back to article How an ancient printer can spill your most intimate secrets

Researchers have devised a novel way to recover confidential messages processed in doctors' offices and elsewhere by analyzing the sounds made when documents are reproduced on dot-matrix printers. This so-called side-channel attack works by recording the “acoustic emanations” of a confidential document being printed, and then …

COMMENTS

This topic is closed for new posts.
  1. Sorry that handle is already taken. Silver badge

    Well there's a stroke of luck

    And I only just threw out my DM printer too. Fifteen years ago.

  2. It wasnt me
    Thumb Up

    Brilliant

    If you're only 2 centimeters away then why not just read it ?

    Top boffinry.

    1. Liam Johnson

      why not just read it from 2cm??

      Because you might be noticed, hanging over the counter at the doctors surgery??

      They might also have been better off using a different design of microphone as they get further away.

      1. Jerome 0

        Re: why not just read it from 2cm??

        "Because you might be noticed, hanging over the counter at the doctors surgery??"

        Whereas dangling a 7cm long microphone 2cm away from the printer would be far less conspicuous.

        1. MacroRodent
          Boffin

          Re: why not just read it from 2cm??

          "Whereas dangling a 7cm long microphone 2cm away from the printer would be far less conspicuous."

          Bah. Just "forget" a bag with the microphone and recorder near the printer. Depending on the circumstances, it might stay in place for some time before anyone wonders. With suitable camoflaging, the presence of the equipment could also survive the bag being opened by the doctor's assistant.

      2. stucs201
        Pint

        @Liam Johnson

        "Because you might be noticed, hanging over the counter at the doctors surgery??"

        So read it by replacing the microphone thats 2cm away with a camera, which could probably be further away.

        (Beer because I'm off to the pub in a bit :))

  3. The Nameless Mist
    Alert

    Dot Matrix !

    My doctor's surgery in the UK went to laser printer some time ago.

    Given the epic handwriting issues with British doctors this was probably a good thing.

    1. Tigra 07

      Encryption?

      Maybe Doctors have a pen capable of encrypting their writing?

      it would explain the jumbled mess they write

  4. Parax

    Not only but also..

    So who sends old ribbons for secure destruction? some types of ribon show exactly what was typed, (the ribon moves on after each keystroke) all you need to do is unwind the ribbon and hey presto every message ever typed..

    anyway today its Thermal Laser and Inkjet that rule the roost, Old News.

    1. Trygve Henriksen
      Thumb Down

      Oh yeah...

      Nothing beats a Dot matrix printer when you're required to make a CarbonCopy, or use special multi-page forms with strikethrough.

    2. Anonymous Coward
      Boffin

      News for ribbons

      Ribbons are typically changed when the ink is diminished. Until then the ribbon has gone under the print heads dozens of times and deciphering text from the ribbon would probably need serious laboratory work.

      You could as well ask who sends their laser printer's drum for secure destruction as the last pages printed could be restored as well.

      1. Nuke
        Alert

        @ AC "News for Ribbons"

        As the GP said, there are SOME types of ribbon ...

        I had an IBM "Quietwriter". Its ribbon had a thin polythene (?) substrate with a thin film of ink on it. It was drawn once through from a feed spool to a take-up spool, and advanced after each character typed. Once all through the cartridge had to be thrown away. You could draw out the ribbon afterwards and read every word as transparent characters in the black ink.

        Try winding it back for a second run, and the printed characters would miss bits of black where they co-incided with what had been typed on the first run.

        It was very wasteful. Even if you had just one character on a line it would still advance the ribbon by the length of a whole line.

        1. Peter Gathercole Silver badge

          Two types of ribbon setting for Quietwriter

          There was the full quality setting that advanced a complete letter at a time, and there was the draft quality setting, that actually only moved a fraction of a character position. This meant that you may get gaps in the later letters, where there was an overlap, but your ribbons lasted many times longer. This would make it much more difficult (though not impossible) to read from the ribbon.

          I think that they were different ribbons, but it may have been a lever setting in the printer. I don't think it was a software setting.

          These were actually thermal transfer printers rather than impact printers. This is how they managed to be so quite. Normal whirring from moving the print head and paper, but printing was silent.

