full-disclosure - [inbox] Re: Reacting to a server compromise

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: purdy at tecman.com (Curt Purdy)
Subject: [inbox] Re: Reacting to a server compromise

The key here is to have the paper handled by only one person and witnessed
by another and the access to that paper by only that person.  Therefore the
validity of the printouts are as sound as that person.  As long as that
person can not be repudiated, neither can the printouts.

That is also applicable to the optical media we now use, with one person
responsible for handling and storage with a reliable witness.

Curt Purdy CISSP, GSEC, MCSE+I, CNE, CCDA
Information Security Engineer
DP Solutions

----------------------------------------

If you spend more on coffee than on IT security, you will be hacked.
What's more, you deserve to be hacked.
-- White House cybersecurity adviser Richard Clarke

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Michal
Zalewski
Sent: Tuesday, August 05, 2003 2:46 AM
To: Curt Purdy
Cc: 'Jennifer Bradley'; full-disclosure@...ts.netsys.com
Subject: RE: [inbox] Re: [Full-Disclosure] Reacting to a server
compromise

On Mon, 4 Aug 2003, Curt Purdy wrote:

> Actually the traditionally accepted court evidence is real-time printouts
of
> data received by the syslog server.

So what would stop anyone from replacing some of the printouts after the
fact?

It's pretty much as insecure as log files in terms of being susceptible to
tampering with by the alleged victim (although less susceptible to remote
manipulation by the attacker after the fact, true).

--
------------------------- bash$ :(){ :|:&};: --
 Michal Zalewski * [http://lcamtuf.coredump.cx]
    Did you know that clones never use mirrors?
--------------------------- 2003-08-05 09:43 --

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html