Todd A. Jacobs | Pragmatic Cybersecurity<p>I deeply respect <span class="h-card" translate="no"><a href="https://infosec.exchange/@briankrebs" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>briankrebs</span></a></span>, but in this case I think the data he's presenting is fundamentally invalid. A little-known fact about <a href="https://infosec.exchange/tags/Git" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Git</span></a> history is that <a href="https://infosec.exchange/tags/timestamps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>timestamps</span></a> are both definable and mutable. While you might be able to make statements about when a Git commit was pushed to a server using the server-side SSH or HTTP logs, the fact that you can set GIT_AUTHOR_DATE and GIT_COMMITTER_DATE as environment variables means you can't rely on commit timestamps alone for this type of analysis.</p><p>This is a <em>feature</em> of Git since the ability to squash or rewrite its mutable history is a key differentiator compared to <a href="https://infosec.exchange/tags/FossilSCM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FossilSCM</span></a> or other <a href="https://infosec.exchange/tags/SCMs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SCMs</span></a> that treat history as immutable(ish). For example, allowing one to do things like report a commit as the time a patch or source document was originally written rather than just noting when it was committed or merged can be very useful in accurately representing the real-world evolution of data created outside the repository.</p><p>This is <em>not</em> a flaw in Git. Anyone savvy enough to craft the <a href="https://infosec.exchange/tags/xz" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>xz</span></a> attack could just as easily have adjusted their system clocks instead, leading to fraudulent timestamps in the commit history anyway.</p><p>Forensically, you'd need to look at the timestamps from NTP-backed server or router logs, not just the Git history. All Git clients are technically "offline" until they push one or more commits to a remote, so there's really no way to validate client-side SCM timestamps. This is also true of email headers, filesystem attributes, and any other data that relies on real system clocks or user-defined timestamps, so you'd need more points of correlation than are provided here.</p><p><a href="https://www.linkedin.com/posts/bkrebs_one-of-the-more-interesting-graphics-ive-activity-7181358250112471040-fzeG" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">linkedin.com/posts/bkrebs_one-</span><span class="invisible">of-the-more-interesting-graphics-ive-activity-7181358250112471040-fzeG</span></a></p>