          Mine only advanced the ribbon for each letter printed (the ribbon was mounted on the print head), not on a per-line basis although mine was a Quietwriter III or IV and could have been different from Nuke's, so was not quite as wasteful as he suggested.

      2. Trygve Henriksen

        Not all.

        Some printers and electric typewiters use a 'one time' ribbon, similar to the ribbons used in labelprinters and such today.

        (thin plastic film with a black coating that is transferred to the paper with an electric discharge)

        Of course, most of those printers could use 'fax paper' insted of normal paper just by removing the ribbon. but those prints tended to fade over time.

        1. Anonymous Coward
          Anonymous Coward

          Carbon Ribbon

          This was known as a "carbon ribbon" and such typewriters would be found on the desks of the secretaries of high-ups. The quality of the output was more akin to sharp print, or to the yet-to-be-invented laser printer. More advanced typewriters could do proportional spacing and even justification. Remember the IBM Golf Ball machine? That could even handle mixed faces.

          The IBM electric typewriters of the day had a keyboard that was so sensitive that even breathing too hard produced a string of gibberish on the paper. Those who tamed it could type very fast on it.

          Oh... I guess this was about Dot-Matrix printers, not typewriters!

          Distinctive sounds, yes... I used to dance to them, in the office, while waiting for print to finish. You can't do that with a laser!

  5. Anonymous Coward
    Happy

    Very good

    Now I have to admit, that's pretty cool as 'ID theft' tricks go!

  6. Rebecca 1
    Black Helicopters

    If there's no audio sheilding...

    ...Then what's to stop the whole doctor-patient conversation being eavesdropped?

  7. John Smith 19 Gold badge
    Boffin

    First side channel attack

    I recall reading an article indicating remote reading of moving head hard drives going back to 1967.

    Note the drives in question were the size of a twin tub washing machine.

  8. Trygve Henriksen

    Easy to block...

    This requires the words and letters to be written in sequence...

    It shouldn't be too difficult to make the printer write a few characters, skip a few, write a few more, backtrack and fill in (part of?) the hole and so on.

    Or, you could have it write the upper half of a line, then the bottom half on the return pass. Or maybe do an 'even/odd' dot pass?

  9. Anonymous Coward
    Megaphone

    add noise generator to printer

    rather than an acoustic hood (expensive, big, traps heat, makes access awkward), just add a small speaker to the printer that generates acoustically similar random noise while printing - it will be no louder than the print noise itself, and will mask the acoustic signature of the print head.

  10. Richard Jukes

    Interesting

    Interesting and Im glad some chap has had a brainwave, sat down and worked it out - alas while it is a nice bit of thinking I cannot see any pratical use for it. I myself use dot matrix printers at work to print out hire contracts on carbon copy paper - it certainly wouldnt be the end of the world if someone found out what was being printed...

    Still, its nice to know it can be done!

  11. Anonymous Coward
    Anonymous Coward

    And typewriters

    According to Viktor Suvorov (if I recall correctly) in the specially suspended secure room inside a Soviet embassy, with noise generators between it and the surrounding walls, reports had to be written with a pencil as the sound of a typewriter, should it despite all the precautions be recorded by the enemy, could perhaps be analysed to discover what was being typed.

    1. Anonymous Coward
      Joke

      title

      "should it despite all the precautions be recorded by the enemy, could perhaps be analysed to discover what was being typed."

      I've seen a certain Chicago living, wolf owning Canadian do this...

  12. Anonymous Coward
    Anonymous Coward

    could you not simply

    be sure to run two or more dot matrix printers at the same time?

  13. Anonymous Coward
    Coat

    Back when...

    .. dot matrix printers were common I was doing computer maintenance. I could usually tell the type of printer they were using from the noise, even across the phone. The Epson MX-80 in particular made a hell of a din.

    Ok the sun's out but I'll get it anyway.....

  14. max allan

    Ho ho "Vorsprung Durch Technik" ?

    So, technology has advanced beyond the physical carbon paper copy stage to the point where you can just tell your printer to print 2 copies (or even more if you want) and yet the Germanics are still using carbon paper and impact printing.

