full-disclosure - Break-in discovery and forensics tools

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <000301c309cc$b4701ad0$9701a8c0@fujilatop>
From: steve at entrenchtech.com (Steve Manzuik)
Subject: Break-in discovery and forensics tools

> I realize the importance of after incident forensics... What I dont
understand is logs used in a court for prosecution. 
> Logs are inheritly not preservable or physical evidence, it is
tamperable from the time the external data hits a MAC, if 
> that were the case basicly I could take my logs and edit any damn
originating ip i choose, send thosse logs to law 
> enforcement, and have an innocent person convicted. Logs are nice..
but IMHO defeatable in court.

It would be quite simple for an attacker to modify or delete the logs on
most operating systems.  That being said, some organizations take steps
to protect the integrity of their logs.  A central syslog server is
typically used and in some cases I have even seen logfiles on that
central server digitally signed, encrypted and stored on some sort of
write once/read only (ie: CDR) media.  I have even seen some go as far
as tunneling this traffic over SSH.

I've stopped 316 spam messages. You can too!
Get your free, safe spam protection at
http://www.cloudmark.com/spamnetsig/