Full Disclosure mailing list archives
RE: [inbox] Re: Reacting to a server compromise
From: "Curt Purdy" <purdy () tecman com>
Date: Tue, 5 Aug 2003 20:28:29 -0500
The key here is to have the paper handled by only one person and witnessed by another and the access to that paper by only that person. Therefore the validity of the printouts are as sound as that person. As long as that person can not be repudiated, neither can the printouts. That is also applicable to the optical media we now use, with one person responsible for handling and storage with a reliable witness. Curt Purdy CISSP, GSEC, MCSE+I, CNE, CCDA Information Security Engineer DP Solutions ---------------------------------------- If you spend more on coffee than on IT security, you will be hacked. What's more, you deserve to be hacked. -- White House cybersecurity adviser Richard Clarke -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com]On Behalf Of Michal Zalewski Sent: Tuesday, August 05, 2003 2:46 AM To: Curt Purdy Cc: 'Jennifer Bradley'; full-disclosure () lists netsys com Subject: RE: [inbox] Re: [Full-disclosure] Reacting to a server compromise On Mon, 4 Aug 2003, Curt Purdy wrote:
Actually the traditionally accepted court evidence is real-time printouts
of
data received by the syslog server.
So what would stop anyone from replacing some of the printouts after the fact? It's pretty much as insecure as log files in terms of being susceptible to tampering with by the alleged victim (although less susceptible to remote manipulation by the attacker after the fact, true). -- ------------------------- bash$ :(){ :|:&};: -- Michal Zalewski * [http://lcamtuf.coredump.cx] Did you know that clones never use mirrors? --------------------------- 2003-08-05 09:43 -- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: Reacting to a server compromise, (continued)
- RE: Reacting to a server compromise Edward W. Ray (Aug 02)
- Re: Reacting to a server compromise Aron Nimzovitch (Aug 03)
- RE: [inbox] Re: Reacting to a server compromise Curt Purdy (Aug 04)
- RE: [inbox] Re: Reacting to a server compromise Ron DuFresne (Aug 04)
- RE: Reacting to a server compromise Edward W. Ray (Aug 02)
- RE: [inbox] Re: Reacting to a server compromise Curt Purdy (Aug 03)
- RE: [inbox] Re: Reacting to a server compromise Michal Zalewski (Aug 03)
- RE: [inbox] Re: Reacting to a server compromise Curt Purdy (Aug 04)
- RE: [inbox] Re: Reacting to a server compromise Michal Zalewski (Aug 05)
- RE: [inbox] Re: Reacting to a server compromise Curt Purdy (Aug 05)
- RE: [inbox] Re: Reacting to a server compromise Bojan Zdrnja (Aug 06)
- RE: [inbox] Re: Reacting to a server compromise Michal Zalewski (Aug 06)
- Re: [inbox] Re: Reacting to a server compromise Valdis . Kletnieks (Aug 05)
- Re: Reacting to a server compromise SecuresDotComs (Aug 02)
- Re: Reacting to a server compromise madsaxon (Aug 02)
- RE: [inbox] Re: Reacting to a server compromise Curt Purdy (Aug 03)
- Re: [inbox] Re: Reacting to a server compromise Gaurav Kumar (Aug 03)