    It's not like you couldn't simply print something different onto carbon paper, so it's not like it's a guarantee of anything.

    More like "Rucksprung Durch Schreiberei".

    1. Anonymous Coward
      Anonymous Coward

      Or, perhaps, using the "Technik" appropriate to the problem

      "So, technology has advanced beyond the physical carbon paper copy stage to the point where you can just tell your printer to print 2 copies (or even more if you want) and yet the Germanics are still using carbon paper and impact printing."

      Multi-part stationary is used for a reason - it makes things a little harder to forge, for a start...

  15. Anonymous Coward
    Welcome

    Don't mention the....

    I, for one, welcome our carbon paper wielding, dot punching overlords.

    Heil Merkel

    Oh, sorry they tried something like that 60 years ago, after having tried it about 30 years before, and it didn´t really work.

    (Why is there no "bad taste" icon?)

  16. Pascal Monett Silver badge
    Thumb Up

    Sure, today it's inkjey and laser

    But one has to start somewhere, and it seems rather logical to use the most obvious system to weed out the errors first.

    After all, what input is being used may have little influence once the patterns have been defined.

    Thus, the next step of this boffinry is to ensure that recognition gets boosted to at least 95% in all cases.

    After that, all that is needed is to define the patterns of an inkjet printer and presto ! Industrial espionage via the secretary's personal paper waster.

    It's a work in progress, don't knock it.

  17. Daniel 1
    Joke

    "The attack so far works only on English text"

    But only if the printer types VE-RY SLOW-LY AND VE-RY LOUD-LY.

    1. Dale 3

      Very slow and very loud

      That would be the old Apple Imagewriter then.

      1. Anonymous Coward
        Boffin

        Unfortunately

        An Apple Imagewriter is actually just a rebranded C-Itoh.

  18. Anonymous Coward
    Thumb Down

    I suppose after they'd finished the research...

    ... they had to return the dot matrix printers to the Boston Computer Museum.

    Pity they didn't think of doing this research in the 1970s, when it might have been relevant.

  19. Lottie
    Pint

    Rather than bash the printing tech

    I would like to congratulate what sounds like an amazing piece of coding!

    1. Daniel 1
      Joke

      An amazing piece of coding?

      They probably just found a Python module to do it.

      >>>import listen_to_printer

      >>>params = {"Epson":"MX-80"}

      >>>print listen_to_printer.whats_it_saying(params)

      It looks like the printer is printing a suicide note. Would you like me to help?

  20. Anonymous Coward
    FAIL

    @parax

    "anyway today its Thermal Laser and Inkjet that rule the roost, Old News."

    Err, not when you want 24/7 unsupervised logging on contiuous paper they don't. And when you want a printer than can go 2 weeks doing said logging without bitching about a new toner/ink cartridge being required and refusing to work until its replaced. DMs will happily carry on printing no matter what the state of the ribbon.

    1. A J Stiles

      Oh really?

      "DMs will happily carry on printing no matter what the state of the ribbon." -- maybe 9-pin ones. But 24-pin dot matrix printers are more sensitive, and a seriously-worn ribbon can bend a pin. Been through two print heads that way .....

    2. Parax

      Doh

      And just to prove the pointlessness of the research.. you give a '24/7 unsupervised' printer as an example of one that could be 'spied' upon! Doh! hardly difficult spying on that..

      Of course there are specialist devices for specialist jobs. but today surely DM is less than 2% of printers.. hence does not rule in the world of printers.

  21. Number6

    Who needs sound?

    You don't need sound to monitor a dot matrix printer remotely - plenty of electromagnetic radiation from the print head drivers and it probably goes through windows and walls better as well. Even inkjet and laser printers, especially those in plastic cases, will probably radiate well enough to reveal their output to a suitably-equipped remote listener.

  22. Graham Bartlett

    Ignobel Prize Winner!

    Great achievement guys. Usefulness in the real world - zero.

    For your next trick, how's about traffic light sensors to detect a horse and cart waiting? Or a lightweight flashing red light as an improvement to the flag carried by the chap walking in front of your Model T Ford? Maybe even a gadget to let you know that your rapier is properly seated in its scabbard?

