Analysis and Evaluation of the Windows Event Log - Bill Buchanan

More documents

Recommendations

Info

Barrie Codona, BSc (Hons) Network Computing, 2007 ……………… ……………… …………………… ……………… …………………… ………………… Figure 11: Server XML string 4.5 Event Viewer The Event Viewer Application will be used to view the contents of the event log that has been generated and stored on the Server. If will display the contents of each Event, for example the different Client and Server timestamps that have been generated. It will also display details about the event that have taken place, namely what files have been modified, changed, deleted or renamed. As well, it will also display the HMAC checksum that was originally generated and will also recalculate a new checksum value based solely upon the information in the Event Log. This will then be compared to the original. So long as the user inputs the same key that was originally used, this check will alert the user if the data has been changed. Figure 12 shows the graphical user interface that has been designed for the application. Figure 12: The event viewer interface This will allow the user to be able to access and view each of the Events that’s are stored in the Event Log, it will work by reading the Event Log file into an array and then allow the user to access each element of the array, as each ‘record’ is accessed the application will use the XML tags to sort the data into its correct field. The 35
Barrie Codona, BSc (Hons) Network Computing, 2007 application will also provide the ability to search through all the events looking or any that fail the checksum check. 4.6 Pseudo Code Pseudo code is used in software development to give a description in a readable form of the basic functions of a program. The purpose of this is to make it more readable for humans, so they can understand what the program is doing, without overcomplicating the code and introducing complex algorithms. 4.6.1 Client Side Pseudo Code Figure 13 is the pseudo code that the client application will use. As it can be seen the client attempts to connect to the Data Archiving System using port 13000. This port has been selected as it outside of the range of commonly used ports. After the connection has been established the client receives the public key from the Data Archiving System. This key is then used to encrypt all the data that is sent to the Data Archiving System. Prompt user to enter a key for use with HMAC Connect to the server on port 13000 Receive public key from server Do Continuously { Monitor for files being ‘modified’ If a file is ‘modified’ { Get system time Get username Get event type (changed/created/deleted/renamed) Get path of file Generate XML string Generate HMAC checksum Add HMAC to XML String Encrypt with Servers public key Send to Server } } Figure 13: Client side pseudo code 4.6.2 Data Archiving System Pseudo Code 36
Page 1 and 2: Analysis and Evaluation of the Wind
Page 3 and 4: Barrie Codona, BSc (Hons) Network C
Page 35: Barrie Codona, BSc (Hons) Network C
Page 75 and 76: Appendix A: Diary Sheets
Page 77 and 78: NAPIER UNIVERSITY SCHOOL OF COMPUTI
Page 85 and 86: Appendix B: Preliminary Gantt Chart
Page 87 and 88:
Nov '07 Dec '07 Jan '08 Feb '08 Mar
Page 89 and 90:
C:\Documents and Settings\Barrie\My
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Appendix D: Server Application Code
Page 97 and 98:
Page 99 and 100:
Appendix E: Event Viewer Code
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
Appendix G: Processor Monitor Code
Page 107 and 108:
Appendix H: HMAC Brute Force Cracke
Page 109 and 110:
Page 111 and 112:
Page 113 and 114:
Appendix I: Windows Event Log Tests
Page 115 and 116:
Copy Security Log C:\windows\system
Page 117 and 118:
Another look at the Security Log re
Page 119 and 120:
The Event Service is then restarted
Page 121 and 122:
Another look at the ‘c:\windows\s
Page 123 and 124:
CO42019 - Project 4 Computer Name P
Page 125 and 126:
CO42019 - Project 4 Turned off the
Page 127 and 128:
CO42019 - Project 4 And then restar
Page 129 and 130:
CO42019 - Project 4 Modify the ‘l
Page 131 and 132:
CO42019 - Project 4 Project - Week
Page 133 and 134:
Page 135 and 136:
Page 137 and 138:
CO42019 - Project 4 As previously d
Page 139 and 140:
CO42019 - Project 4 The screenshot
Page 141 and 142:
CO42019 - Project 4 Displaying the
Page 143 and 144:
CO42019 - Project 4 Modifying the r
Page 145 and 146:
CO42019 - Project 4 Master File Tab
Page 147 and 148:
CO42019 - Project 4 Modify the sect
Page 149 and 150:
CO42019 - Project 4 Sectors 3748520
Page 151 and 152:
CO42019 - Project 4 This now shows
show all

Analysis and Evaluation of the Windows Event Log - Bill Buchanan

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?