Full Disclosure mailing list archives
Re: Re: Reacting to a server compromise
From: "morning_wood" <se_cur_ity () hotmail com>
Date: Sun, 3 Aug 2003 03:10:33 -0700
we could start adding your ip to our headers, log, and use that as evidence against you, ok "Jenn" logs can be originally faked, before the data reaches the logging device. sorry, IMHO server logs etc, should clearly not be admissable. if I recall didnt thet actually have to catch "Kevin" "in the act" so to speak? Contrary to popular belief server logs are not like a video tape as evidence , and i think that is what the"popular" belief is about logs. this topic was once brought up by me and i got bl;asted as this is not the proper forum for this discussion, but yet my wood spoke now didnt it? Donnie "sometimes the XSS King" Werner http://e2-labs.com http://www.exploitlabs.com ----- Original Message ----- From: "Jennifer Bradley" <jenbradley () webmail co za> To: <full-disclosure () lists netsys com> Sent: Sunday, August 03, 2003 2:06 AM Subject: Re: Re: [Full-disclosure] Reacting to a server compromise
On Sun, 3 Aug 2003 12:31:39 +1000 (devnull () iprimus com au) wrote:On Sun, 3 Aug 2003 01:38 am, Jennifer Bradley wrote:If this happens again, I would probably make a copy of the harddrive,or at the very least the log files since they can be entered as evidence of a hacked box.Under most jurisdictions, an ordinary disk image produced by NortonGhost etcusing standard hardware is completely inadmissible in court, as it is impossible to make one without possibly compromising the integrity oftheevidence. The police etc use specialised hardware for making suchcopies,which ensures that the disk can't have been altered.This is not true, at least in the US. Log files can be entered into evidence unless you can prove that the log files have been tampered with. The "possibility" of changing data does not make evidence inadmissible, only proof that data has been changed. I don't see why a Norton Ghost image is any different than a tape backup, and backups have been regularly entered in as evidence in many famous cases, such as the Microsoft anti-trust case. jb _______________________________________________________________________ LOOK GOOD, FEEL GOOD - WWW.HEALTHIEST.CO.ZA Cool Connection, Cool Price, Internet Access for R59 monthly @ WebMail http://www.webmail.co.za/dialup/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: Reacting to a server compromise, (continued)
- Re: Reacting to a server compromise Alexandre Dulaunoy (Aug 03)
- RE: [inbox] Re: Reacting to a server compromise Curt Purdy (Aug 04)
- Re: Reacting to a server compromise David Hayes (Aug 05)
- Re: Reacting to a server compromise Ron DuFresne (Aug 05)
- Re: Hard drive images Craig Pratt (Aug 05)
- RE: [inbox] Re: Hard drive images Curt Purdy (Aug 05)
- Re: Hard drive images ldreamer (Aug 05)
- Re: Hard drive images madsaxon (Aug 05)
- Re: Reacting to a server compromise Alexandre Dulaunoy (Aug 03)
- Re: Re: Reacting to a server compromise morning_wood (Aug 03)
- Re: Re: Reacting to a server compromise manohar singh (Aug 03)
- Re: Reacting to a server compromise James A. Cox (Aug 03)
- Re: Re: Reacting to a server compromise Frank Bruzzaniti (Aug 04)
- RE: Re: Reacting to a server compromise Ron DuFresne (Aug 04)
- RE: Re: Reacting to a server compromise security snot (Aug 04)
- SV: Re: Reacting to a server compromise martin scherer (Aug 04)
- RE: Re: Reacting to a server compromise madsaxon (Aug 04)
- Re: Re: Reacting to a server compromise Darren Reed (Aug 04)