    1. Anonymous Coward
      FAIL

      Retard

      Guess this one didn't bother reading the "60% of doctors still use" part of the article.

    2. Curtis
      FAIL

      no history

      Government Agencies, Doctors, Automotive Repair, Police Departments, ad infinitum are still using Dot Matrix printers. These printers are preferred due to low maintenance, low user intervention, and ability to print NCR forms. Sure, you can have your laser/inkjet print multiple copies, but there still runs the risk of it printing one form differently than the others (think contract law and legal proceedings).

      As for a stoplight that can detect Horse & Buggy, such a sensor would be useful for motorcycles, cars made with non-ferrous materials, and even the, you know, Horse and Carts that are still seen in some parts of the country.

  23. rhydian

    Bitch all you want about "old tech"...

    But you can still buy Epson LX-300s new. OK, a £30 inkjet printer would knock the socks off it for quality and speed but an LX-300 will noisily bang away until the end of time itself. Perfect for logging jobs.

    1. gaz 7
      Paris Hilton

      Paris

      San ld LX-300 would bang away noisily for years" - hope you nicknamed the printer Paris then (cos some had to. It's the law)

      What will the massivly paranoid comd up with next. Work out how to steal some one's credcit card details by analysing someone's shit and work out which restaurant they ate at! Do these people ever leave their faraqday sheilded panic rooms

  24. heyrick Silver badge

    "the rate dropped to about four per cent when the distance reached two meters."

    Interesting proof of concept, but probably not so useful for espionage. Given the age of dot-matrix hardware, it might be simpler to look a little dongle between the printer and the parallel port? Hell, these days you could probably put a tiny microcontroller and an 8Gb flash chip in the parallel plug, record everything between "servicings".

    1. Marcelo Rodrigues
      Boffin

      Two words:

      Laser mic. There are mics that work based on the vibration of the target - not the sound. They are used in surveillance, where You can point one to a closed window and "hear" what's going on inside.

      Why not point one of these at the printer itself? Works from dozens (hundreds?) of meters.

  25. Anonymous Coward
    Stop

    Dot matrix printers aren't dead yet...

    Whilst most of the world has moved on, I know a fair few UK Government departments are still relying on dot matrix printers to produce cheques...

    1. Someone Else Silver badge
      Happy

      And they still use IE6 too...

      ...wait a minute.....

  26. Matt Bucknall

    Carbon copies

    Why do we still rely on carbon copy paper? Surely this dates back to a time of no printers, or printers which were too slow to print everything out twice. Is there some antiquated law which dictates that carbon copy paper must still be used for certain things? If so, it's about time it was rescinded.

    I suppose there is the case where you might require two copies of one signature. But then there has been plenty of times when I've had to sign certain paperwork multiple times.

    1. Peter Gathercole Silver badge

      Pedantic, I know

      but legally, there is a difference between two copies printed at the same time using multi-part stationery, and two copies printed one-after-another. There is no guarantee that the two serially printed sheets are identical, because they could just be one print after another, with the second one slightly different. How would you know unless you minutely compared them?

      And yes, I know that the lower copies in a multi-part *could* have been pre-printed, but that is why they come bound together with tear-off sprockets, so that you can tell whether the lower copy has been tampered with.

  27. Iggle Piggle

    Alternate print heads

    Instead of messing around with microphones and DM printers how about creating a replacement print cartridge for ink jet printers with memory built in. If you can get close enough to place a microphone then you can get close enough to replace the cartridge of the printer with one that records every dot printed.

    Getting hold of the memory could either be done wirelessly or by going through the trash.

    1. Anonymous Coward
      Anonymous Coward

      Really?

      Have you ever changed ink or toner before? I'm pretty sure putting in a modified cartridge would be far more conspicuous than placing a covert recording device. Audio bugs these days can fit on the head of a pin and could be placed on the printer with the touch of a single finger, in passing.

      1. RichyS
        Joke

        More really?

        And I'm pretty sure Epson/HP et al would tell you that you've invalidated the warranty.

        ONLY USE GENUINE(R) INK(TM).

  28. bluesxman
    Coat

    Clarficiation required

    "the four Wikipedia articles printed averaged an accuracy rate of about 63 per cent"

    Seems a tad higher than I expected.

