0

I apologize for turning here with a question, my research both searching here and on Google has only turned up useless information.

I believe that someone has sent me files that have had their file creation date altered via a program like the ones listed here.

Is there any way to detect spoofed file modification performed with utilities such as these?

Edit: The files in question were created using Adobe InDesign and "sent me some files" in this case is a USB thumb drive where the files were copied and sent to me.

Edit 2: In hopes of maybe culling one of two somewhat "duplicate" questions, I'll post here and assign a correct answer here if someone comes up with one. This is the much more complete context for where I am with this:

=====

I have an Adobe InDesign document with the following created action in <xmpMM:History>. There seems to be a discrepancy in the file, as <stEvt:softwareAgent> reports Adobe InDesign CC 14.0 which was released in November 2018, but the "created" action is timestamped 2017-04-03T16:16:19-04:00.

My question is this -- does this XMP tag <stEvt:softwareAgent> get overwritten such that it is normal to see this tag not match the version originally used to create the file?

         <xmpMM:History>
            <rdf:Seq>
               <rdf:li rdf:parseType="Resource">
                  <stEvt:action>created</stEvt:action>
                  <stEvt:instanceID>xmp.iid:da3ade9b-b298-4414-a7ad-8dc125eab74d</stEvt:instanceID>
                  <stEvt:when>2017-04-03T16:16:19-04:00</stEvt:when>
                  <stEvt:softwareAgent>Adobe InDesign CC 14.0 (Macintosh)</stEvt:softwareAgent>
               </rdf:li>
3

Systems that have been compromised cannot be trusted. You can hope the attacker made a mistake, or missed something while they were wiping down their tracks, but in general, no, these aren't directly detectable.

First, identify your threat model. In the kinds of organizations typically involved in data breaches, attackers often won't take the time to cover their tracks with precision timestamp tampering, because it's a lot of work to get perfectly correct. Wiping their tracks gives them little benefit - once they whisk a copy of the data off to foreign soil, they no longer care about their tracks. (While discovery time is improving, most breaches remained undetected for a month or more.) In most cases they simply delete their logs, if they bother to do anything at all. But I imagine a state sponsored attacker performing espionage would have more motive to operate stealthily to remain undetected for as long as possible. So it helps to know your probable attacker.

There are things you can look for. These could provide evidence of tampering, even though they can't be trusted to provide evidence of what really happened.

  • Look for inconsistencies in the timestamps. The file's last modified datetime should not be earlier than the file's creation datetime, for example.

  • Look for file contents that are timestamped with values that don't match the last modified time of the file. If the last line in a log file is stamped 2019-02-01 12:34:56, but the last modified time is 2018-04-20 16:20:00, that seems unlikely.

  • Look for other logs to corroborate program execution. The Windows Event Logs may have audit history of processes that were run. If it shows "2019-02-01 12:34:56 Accounting.exe terminated", and the Accounting.log file's last modified time is 2019-01-28 16:20:00, that would indicate the program was run but didn't log anything for the last few days, which might be unusual.

  • Look for multiple files that have no reason to be in sync that all have identical timestamps. While I might expect tomcat-stderr.log and tomcat-stdout.log to have close timestamps, I might not expect them to have the same timestamp as accounting.log.

  • Check files that could contain unexpected timestamps. For example, JPEG files can have metadata (called "EXIF") that can be viewed with an EXIF viewing tool. Most phones and cameras will set the time the photograph was taken in the EXIF data. If the last modified date of the image file is older than the date the photo was taken, it may have been tampered with. Executable files may contain date artifacts from the linker; installation packages may have timestamps.

  • Look for evidence of hacker tools in the environment. They may have run something like apt-get install nmap, which may be a clue as to when they performed their reconnaissance.

  • Check for logs on other systems the compromised system may have communicated with. If the system is configured to export syslogs to a secure server, you would have a trustworthy source of when logins were made, applications were executed, etc. External logging is a mandated requirement for certain security frameworks, such as PCI DSS, so it's not uncommon.

  • Look for gaps in logging. If you see tomcat-stdout.2019-02-01.log, tomcat-stdout.2019-01-31.log, and tomcat-stdout.2019-01-28.log, you could reasonably wonder what happened to the logs from the 30th and 29th.

Keep in mind that any digital data could have been tampered with, and it could have been done so expertly. Document what you find, but don't count on it to serve as proof in a courtroom. If a system's been compromised, it's no longer trustworthy.

  • Understood that all of this could be tampered with and spoofed, which is indeed what I suspect. My goal is to see if I can find conclusive evidence of that. If the tracks have been thoroughly covered, obviously I'm unable to do anything to prove it. I've probably narrowed it down to a domain that might not be within your expertise, when I posted this, the question was more general, but the trail I'm currently on has me looking at InDesign XMP data. On the off chance you're familiar: superuser.com/questions/1401408/… – Brian Feb 2 at 20:35
  • Also, to clarify, in my case ... hmmm... trying not to get overly legal here, but in my case, the "attacker" is someone whom I know is using a computer program to do this (or nothing at all). One such as these: online-tech-tips.com/computer-tips/… – Brian Feb 2 at 20:40
1

You say someone has "sent you files". There is nothing in a file that says what its creation or modification date is. You now possess a copy of a file. That's all. Is the copy they sent you the same as what is on their hard disk? There's no way for you to know by looking at the copy they sent you.

What you're talking about is what we in the industry call metadata. It's the data about the data. When it was created, modified, etc. Not the data itself (i.e., the document, image, words, etc.)

Certain kinds of files contain metadata inside them. Microsoft Word documents, for example, often store some data in them about when they were created and last edited and such. JPEG pictures often contain some data about when a picture was taken. But you can changed the date in your camera or on your phone. When you take a picture, the camera/phone will just put what it thinks the current date/time is into the image. And that's all just data, anyways. There are tools to edit those fields in Word documents, images, etc. without altering the text or the picture. Lots of files do not carry any metadata inside them. Plain text files definitely have no metadata. Music/audio files and video files might or might not have anything useful. Its all different and it's really complicated.

So you're a bit non-specific about what kinds of "files" they are, how they were "sent" to you (email? that's what I've been assuming), and what you are trying to figure out. But the short answer is that all this stuff is pretty trivial to fake, and if you've been sent a copy of something, there's very little you can do to prove or disprove its authenticity. You kinda need to bring something else to the table. Like a separate copy from someone / somewhere else.

  • Apologies for being vague, I've since narrowed it down. My goal is to see if I can find conclusive evidence of that. If the tracks have been thoroughly covered, obviously I'm unable to do anything to prove it. I've probably narrowed it down to a domain that might not be within your expertise, when I posted this, the question was more general, but the trail I'm currently on has me looking at InDesign XMP data. On the off chance you're familiar: superuser.com/questions/1401408/… – Brian Feb 2 at 20:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.