PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Windows File Time Stamp Display Flaw

bishopfox.com | advisory | #windows | #advisory | #forensics | #ntfs | #anti-forensics | #timestamps
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Vincent Liu's Black Hat 2005 finding: maliciously low file timestamps via NtSetInformationFile render blank in Windows Explorer and forensic tools like EnCase and WinHex.
Published
Collected

Related coverage

advisory · bishopfox.com
PGP Desktop Wipe Free Space Flaw
Vincent Liu's Black Hat 2005 advisory: PGP Desktop's Wipe Free Space utility failed to clean NTFS file slack space, letting the Slacker tool hide data the wipe should have erased.
blog · blog.trailofbits.com
Collect NTFS forensic information with osquery
Built with Crypsis, this osquery extension exposes NTFS forensic artifacts—filename timestamps, security descriptors, Alternate Data Streams, and stale index entries—to incident responders.
advisory · metabase.com
August 2026 Security Vulnerability: What happened?
This advisory helps Metabase administrators evaluate impact and complete recommended upgrade procedures.
vulnerability · bishopfox.com
AirDroid Web Application Authentication Flaw
Technical advisory on AirDroid 3.0.4 and earlier: its web app relied on JSONP for cross-origin requests, letting a malicious page generate a valid session token and hijack full device functionality.
vulnerability · bishopfox.com
Oracle WebLogic Node Manager allows arbitrary configuration via UNC path
Bishop Fox advisory: WebLogic Node Manager 10.3.3 and earlier let unauthenticated attackers redirect its config and password files to an attacker-controlled UNC path, then run commands; fixed in 2011.
research · blog.quarkslab.com
Tearing down a car telematic unit (and finding an accident on Facebook)
Quarkslab tore down a second-hand BYD telematic unit (Snapdragon MDM9628, NAND flash), extracted firmware and stored data, then combined forensics with OSINT.
Back