On Thu, 3 Oct 2002 16:07:07 -0700 "Mark G. Spencer" <dreadnought13at_private> wrote: > Also, this may lead to a discussion of whether this data is even useful. > I am not sure how well different CD burn applications adhere to this UDF > format regarding dating. I have also noticed some applications (Nero) > actually allow you to manipulate all the date information before > burning! Of course, even if they didn´t, the apps do have to get that information from somewhere (i.e., system clock), which is easily tampered with on most environments. Date/time stamps on media like that should only be used as clues for similar attack vectors (e.g., trojaned system files with dates similar to the CD stamp), *NOT* direct evidence. Cheers Pedro. -- Pedro Miller Rabinovitch Diretoria de Tecnologia Cipher Technology http://www.ciphertech.com.br ______ "Segurança em TI - uma especialidade Cipher Technology" ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Tue Oct 08 2002 - 08:26:37 PDT