CSCI E-170 Lecture 11: Redux of papers, Logging, The Law, Integrity - PowerPoint PPT Presentation

CSCI E-170 Lecture 11: Redux of papers, Logging, The Law, Integrity Management Simson L. Garfinkel Center for Research on Computation and Society Harvard University December 5, 2005 1

Today’s Agenda 1. Administrivia 2. Midterm Projects: Redux 3. Logging 4. Federal Rules of Evidence 5. Federal Computer Crime Statutes 6. Integrity Management 2

Administrivia 1: HW4 You should be working now on P2, not HW4. HW4 should be released by next Monday. 3

Administrivia 1: P1 Overall, we were very impressed with the projects. Best papers: • Trends in Biometrics and User Acceptance , by Team Future (Ellen Jervis, Matt Kennedy, Neal Kepler, and Julia Kim). • Steganography: Two Faces of a Coin , by Team Money (Migdalia Rosa, David Root, Ricardo Rodriguez, Gerrick Rodrigues) 4

P1 Continued . . . Some groups had issues regarding citation and sourcing. You were all very careful not to plagiarize! . . . But you were not careful to use proper academic citations or sources. 5

Which is the better reference? [1] http://www.accessdata.com/Product04 Overview.htm? ProductNum=04 [1] Access Data. Forensic toolkit—overview, 2005. http://www. accessdata.com/Product04 Overview.htm?ProductNum=04 6

Which is the better reference? (2) [2] US Environmental Protection Agency. Wastes: The hazardous waste manifest system, 2005. http://www.epa.gov/epaoswer/hazwaste/gener/manifest/ . [2] http://www.epa.gov/epaoswer/hazwaste/gener/manifest/ 7

Which is the better reference? (3) [3] American Library Association Office for Information Technology Policy. Managing cookies to protect patron privacy, 2005. http://www.ala.org/ala/washoff/oitp/ emailtutorials/privacya/20.htm . Accessed April 20, 2005. [3] http://www.ala.org/ala/washoff/oitp/emailtutorials/ privacya/20.htm. 8

Which is the better reference? (4) [1] Steven Bauer and Nissanka B. Priyantha. “Secure data deletion for Linux file systems.” In Proc. 10th Usenix Security Symposium, pages 153–164. Usenix, San Antonio, Texas, 2001. [1] Chuvakin, Anton, Ph.D. “Linux Data Hiding and Recovery,” LinuxSecurity.COM, Posted 10 March 2002, http://www.linuxsecurity.com/content/view/117638/49/ . 9

What’s wrong with Dr. Chuvakin’s article? About the Author Anton Chuvakin, Ph.D. is a Senior Security Analyst with netForensics ( http://www.netforensics.com ), a security information management company that provides real-time network security monitoring solutions. 10

What’s wrong with this citation? [1] “Feds Get Wide Wiretap Authority,” CBS News, November 18, 2002. http://www.cbsnews.com/stories/2002/08/23/attack/ main519606.shtml 11

Common mistakes in sources on midterm projects: • Providing URLs instead of proper citations. • Citing articles in popular press . • Citing market research reports (e.g. Gartner Group). • Citing articles about patents rather than the patents themselves. • Citing references that are out-of-date. 12

P1 was a research report. P2 is a conference article. Key differences: Why Johnny Canʼt Encrypt: A Usability Evaluation of PGP 5.0 Abstract 1 Introduction • Strict page limit. • Two column format. 13

Logging % ls -l /var/log/ | grep -v gz total 1224 -rw-r--r-- 1 root wheel 112590 Dec 5 13:45 asl.log -rw-r--r-- 1 root wheel 60159 Dec 4 00:12 crashreporter.log drwxr-xr-x 7 root wheel 238 Nov 28 15:11 cups/ -rw-r--r-- 1 root wheel 216534 Dec 5 03:14 daily.out drwxr-xr-x 2 root wheel 68 Mar 20 2005 fax/ -rw-r----- 1 root admin 0 Dec 4 05:50 ftp.log drwxr-xr-x 10 root wheel 340 Dec 4 05:50 httpd/ -rw-r--r-- 1 root admin 0 Dec 1 17:41 install.log -rw-r----- 1 root admin 0 Dec 4 05:50 ipfw.log -rw-r----- 1 root admin 14112 Dec 5 13:41 lastlog -rw-r----- 1 root admin 0 Dec 4 05:50 lpr.log -rw-r----- 1 root admin 713 Dec 5 03:14 mail.log -rw-r----- 1 root wheel 3742 May 12 2005 mb.log -rw-r--r-- 1 root wheel 721 Dec 1 17:41 monthly.out -rw-r----- 1 root admin 0 Dec 4 05:50 netinfo.log drwxr-xr-x 2 root wheel 68 Mar 26 2005 ppp/ -rw-r----- 1 root admin 0 Dec 4 05:50 ppp.log drwxr-xr-x 2 root wheel 68 Mar 20 2005 sa/ drwxr-xr-x 4 root wheel 136 Jun 22 23:15 samba/ -rw-r----- 1 root admin 5033 Dec 5 13:23 secure.log -rw-r----- 1 root admin 8504 Dec 5 13:45 system.log -rw-r--r-- 1 root wheel 2741 Dec 4 05:50 weekly.out -rw-r----- 1 root admin 49132 Dec 5 13:23 windowserver.log -rw-r----- 1 root admin 56188 Nov 30 06:21 windowserver_last.log -rw-r--r-- 1 root admin 3312 Dec 5 13:41 wtmp 14

