How to Hack Time, With C2PA
The story of hacking time through C2PA metadata originated from the 2015 film Kung Fury, where the protagonist, Hackerman, uses the power to manipulate time to rectify historic wrongdoings. The concept of hacking time to one's advantage has been explored, with the author themselves attempting to use the lottery numbers from a photo they created.
The photo, identified as being photoshopped due to C2PA metadata, can be verified at specific links provided. The C2PA metadata includes a claim signature and a timestamp signature, the latter provided by a Time Stamp Authority (TSA). The TSA serves as an independent witness to confirm the existence of data at a certain timestamp.
In the case of Google Pixel 10, devices are assumed to be trustworthy in their timekeeping. The author focuses on exploiting a bug known as the spec footgun, which allows for arbitrary exclusions in the file, enabling changes to be made post-signature without invalidating the C2PA metadata. This allows for the tampering of files, like photoshopping a lottery ticket, without detection.
The author suggests that the exclusion feature should be explicitly specified for each file format to avoid potential issues.
Written by urgent.news from Lobsters's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
