That's a nice, subtle way of fucking with someone: spoofing messages that trip these pedo-sensors won't result in an obvious mistaken raid, because the police will want something more solid to go on (like the case in the OP) -- the victim will just show up as 'pedophile, we just can't prove it yet' in a bunch of police databases/background checks/opposition research, and won't know why the random searches randomly choose them every time.
I suspect that the "hash" actually is the following info per file: sha1-hash, md5-hash, crc32-hash and file size. If a file matches the file size, hash1 is checked, then hash2 and so on. I will be pretty impressed if you can fake that somehow.
Edit: this is a normal algorithm for files in general, but it appears to be a image-specific algorithm used in this case. (A la imageDNA)
I'm actually guessing not. It's probably something similar algorithm-wise to what Shazam does. Probably not a crypto-hash, but more likely a hashing of robust features (in a relative as opposed to absolute location form) detected from the image to give a "fingerprint." Such features would be robust to scaling and most compression artifact issues. EDIT: Here's a good example: http://laplacian.wordpress.com/2009/01/10/how-shazam-works/
If this is Microsoft's hash algorithm, the one from the robust image hashing paper, it's not perceptual (like Shazam); it's coding-theoretic. If I understand it correctly, it leaves room for false negatives from drastic (but intelligible) image changes in favor of avoiding false positives from attackers trying to deliberately trip it with non-matching images.
If you are the sort of person able and willing to screw with someone's life like that, you will have no qualms using your stolen credit cards to buy child porn images to use in this way.
I remember a episode of some legal drama where our hero the judge had his laptop "hacked" and child poem images installed on it. (Luckily it was make believe so he was able to "delete" them before the other judges arrived with the tipoff but that's not the point)
I think we shall soon enter a legal landscape where mere possession of digital products does not imply legal possession. It's going to be an interesting world.
This scares me. What can we do though? Can we decriminalize/legalize possession of anything? Perhaps just make it illegal to produce illicit materials? How would it work? Would that mean bad guys would be able to legally own weapons-grade plutonium if they didn't produce it?
It only applies to digital products. If you are found with next doors stolen TV it's not much of a defence to say "I did not put it there", but since any script kiddie from Russia or China can dump bitcoins, porn or military files on your bot netted PC we shall have to see a higher level of proof from prosecuters beyond "well it's on his PC so he must be a MtGox exec / paedophile / spy"
The article said the hash was effective across resized versions of the same file. Pick the top 50 most prevalent colors by pixel and create a normalized vector representing the distance of each color's center of mass from the center of the image.
For a photo, you might have to be a bit fuzzier than that, given that things like jpeg recompression can change a lot of that. I assume there are techniques to get around that sort of thing, though, and major software vendors like Google & Microsoft ought to have the sort of people who can solve that problem.
There's no such thing as a "pedo-sensor". This is a hash-based search against a corpus of known images, where the hash function was designed explicitly (a) to survive image transformations and (b) to prevent unauthorized parties from predicting the hash of a given image.
Either of those two goals could fail and it would still be implausible that an attacker could trigger a false positive without using an image derived from actual known child pornography.
I think he means spoofing the message was sent by a particular person, but not actually spoofing the content. The content has to be real to trip the hash-search.
I'm actually aware of systems which were built to identify porn through neural-network training. I don't know if these were sensitive to distinguish child porn from other, but as a method of finding images likely to contain more skin than desired, they worked fairly reliably.
That said, the Google/Microsoft tool does seem to work based on a known image corpus.