    Oh, wait ... Are you referring to the validity of the source material or the accuracy of the transcription?

    1. This post has been deleted by its author

      1. Anonymous Coward
        Anonymous Coward

        Re: Joke

        I thought it was rather a good joke... and I like Wikipedia.

        And for the record, Wikipedia was not found to be more accurate than Britannica. Here is an article we wrote at the time...

        http://www.theregister.co.uk/2005/12/16/wikipedia_britannica_science_comparison/

      2. bluesxman
        Coat

        RE: Joke

        "Wikipedia has a higher accuracy rating than printed encyclopedias, including Encyclopedia Britannica"

        Where did you read that? Wikipedia?*

        "But people could change it! Yeah, and I could walk into your house and write in your encyclopedia, big deal"

        A biro drawing of a cock-n-balls might not be noticeable in your encyclopedia, but would be in mine**.

        * It's the joke that just keeps on giving!

        ** Implication of my owning an encyclopedia was added for comedic effect.

      3. RichyS
        Joke

        @Ballseyed

        Are you Jimmy Wales?

        I thought it was quite funny.

  29. M. Burns Silver badge
    Boffin

    Nothing New Here, Move Along

    This type of acoustic eavesdropping was used decades ago to determine what was being typed on IBM "ball" typewriters. The delay between the key press and the type strike is unique for each position on the type ball. Spy agencies would try to stick a "bug" in the typewriters they wanted to monitor.

  30. JP19

    Pointless

    If you have enough access to a printer to stick a microphone on it and some way of recording or transmitting the audio then you have enough access to stick a dongle in series with the printer lead and record or transmit exactly what has been printed.

  31. Stevie

    Bah!

    You're all missing the point! The key question, the BIG question here is: Where in Aazathoth's name did these kids find a dot matrix printer that was a) in working order and 2) had a driver that was compatible with today's operating systems?

    As for multipart paper - the use of it goes back to impact line printer days and has little or nothing to do with the legal world (that in all probability came up with its persnickety rule years after carbon copies were a reality).

    Multipart stationery is - or was - used simply to save time. There was typically one and only one printer in a computer room and it ran all night non-stop in most shops I worked in.

    Many years ago a fellow consultant at a large manufacturing plant in the UK brought all development to a halt by printing nine copies of an enormous bill of materials print ( we're talking a box of fanfold greenbar per copy here). Once the protests had risen to a certain level I asked what was going on and was filled in. I then asked the lady responsible why she hadn't run it as two print runs (one on four-part, one on five) instead of nine runs on top copy only. The stunned silence from the young and restless, who had forgotten that it wasn't always simpler to just say print X copies in the ECL was quite satisfying.

    I grabbed her hands as she tried to cancel her run (which would have wasted 3/4 box of paper) and called the operators and had them intervene by loading two-part in 3 of her queued runs, then sticking them into backlog until the early morning and it was Job Done.

    Of course, no-one but me had ever tried to read the bottom copy of five part (mostly illegible black smudge) or the top copy (mostly letter-shaped holes punched in the paper due to the need to dial the print hammers up to Maximum Wellie just to see *anything* on the bottom copy) and so there was yet another voyage of discovery to be undertaken by the New Guard when someone remembered my advice.

    Luckily that would be after my contract was up and I was long gone.

    Ah, the Goodole Daze.

    1. AdamB

      old hat

      Not exactly new. In the early 70's spooks started recording IBM "golfball" typewriters and figuring out what was being typed by the length of time to rotate the ball to each letter.

    2. Peter Gathercole Silver badge

      @Stevie

      You're talking chain or band line printers here. I very much doubt that a dot-matrix, even a heavy duty one like a Printronix, would be able to do more than three part, chemical transfer paper.

      When I was working with mainframe band printers, we were using multi-part fanfold stationery with interleaved carbon paper (not chemical transfer paper). There was a machine called a splitter, which would split the copies out and wind the carbon paper up for disposal, while leaving the two split copies neatly folded (at least, if the operator threaded it correctly). For three and more part stationery, it had to be put through further times to split each copy off. Interestingly enough, each carbon sheet had a completely legible copy of what was on the page. We also had authorized cheques with a second carbon copy, but this was for audit purposes.

