lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: se_cur_ity at hotmail.com (morning_wood)
Subject: Reacting to a server compromise

we could start adding your ip to our headers, log, and use that as evidence
against you, ok "Jenn"
logs can be originally faked, before the data reaches the logging device.
sorry, IMHO server logs etc, should clearly  not be admissable.
if I recall didnt thet actually have to catch "Kevin" "in the act" so to
speak? Contrary to popular belief server logs are not like a video tape as
evidence , and i think that is what the"popular" belief is about logs. this
topic was once brought up by me and i got bl;asted as this is not the
proper forum for this discussion, but yet my wood spoke now didnt it?

Donnie "sometimes the XSS King" Werner
http://e2-labs.com
http://www.exploitlabs.com





----- Original Message ----- 
From: "Jennifer Bradley" <jenbradley@...mail.co.za>
To: <full-disclosure@...ts.netsys.com>
Sent: Sunday, August 03, 2003 2:06 AM
Subject: Re: Re: [Full-Disclosure] Reacting to a server compromise


> On Sun, 3 Aug 2003 12:31:39 +1000  (devnull@...imus.com.au) wrote:
>
> >On Sun, 3 Aug 2003 01:38 am, Jennifer Bradley wrote:
> >
> >> If this happens again, I would probably make a copy of the hard
> drive,
> >> or at the very least the log files since they can be entered as
> >> evidence of a hacked box.
> >
> >Under most jurisdictions, an ordinary disk image produced by Norton
> Ghost etc
> >using standard hardware is completely inadmissible in court, as it is
> >impossible to make one without possibly compromising the integrity of
> the
> >evidence. The police etc use specialised hardware for making such
> copies,
> >which ensures that the disk can't have been altered.
>
> This is not true, at least in the US.  Log files can be entered into
> evidence unless you can prove that the log files have been tampered
> with.  The "possibility" of changing data does not make evidence
> inadmissible, only proof that data has been changed.
>
> I don't see why a Norton Ghost image is any different than a tape
> backup, and backups have been regularly entered in as evidence in many
> famous cases, such as the Microsoft anti-trust case.
>
> jb
> _______________________________________________________________________
> LOOK GOOD, FEEL GOOD - WWW.HEALTHIEST.CO.ZA
>
> Cool Connection, Cool Price, Internet Access for R59 monthly @ WebMail
> http://www.webmail.co.za/dialup/
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

Powered by blists - more mailing lists