Question

A successful attack was performed on a system at time t that gave the attacker full control of the system (including the power to modify the audit log from time t and beyond, but not before time t.) Given the log from time 0 to current such that 0 < t < current, would you still be able to identify that an attack happened on the system? Explain your answer. (Assume that all relevant events are logged in the audit log.)

Answer 1

Yes, we can clearly make out if an attack was made on the system, if the logs were also maintained on a remote log server. Then all we had to do, was verify the local log with remote log. If any changes are found, it implies that an attack was made on the local system and the attacker tried to hamper with the audit logs of the local system.