You thought you sent a one-page letter. What you actually sent was a one-page letter and a small pile of paperwork the letter filled out about itself when you weren’t looking.

That paperwork is metadata — data about data. And it travels with your files whether or not you invited it along for the trip.

Metadata is the stuff a document quietly jots down while you’re jotting down words. There’s a lot of potential information there: Who created it, when, and on what computer. Who edited it, and when they last saved it. Where a photo was taken, down to the GPS coordinates. What camera, what settings, what software. None of it shows up on the page. All of it comes along, like a stowaway.

Most of the time this is harmless, but occasionally, it’s the whole story.

A photo is a very talkative little file.

Take a picture with your phone and you’ve created a small autobiography. The image, surely, but tucked inside is a section called EXIF data: the make and model of the phone, the date and time down to the second, and, if location services were on, the exact spot on Earth where you stood. Share that photo in its original form and you may be handing over your home address without meaning to.

The good news: most social platforms started stripping this out a few years ago when there was a public hue and cry about it. The bad news: “most” is not “all,” and emailing the original file, or dropping it in a shared folder, sends the whole talkative package along.

Documents keep a diary too

A Word document remembers more than the final draft. Depending on your settings, it can carry the author’s name, the company the software was registered to, how long the file was open, and sometimes, a list of former edits and tracked changes and comments you thought you’d removed. Every “on second thought, delete that paragraph” can live on in the file’s memory.

The Internet is dotted with cautionary tales of press releases and legal filings that were sent out with the edits still readable underneath. The same is true with newsworthy congressional hearings. Most of us are not popular enough to warrant interest from the government. Still, the words on the page said one thing but the metadata said “here’s what we almost admitted.” Oopsie.

So, what to do?

There’s no need to get paranoid about this. Depending on what you’re shopping for, your grocery list is not a national secret. But a few practical habits go a long way:

• Before sending anything sensitive, look under the hood. In Word on Windows, “Inspect Document” should find and remove hidden data, comments, and tracked changes. Do it on the final version, not the draft.
• Turn off location tagging for your camera if you don’t need it — or scrub EXIF data from photos before sharing the originals. By the way, if litigation is foreseen that involves these photos, don’t scrub the EXIF metadata. It will be considered spoliation of data and will go poorly for you if and when it goes to court.
• Remember that “delete” inside a file often just means “hide.” Removing a comment from view is not always the same as removing it from the file.

None of this requires becoming a hermit. It’s the digital equivalent of checking your pockets before you send the coat to the cleaners.

Metadata isn’t sinister. It’s just honest — sometimes more honest than we’d like. The trick is knowing it’s there, so you decide what to share instead of the file deciding for you.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post The Metadata You Didn’t Know You Were Sending appeared first on Burgess Forensics.

Cyberwar History and Ukraine

People are much more drawn to images of blown-up building, fires, mushroom clouds, refugees in dire circumstances, color pictures of pain that are better in black and white than they are to explanations of code or even fallout from code if it’s not resulting in something blown-up, fiery, or pictures of people in pain that are better in black and white.

That is to say, while we see plenty of stories of ransomware, temporary business disruptions, and credit card & ID fraud, it’s not visceral. It goes by quickly on the page and in our minds.

So, whatever happened to the stories we saw before the cyberattack age? When the US Cybercommand was just a twinkle in some geeky eyes? What happened to the discussion that cyberattacks would engender kinetic responses? Bombs not electrons.

Perhaps it was a sense of proportion. Perhaps it was a recognition that we consider that an increasing cyberwar, if responded to with bullets, might just result in use seeing those images of things that would be better in black and white on our own doorstep?

Did we back off, or did sanity take hold in the minds of the planners?

Let’s look at a little history.

Back in 2003, a cyberattack originating from China – and christened, “Titan Rain,” by the US – managed to get access to loads of sensitive government information by compromising the systems of US government contractors and of government systems themselves. Only unclassified information was stolen, but the world woke up to this kind of attack.

In 2004, the Joint Chiefs of Staff declared cyberspace an important domain of conflict alongside the air, land, sea, and space domains. No doubt, this was prompted by the reality of Titan Rain. As a culture, we were just starting to think about these things on a national level.

In 2007, Estonia experienced a broad cyberattack that included their parliament, banks, and media. It was believed to have originated from Russia, or from Russian actors. NATO’s response was to create the NATO Cooperative Cyber Defence Center of Excellence (CCDCOE) in 2007. Now, continents were beginning to wake to the threat and the need to do something about it.

The Tailinn Manual

The CCDCOE began to develop an extensive study and code about what how international law applies to cyber conflicts and cyberwarfare; these previous acts were beginning to be recognized as acts of war. Calling on legal scholars and legal practitioners that were experienced in cyber issues, the CCDCOE produced Tailinn Manual on the International Law Applicable to Cyber Warfare in 2012.

