Manafort Left an Incriminating Paper Trail Converting PDFs to Word

Here's how (on windows): download qpdf (http://qpdf.sourceforge.net/) and run

     qpdf.exe -decrypt encrypted.pdf woho.pdf

    # usage:
    #    decrypt.sh mypdf.pdf
    # the decrypted file will be named mypdf.pdf, while the old encrypted is now mypdf.pdf-encrypted.pdf
    # 
    echo pdf to de-secure: $1
    read -n 1 -s -p "Press any key to continue"
    mv "$1" "$1"-encrypted.pdf
    qpdf.exe -decrypt "$1-encrypted.pdf" "$1"
    echo encrypted file is now named: $1-encrypted.pdf
    echo decrypted file is: $1

Sending files to someone else is a problem with a ton of solutions, some of them better than others, but none of them actually solving the problem. Email often has size limits and spam filters block certain attachments. Dropbox is often restricted at most workplaces, and not everyone uses it. It also has size restrictions. USB is the most reliable, but then you get into the whole "it's NTFS formatted which doesn't work on my Linux machine" or it's HFS and I need to use it on Windows" nonsense, plus sending it longer distances takes days through the mail.

But converting documents... guys it's just electricity running through fancy sand. It shouldn't be that hard. I work on software where I'm often connected to a jump server without Office installed on it, and the software expects me to open a spreadsheet for troubleshooting. I was doing some audio recording recently and the hoops I had to jump through to save it as MP3 weren't insurmountable, but still pretty annoying.

And don't get me started on the Office 2003 spreadsheet that makes me boot up my Windows XP VM to open because the macros won't work on Office 2017. Or when I need to use Visio but there's no Mac version so I have to open my VM too.

And the web just makes it worse... no more software incompatibilities because when software isn't supported anymore, we just shut the servers down and everything is gone forever.

https://www.buzzfeed.com/jasonleopold/manafort-under-scrutin... (bottom)

The entire inventory of the store is barely worth 25K, I assume he must have been loading up on gift cards a la Mexican drug lords (http://am.blogs.cnn.com/2009/06/10/drug-lords-using-gift-car...).

That's not to say that he couldn't have learned were he interested, but his daily life had very little intersection with this kind of thing until he spiraled into a hole of debt, at which point "do I trust this person" ranked a lot higher than "how are this person's technical skills?"

Back to the privacy point, we are currently going through NIST 800-53 at work. We only need 800-171 but we thought the 800-53 standard would make us a better organization. So many things I didn’t think of. Do you have a micro-cut shredder first of all? Those Enron-esque cross-cut shredders don’t cut it anymore with open source machine learning that can easily reassemble those documents. Also, do you have an access code for your printer so the document only prints when he/she is up there, and doesn’t get left throughout the day in the tray for prying eyes? Also are your servers currently sitting in inventory up high on the shelves in case water gets into the building? So many things...

AmazonBasics 12-Sheet High-Security Micro-Cut Paper, CD, and Credit Card Shredder with Pullout Basket https://www.amazon.com/dp/B00D7H8XB6/ref=cm_sw_r_cp_api_zCfK...

>Try it in Adobe Acrobat (via the “Save as Other” command under “File” on a Mac) and you’ll quickly be redirected to Adobe’s website and presented with a handful of subscription packages that will allow you to transform your documents. [...] Indeed, it’s probably a little safer, all things considered.

If I was doing shady stuff the last thing I'd want to do is send my incriminating documents to some 3rd party service. That being said I would also probably not send them over the clear in emails either.

It's pretty insane how cavalier people are with email security (or lack thereof). I can't imagine that they would be so lenient if they were sending each other the files over regular mail. I think most people simply don't realize how thoroughly unsecure stock email is, you're basically lending an open postcard over the internet and you can be sure that a bunch of copies are made along the way. It's pretty much the worst way to share sensitive documents online short of posting them on facebook.

I noticed that when I select a region of text with a mouse, the retracted' black text becomes white text over black background. It revealed name of our competitor, addressees and numbers in their offer, the whole retraction was just a typographic trick.

When in doubt, print -> scan -> convert to pdf.

"I attempted to transform my Word draft of this blog post into a PDF. I confess that I did fumble a bit at first (it’s been a while), but I eventually managed to get the job done. According to my stopwatch, the full ordeal took me 42 seconds."

When the real problem ws turning a PDF into Word.

Another example: I seem to recall a case awhile back where Word change-tracking contained sensitive information even though “the document” didn’t seem to.

Sadly it used to be easy to rely on plain text implicitly but then we made Unicode so complicated that you have to be careful there too. Fingerprinting through zero-width sequences, etc. is essentially unnoticeable if you do not actively look for it.

Manafort is not a smart man.

These programs should protect user privacy by stripping identifying information by default, allowing the user the option to preserve it.

All technology should protect its users by default, otherwise everyone is at risk, not just the bad guys.

When you deal with Russians crooks and people in those circles, you tend to lower your guard. You think you will not get caught "because in Ukraine they had money in suitcases," or through a gazillion shell companies. The funny thing is that he might have just gotten away, if he wasn't involved in the Trump campaign. Call it greed or money mismanagement, but knowing when to quit may mean life or death (kinda)

Hindsight is always 20/20 I guess.

j/k

Separate OT: Do we know any political party that colluded, in primaries? Or that received foreign $? Or used 'bots' to make it seem like they have support? Or that had it's operatives use state instruments to disrupt the opposing party?