In this lesson,
we will learn about metadata analysis.
Metadata analysis is examining the underlying data
about files, media, or communications.
Metadata analysis can be used
to uncover information about the origin,
manipulation, or potential malicious intent of files,
media, or communications.
Analysis concepts include files and file systems,
images, audio and video, and email header analysis.
Within files and file systems, metadata analysis
can reveal file creation dates,
modification times, and user permissions.
Next, metadata from images, audio, and video
can include information about device models,
GPS coordinates, or editing history.
Finally, email header metadata provides details
about the sender, recipient, and transmission path.
Let's learn more about metadata analysis
in files and file systems, images, audio and video,
and email header analysis.
First, we have metadata analysis in files and file systems.
Metadata analysis in files and file systems
involves examining the underlying information about a file,
such as its creation date,
modification history, and user permissions.
A command line tool,
like stat in Linux or Windows file properties
can reveal this metadata,
allowing analysts to track changes to files
and detect unauthorized modifications.
For example, the command stat /path/to/file.txt
would return detailed metadata for file.text,
including the file's access permissions, ownership,
timestamps, last modified, accessed, and changed, and more.
So if a file was modified outside normal working hours
or showed unauthorized access patterns,
this metadata could help pinpoint
when and possibly how a file was altered,
aiding in security investigations.
File system metadata can also include details
about file ownership and access control,
helping analysts detect abnormal access patterns.
For instance, forensic tools like Autopsy or FTK Imager,
can extract metadata from a disc image
to investigate who accessed or modified certain files.
By analyzing this type of metadata,
investigators contract the sequence of events
leading to a security incident,
such as tracing how malware was planted in a system,
or uncovering hidden files with modified attributes
designed to evade detection.
Second, we have metadata analysis
in images, audio, and video.
Metadata analysis of media files like images,
audio, and video often focus on extracting information
about the device used to create the file,
the GPS coordinates, and editing history.
Cross platform tools such as ExifTool allow analysts
to dig into the metadata of media files,
uncovering details such as camera model,
software used for editing,
and even the location where media was captured.
For example, the command exiftool /path/to/image.jpg
would display metadata for image.jpg,
including details like the camera model, creation date,
GPS coordinates if available,
software used for editing, and much more.
Analysts can use this information to determine
where and when the image was taken, whether it was edited,
or to trace the source of the file.
This type of analysis is particularly useful
in cases of digital forensics or authenticity verification.
For example, an image's metadata might reveal
that it was edited with specific software,
even though it was claimed to be an original photograph,
indicating potential manipulation.
Similarly, video or audio files can include metadata
that provides details about the device used to record them,
or timestamps that indicate
when and where the recording took place.
This can be critical in legal investigations
as it helps establish the chain of custody
or disproves false claims.
For instance, if a video file is presented
as evidence in a legal case,
the metadata might show that the video was edited
after the alleged event took place,
challenging its authenticity.
Third and last, we have metadata analysis in email headers.
Email metadata analysis focuses on extracting
and interpreting the details hidden in email headers
to uncover the origin and transmission path of a message.
Tools like MXToolbox
or the header analysis features in email clients,
like Gmail and Outlook, can display this information,
allowing analysts to trace an email's journey
through mail servers.
Key fields such as received, message-ID,
and return-path can reveal whether an email was spoofed
or if it came from a legitimate source.
By analyzing these fields, an investigator might detect
that an email that appears to come from a trusted domain
was actually sent from an unknown or malicious IP address.
For example, in a phishing attack, email headers can show
that the email originated from a server
in a completely different region than expected,
or it may lack proper authentication records,
like DKIM or SPF.
This metadata can help security teams
identify phishing attempts, block malicious senders,
and prevent further compromise.
By closely examining email headers,
cybersecurity professionals can also determine
if emails were rerouted through suspicious servers
or if there are inconsistencies in the timestamps
that suggest message tampering.
Now, let's take a look at email header analysis
using the MXToolbox email header analyzer.
On the right hand side of the screen is an email header.
In Gmail, we can get access to email headers
by selecting more and then show original.
On the right hand side, let's take this email header
that I've created and analyze it with MXToolbox.
This is mxtoolbox.com specifically for email headers.
We'll go ahead and paste our email header in here
and then analyze it.
As you can see, the email is a bit more sorted out here,
but we can find some malicious indicators in this email.
Specifically in this email header,
there are four malicious indicators that stand out.
The email was received from suspicious IP addresses.
There was an SPF failure.
There are DKIM and DMARC inconsistencies,
and there's a misaligned reply to address.
Let's look at each of these.
First, the email was received from a suspicious IP address,
specifically 45.227.253.94,
and 178.62.193.182.
I can take either of these emails
and put them into the MXToolbox super tool
to check whether or not they're on a blacklist,
and you can see that IP address 178.62.193.182
is on a blacklist.
I can even select detail here
to get more information about why
that particular IP address is blacklisted.
So both of these IP addresses
are linked to known malicious domains
or IP addresses associated with phishing activity.
Next, the email failed an SPF check.
This indicates that the IP address sending the email
is not authorized to send emails
on behalf of the legitimate domain, chase.com.
Next, there is no DKIM signature
and the DMARC check failed.
This further confirms that the email is spoofed
and did not originate from the legitimate domain.
Finally, the reply to address.
Replies to a domain secure-chase.login.com,
which is different than the from address of chase.com.
We can take this secure-chase.login.com
and go again to the MXToolbox, to our super tool,
and look up that domain,
and we will find that there is no DMARC
or DNS record published,
further confirming that this is a fraudulent email
intended to deceive recipients.
Any replies to this email would be sent
to the malicious domain secure-chase.login.com
rather than chase.com.
So this email header confirms
that the email has been crafted
to trick recipients into believing it is from Chase Bank.
When analyzed with a tool like MXToolbox,
the header clearly reveals failures in authentication
and highlight that the email originated
from a suspicious domain,
raising significant phishing concerns.
This is the end of our demonstration.
So remember, metadata analysis involves examining
the hidden data in files, media, or communications
to uncover important details like origin,
manipulation, or malicious intent.
It can reveal key information, such as file creation dates,
modifications, user permissions, and access history,
making a metadata analysis useful
for detecting tampering or unauthorized changes.
Next, for images, audio, and video,
metadata can show device details, GPS locations,
and editing history, which helps track the source
or verify authenticity.
Finally, email header analysis focuses on revealing the path
and origin of a message, helping to identify spoofing
or phishing attempts by checking details,
like IP addresses and server hubs.
Overall, metadata analysis is a powerful tool
in cybersecurity investigations,
aiding in uncovering anomalies
and tracing the origins of suspicious activities.