The Tailinn Manual declared that killing hackers in response to certain cyberattacks was justifiable.

Killing hackers?!

Meanwhile, other state-sponsored cyberattacks marched their way into the public consciousness.

The Stuxnet Worm was developed to sabotage Iran’s nuclear development efforts – in particular, the centrifuges used to enrich uranium gas. It is believed to be the first malware designed to and succeeding in visiting physical destruction on physical equipment. Wired Magazine called it the first digital weapon.

It’s widely considered that the US and Israel collaborated over a period of 5 years to develop this malware.

In 2009, Secretary of Defense, Robert Gates, recognizing how important AND vulnerable important computers and networks were (are), directed the creation of USCYBERCOM. It is the unified command for the cyberspace domain in the US and the world.

In 2016, the organization described the 2016 espionage ops against the Democratic National Committee while in the midst of a national election “serious business . . . [that] may destroy democracy.”

Administration officials at the time considered that cyber weapons were so potentially destructive that they should be unleashed only on the direct orders of the Commander in Chief, like nuclear weapons. I do not know if there is an equivalent “Cyber Football.” Would it have red and blue buttons?

Article 51 of the UN Charter allows individual countries to defend themselves and to band together to defend each other. It also allows the same if an armed attack is anticipated and recognizes the right to use force in such a situation. It allows a cyberattack to be considered an armed attack.

In 2019, Israel did just this, by conducing airstrikes on a building that they said had Hamas members inside that were planning to launch a cyberattack on Israel. Before they launched the anticipated cyberattack. If they were indeed going to do so.

In 2021 the topic was up for noticeable public discussion again. NATO heads of state and government met at NATO’s North Atlantic Council meeting in Brussels and issued a communiqué that ultimately equates cyberattacks with kinetic attacks and leaves the possibility of military action against hackers on the table.
Still, what we generally see is that cyberattacks – or anticipated cyberattacks – by states are dealt with by preemptive and after-the-fact punishing cyberattacks. Tit for tat, as it were, and even before the tat.

Cyberwar in Action

What we have seen in practice in Georgia in 2008, Crimea in 2014, and in Ukraine in 2021 is the “softening up” cyberattack. The attack used to diminish and disable defensive and civil systems before a kinetic attack, rather than a kinetic attack in response to a cyberattack.

Many said that the 2014-2015 cyberattacks were on a an entirely different – and grander – level than had been seen previously. Several Ukrainian banks and government agencies became inaccessible and malware – using a tool called “HermeticWiper” – was wiping data from hundreds of PCs and servers.

But we’ve gotten used to common DDOS attacks, data-wiping and ransomware in recent years on the civilian level. It’s kind of taken for granted that these things are ongoing and all over.

The use of cyberwar and kinetic war together has been labeled “hybrid warfare.”

And yet, the world seems surprised that Russian cyberattacks on Ukraine in 2021 and 2022 have been substantially less severe than anticipated. To be sure, they were and are ongoingly widespread. Hackers caused the Viasat satellites to become inoperative. But that may have affected Russian soldiers and commanders to lose connectivity as well. And said attack has been mitigated somewhat by the Musk’s activation of Starlink Internet satellites over Ukraine.

Additionally, Ukrainian modems were zombie-fied by Russian malware, being used as nodes for targeted DDOD attacks within Ukraine.

But the ruination from malware that was expected has not really seemed to occur. We haven’t seen a cyber-Armageddon. Were they more prepared? Were the US and/or the EU pumping up Ukraine’s cyber defenses or attacking the offensive cyber capabilities of Russia? The newspapers wonder about this and government sources overtly express surprise and confusion that there isn’t more cyber damage.

I would be willing to wager that they know more about this than they are letting on. But then, isn’t that almost always the case?

The coming days and weeks will tell us more about cyberwar in Ukraine. It’s possible that all-out disruption of Ukraine’s Internet will come to pass. We hope not.

But one thing about this history stands out. We have not seen the kinetic response to cyberattacks on a wide scale that was being discussed a decade ago.

Luck? Cooler heads? Invisible cyber counterattacks? Thoughts of a Cyber version the Mutually Assured Destruction (MAD) doctrine that has, in theory, kept the world from launching nuclear war? Or is physical destruction on a massive scale enough to satisfy those bent on domination?

These times we’re living in will surely shape the times we will be living in. Let us hope and work for that cyberwar doesn’t exceed the malign effects we have seen to date and that going forward we see fewer dire images because of fewer dire circumstances.

The post Cyberwar History and Ukraine appeared first on Burgess Forensics.