The timestamp that does not lie
Changing a file's permissions does not touch its modification time, because the contents did not change. It does update the change time, which records inode changes: permissions, ownership, link count. Most tools show you the modification time by default, and an attacker can set that one to whatever they like with a single command. There is no ordinary way to set the change time, which is what makes it worth comparing when a file looks suspicious.
Somebody made a file on your server run as root. The modification time will not tell you.
When you want to know whether a file was touched, you look at the modification time. It is the one every tool shows you by default.
Copy a binary and note its modification time. Now change its permissions, so that anyone who runs it runs it as root. Check the modification time again.
Identical. Nothing inside the file changed, so nothing updated it.
But every file carries a second timestamp. The change time. Not when the contents changed, when the record of the file changed: permissions, ownership, link count. That one moved.
The attacker did not edit your file. They changed what it is allowed to do, and only one of these two noticed.
Anyone can set a modification time to whatever they want. There is no ordinary way to set the change time.
When a file looks wrong, compare both timestamps.
#linux#security#selfhosted#infosec#sysadmin
❯ When a file looks wrong, compare both timestamps.