essentially off.
This is not to say software detector could not be used. The average phone should do fine.
This was like before the Olympics in Brazil, so it must have been 2015, maybe earlier. Since then, I've always assumed that someone is secretively recording all meetings where I have to wear a suit.
Much, much earlier, during the 2008 meltdown, meetings sometimes ended with loosen-up remarks that one wouldn't want recorded (one client was a big corp whose CEO was known to have an extremely attractive wife). These were valuable bonding moments, but maybe they underscored a corporate culture that had its downsides (like making the pretty girl in the team do all the charliework).
Either Trump or Biden needs to make some EOs to clip zooms wings, it just looks like a disaster waiting to happen.