How to Hack Time, With C2PA

David Buchanan (aka retr0id) reckons the most impressive hacking stunt in cinema is the scene in Kung Fury where the hero hacks time itself. His own ambitions are humbler: he'd just go back a couple of hours and tell himself the winning lottery numbers. According to the cryptographic C2PA timestamp attached to his post, that is precisely what he did — he attached a photo of a lottery ticket seemingly snapped hours before the EuroMillions draw.

The image, he cheerfully admits, is crudely photoshopped — no actual fraud intended. What matters is something else: every C2PA verification tool he could find confirms the signature and the timestamp as valid.

Two signatures

A typical C2PA manifest carries two signatures. The first is the "claim" signature: a camera app might assert that this is a photo taken at given coordinates at a given moment. In an earlier article Buchanan showed this signature is nearly worthless — you can sign whatever claim you like, even on flagship implementations like the Google Pixel Camera app.

The second comes from a Time Stamp Authority (TSA) over RFC 3161. Since devices aren't trusted to report their own time, a remote server attests: "yes, I saw this hash at this moment," acting as an independent witness. With the Pixel 10, Google decided devices can be trusted to tell their own time after all — which Buchanan finds dubious, but here he does not attack the TSA and assumes it behaves honestly.

The spec footgun

The trick rests on Buchanan's favourite bug class: the spec footgun. C2PA permits arbitrary "exclusions" — byte ranges within a file that are left out of the signature calculation. Dr. Neal Krawertz flagged this in his list of C2PA flaws back in June 2025.

The new angle is that a malicious signer can deliberately exclude the entire file. The signature is then computed over an empty string — its hash equals that of /dev/null. The file can afterwards be altered freely without invalidating either the claim signature or the timestamp. So Buchanan photographed a real ticket, obtained a genuine timestamp, and painted in the numbers only after the results were announced.

Can it be fixed?

Not easily. Detecting a full-file exclusion is trivial, but how do you tell a harmless small exclusion from one whose modification could completely change the image (think MD5 collision PoCs)? Nor can exclusions simply be removed: some formats need them — in PNG, for instance, each chunk's CRC32 checksum would otherwise create a circular dependency. His proposed fix is to specify explicitly, per file format, which parts may be excluded, and require verifiers to enforce it.

Source: Lobsters