What is a log? 15

What gets logged? 16

What gets logged? • Logins & Logouts • Privilege escalation • Security relevant events 17

What gets logged? • Logins & Logouts • Privilege escalation • Security relevant events 18

Why keep logs? 19

Why look at logs? Policy may require it. Regulations may require it. Cost savings—find inefficiencies that can be avoided. 20

But what really gets logged? 21

What really gets logged... windowserver.log: Nov 30 09:00:40 [70] Server is starting up Nov 30 09:00:42 [70] Accel caps: 00000003 Nov 30 09:00:42 [70] Accel caps: 00000003 Nov 30 09:00:42 [70] CGXPerformInitialDisplayConfiguration Nov 30 09:00:42 [70] Display 0x4270a80: MappedDisplay Unit 0; Vendor 0x610 Model 0x9c2a S/N 0; online enabled built-in (0,0)[1024 x 768], base addr 0xb0015000 Nov 30 09:00:42 [70] Display 0x3f003d: MappedDisplay Unit 1; Vendor 0xffffffff Model 0xffffff ff S/N -1; offline enabled (2048,0)[1 x 1], base addr 0xb2016000 Nov 30 09:00:49 [70] kCGErrorIllegalArgument: CGXSetWindowListTags: Operation on a window 0x1 not owned by caller SecurityAgent Nov 30 09:00:50 [70] kCGErrorIllegalArgument: CGXOrderWindow: Operation on a window 0x1 not owned by caller SecurityAgent Nov 30 09:02:32 [70] kCGErrorFailure: CGXDisableUpdate: UI updates were forcibly disabled by application "Finder" for over 1 second. Server has re-enabled them. Nov 30 09:09:37 [70] "loginwindow" (0x3eb3) set hot key operating mode to all disabled Nov 30 09:09:37 [70] Hot key operating mode is now all disabled Nov 30 11:55:15 [70] "loginwindow" (0x3eb3) set hot key operating mode to normal Nov 30 11:55:15 [70] Hot key operating mode is now normal Nov 30 11:57:17 [70] "loginwindow" (0x3eb3) set hot key operating mode to all disabled Nov 30 11:57:17 [70] Hot key operating mode is now all disabled Nov 30 11:57:22 [70] kCGErrorCannotComplete: CGXPostNotification2 : Time out waiting for reply from "coreaudiod" for notification type 102 (CID 0xc903, PID 42) Most log files are created for debugging, not for security. 22

What does this mean? Nov 30 09:00:40 [70] Server is starting up Month and day (no year!) Nov 30 The time (is it accurate?) 09:00:40 Unix Process ID [70] Message Server is starting up 23

There is no regularity for log files—not even within a single log file. windowserver.log: Nov 30 09:00:40 [70] Server is starting up secure.log: Dec 4 13:01:44 localhost com.apple.SecurityServer: Entering Dec 4 13:01:51 G12-2 SecurityAgent[90]: Showing Login Window Dec 4 13:01:54 G12-2 SecurityAgent[90]: User Authenticated: Dec 4 13:01:54 G12-2 com.apple.SecurityServer: authinternal authenticated user simsong (uid 501). Most log files are created to be read by humans, not programs. 24

Log files can contain unexpectedly sensitive information These logs are readable by anybody: -rw-r--r-- 1 root wheel 112590 Dec 5 13:45 asl.log -rw-r--r-- 1 root wheel 60159 Dec 4 00:12 crashreporter.log -rw-r--r-- 1 root wheel 216534 Dec 5 03:14 daily.out -rw-r--r-- 1 root admin 0 Dec 1 17:41 install.log -rw-r--r-- 1 root wheel 721 Dec 1 17:41 monthly.out -rw-r--r-- 1 root wheel 2741 Dec 4 05:50 weekly.out -rw-r--r-- 1 root admin 3312 Dec 5 13:41 wtmp These logs are protected: -rw-r----- 1 root admin 0 Dec 4 05:50 ftp.log -rw-r----- 1 root admin 0 Dec 4 05:50 ipfw.log -rw-r----- 1 root admin 14112 Dec 5 13:41 lastlog -rw-r----- 1 root admin 713 Dec 5 03:14 mail.log -rw-r----- 1 root wheel 3742 May 12 2005 mb.log -rw-r----- 1 root admin 5033 Dec 5 13:23 secure.log -rw-r----- 1 root admin 8504 Dec 5 13:45 system.log -rw-r----- 1 root admin 49132 Dec 5 13:23 windowserver.log -rw-r----- 1 root admin 56188 Nov 30 06:21 windowserver_last.log Why? 25

Conventional thinking is to protect any log that may contain sensitive information -rw-r----- 1 root admin 0 Dec 4 05:50 ftp.log -rw-r----- 1 root admin 0 Dec 4 05:50 ipfw.log -rw-r----- 1 root admin 14112 Dec 5 13:41 lastlog -rw-r----- 1 root admin 713 Dec 5 03:14 mail.log -rw-r----- 1 root wheel 3742 May 12 2005 mb.log -rw-r----- 1 root admin 5033 Dec 5 13:23 secure.log -rw-r----- 1 root admin 8504 Dec 5 13:45 system.log -rw-r----- 1 root admin 49132 Dec 5 13:23 windowserver.log -rw-r----- 1 root admin 56188 Nov 30 06:21 windowserver_last.log What’s sensitive? • Usernames — users may provide passwords by accident. • Email records — reveals relationships. But conventional thinking may be wrong. It may be appropriate to keep all log files confidential. 26