Vulnerability allows hackers to hide attacks from investigators. Here is how to protect yourself.

What is it about?

System logs are considered the most valuable artifact when investigating cyberattacks. To be useful, however, they must include a trace of what the hackers did during their cyberattack. This paper describes a race condition vulnerability that can be exploited by hackers to leave no traces about their cyberattack in the system logs. Unfortunately, the paper finds that existing defenses (even state-of-the-art tamper-evident logging frameworks) do not protect against this attack. The paper then describes a new defense design that can protect against this attack, and introduces a system called KennyLoggings that implements this design. KennyLoggings is the first system logging framework to provide "synchronous integrity" by guaranteeing tamper evidence of log events upon their occurrence. Finally, the paper evaluates KennyLoggings' performance and discusses how it can work in conjunction with existing logging frameworks.

Featured Image

Photo by Anushka Arun on Unsplash

Photo by Anushka Arun on Unsplash

Why is it important?

1. It shows that the increasingly common threat of anti-forensic attackers in operating systems is worse than we thought. Hackers can undetectably intercept and conceal their attack traces even in the presence of state-of-the-art secure logging systems! 2. It presents the first system to guarantee tamper evidence for all the log events that lead to full system compromise. This property gives investigators insight into the window of time during which existing defenses are vulnerable.

Perspectives