Hacker News Reader

Comment by staticassertion | Hacker News Reader

You can assume a lot of logs are not compromised. For example, logs from your network infrastructure. In this case you could trust sshd logs (so long as you ship them off quickly) and network logs.

As for endpoint logs, yes, a privileged attacker could disrupt them. But honestly, even with regards to your endpoint, attackers often don't disable logging - though I do see it, for sure. For "blessed" logging like Windows Event Log you'll have an even harder time - they do take measures to protect the files on disk, even against privileged attackers, and supported methods of deleting the event log actually themselves generate a "Someone deleted the event log" event, which I would highly recommend you watch out for :)

The simplest advice for dealing with this is to ship logs off of the device ASAP and to make sure that disrupting the service requires privileges.

View on HN

> For "blessed" logging like Windows Event Log you'll have an even harder time [...] even against privileged attackers

Trying to prevent a determined privileged attacker from doing something is an exercise in futility, since it's impossible in every sense of the word. If they have total control over a system, they can do whatever they want, even if you put up a bunch of stopgaps.

Most post-exploitation frameworks (prominent example: DanderSpritz) have modules to remove stuff from the windows event logs without leaving traces.

It's pretty basic stuff.

A log immediately stored on a "physically" write-once device, or printed, may be more difficult to dispose of (w/o physical access to the premises).

> Trying to prevent a determined privileged attacker from doing something is an exercise in futility,

That's not really true at all.

> since it's impossible in every sense of the word

Ok? Lots of things are impossible, and lots of those things are also still very very hard and costly. Hash collisions aren't impossible, and yet here we are, with a world hinging on them being very hard.

> , they can do whatever they want

Not really.

> Most post-exploitation frameworks (prominent example: DanderSpritz) have modules to remove stuff from the windows event logs without leaving traces.

You realize that:

a) DanderSpritz's logic to bypass the event log was a huge deal

b) It's literally an NSA leaked exploit????? Like are you kidding me using an NSA developed exploit as "pretty basic stuff" lol

Sorry but I think I'm gonna stop responding here.

> b) It's literally an NSA leaked exploit????? Like are you kidding me using an NSA developed exploit as "pretty basic stuff" lol

It must have been very expensive and innovative, does that make it hard to copy into your scriptz folder?

I don't understand the point you're trying to make. That because one exploit exists, and using that exploit is cheap, the entire class of attacks is cheap?

Sorry, but this entire thread is nonsense, and it's just a clear demonstration of a lack of threat modeling and frankly a lack of understanding of what attacker capabilities are.

The basic principle of real security models is once an attacker has full access all data on the system is potentially tampered with.

You can try to play games with ensuring logs leave the system, but everyone takes shortcuts to make sure they can recover the system when networking is down etc.

Everyone and their grandma has access to complex scripts, etc that were once very expensive. Whether they invest the energy in learning methods to hide their presence or just go straight to some other goal is going to depend on how they intend to abuse your systems.

I think most "security professionals" pretend they are going to catch an oddity that occurs that doesn't match what their automated tools would catch and occurs in the middle of some other crisis or holiday break. I would say good luck with that.

> The basic principle of real security models is once an attacker has full access all data on the system is potentially tampered with.

That's not true at all. Like, not at all.

Reply on news.ycombinator.com