      I was once told that the hood on these fast printers was more than just acoustic protection, because if the band or chain broke, it was moving so fast that it would damage the hood as it flew off. Not something I would like to hit me.

      Where's the old fart icon.

  32. Mr Young
    Thumb Up

    Faster than a speeeding bullet....nearly

    I've never seen an inkjet or laser win on speed compared to a dot matrix I saw about 20 years ago. It actually was a moment - "how many lines of code is that? Is that mine? Oh nooooo"

  33. J 3
    FAIL

    speech-recognition technology known as Hidden Markov Model (HMM)

    I'm sure lots of such techs do use them, but HMMs are not a "speech-recognition technology".

  34. Anonymous Coward
    Anonymous Coward

    little new here...

    I was designing counter measures to EMC eavesdropping and the like on such impact printers back in the 80's (US Gov't Tempest spec) . There's little new here... If anything this illustrates the knowledge management issues across generations regarding such forms of security aware technology.

  35. Anonymous Coward
    Coat

    Walls have ears

    How unnecessary! As all von Däniken fans know, walls (and other solid objects) record all the sounds that were ever played within or near them, at the quantum level. Now if we only had a way of playing it back ...

    Mine's the one with a copy of "Chariots of the Gods" in the pocket ...

  36. Doug Glass
    Go

    Duhhh!!

    Why do you think they sold those foam lined boxes? To cut down noise in the office place? Frell no, it was to keep government secrets out of the hands of wikileaks. Or the Russians maybe. Or aliens in my case. Crap! I guess that means all my Windows 3.1 serials are in the wild. Damn!

  37. verbatim
    Alert

    security!

    there's a man loitering in a very suspicious manner near our printer...

  38. A J Stiles
    Boffin

    Another use for dot matrix printers

    Another use for dot matrix printers:

    If you take out the ribbon and trick the sensor with matchsticks and/or electrician's tape, they can print onto the stencils used in those old hand-cranked printing presses they used to use in schools before photocopying became affordable.

  39. Simon 39
    FAIL

    What's old is new again.

    This "news" is decades old.

    Those machines were never secure, anyone remotely interested in the topic should have known this.

    Next we'll have some top notch product of our educational system discover the cardboard box.

  40. KayKay
    Black Helicopters

    sshhhhh....

    Laser printers are not secure at all -- they have internal memory to "spool" the print jobs, and most of this can be (and apparently often IS) recovered when the printer goes for service/recycling. Ditto copiers capable of more than single copies.

    During the Cold War the Ruskis were able to intercept encrypted communications from foreign embassies by remotely reading the electromagnetic fluctuations in the 6 inches of bare cable from the tele-typewriters to the encryption box.

    Biros sending signals of the what was being written, by monitoring pressure and direction, existed, not just in Bond movies.

    Hard drives in discarded First World computers are being read in Chinese "recycling" shops to obtain banking and other data useful for ID theft.

    The only really secret secret in the world is the one not communicated to ANYBODY and not even thought very loudly.

    Where's the AFDB icon???

  41. Wile E. Veteran
    Unhappy

    Old News

    The TEMPEST requirements for mll-grade IT equipment has included prevention of this attack vector since the 1960's. The recent launch of the new Coast Guard Cutter Bertholf was delayed for several months because of failure to meet this particular standard.

  42. Anonymous Coward
    Big Brother

    LX300...

    I've even seen color ribbons for those. And new ones can be bought straight from Epson, with USB cabling and all.

    There is no other way to print 5-way Carbon-copy invoices. We usually run out of continuous-feed invoice paper faster than the ribbons. Plus we were able to 'recycle' ribbons using stamp ink. Messy, but very effective. And cheap.

    But wait, we have an Olivetti Tekne 3, for when the PC hooked to the LX-300 craps up, or out-of-hours emergency batches. Yes, that's a typewriter, it weights only 35Kg, it is 35 years-old, and still works. You could swear that the desk where both of them are sitting could collapse any minute, due to vibration. You can hear those from 500 feet away, without microphones. Both of them sound like high-pitch jackhammers. We are almost required to use earplugs.

This topic is closed for new posts.