3 ms·
> Note that a skilled attacker would likely remove these entries from the log file, thus effectively eliminating any reliable signature that the device had been
by rodionos 11y ago
> Note that a skilled attacker would likely remove these entries from the log file, thus effectively eliminating any reliable signature that the device had been compromised
Sending logs off as they're written to a centralized logging server or a time-series database would have been useful in this context.
- wtbob 11y ago> Sending logs off as they're written to a centralized logging server or a time-series database would have been useful in this context. Schneier & Kelsey's paper Secure Audit Logs to Support Computer Forensics[1] seems relevant here. At the time I know that they wished to patent the work; does anyone know if a patent were granted, and if so when it expires? [1] https://www.schneier.com/cryptography/paperfiles/paper-auditlogs.pdf https://www.schneier.com/cryptography/paperfiles/paper-audit...
- floatrock 11y agoI would also assume you could do a blockchain-type log -- ie the hash of an entry includes the hash of the previous entry so that if one entry is removed, the whole thing is tamper-evident. Of course, then you need to ensure the integrity of the latest hash (if you can change one log, you can change them all). If the centralized logging server(s) are protected with the same rooted ssh, then it's just an additional step for our sophisticated state-sponsored boogeyman.
- hidroto 11y agojust print the logs as they come in.