Analysis and Evaluation of the Windows Event Log - Bill Buchanan

More documents

Recommendations

Info

Barrie Codona, BSc (Hons) Network Computing, 2007 Abstract The windows event log is used in digital forensic cases, but unfortunately it is flawed in many ways, and often cannot be seen as a verifiable method of determining events. In the past few years there have been a few highly publicised cases where the data that is contained within the event log is used to successfully secure a conviction. The aim of this dissertation is to develop a solution that addresses the flaws in the Windows event logging service. Through research carried out it had been found that it was possible to disable the event log service. This then allowed for important data to be modified, such as usernames, computer names, times and dates. It was also noted that an event log from one machine could successfully be transplanted into another without any problems. All of these vulnerabilities involved having access to, and being able to edit, the event log files. Based upon the research done, an event logging application was developed using C# and the Microsoft .NET framework. It makes use of RSA and AES encryption and HMAC hash signatures to improve the integrity of the data. The application is divided up into three components, an event logger which monitors specific files and folders within a computer system and sends alerts to the data archiving system in an XML format, and an event viewer that presents the events in a readable format to the user. The performances of the symmetric and asymmetric encryption were tested against each other. It had been found that the symmetric encryption was 800% faster than asymmetric encryption. Also the HMAC hash signatures were tested to see how long it would take to do a brute force attack on them. It was discovered that approximately 21,093 keys were processed every second, this was then compared to the key entropy and how a longer random key would be harder to break. 3
Barrie Codona, BSc (Hons) Network Computing, 2007 Table of Contents Authorship Declaration….……………………………………………………….. 1 Data Protection Declaration……………………………………………………… 2 Abstract……….…………………………………………………………………… 3 Contents…………….……………………………………………………..………. 4 List of Figures and Tables…………………………………………….………….. 5 Acknowledgements…………………………………………..…………………… 8 1. Introduction…………………………………………………………………… 9 1.1. Project Overview………………………………………………………. 9 1.2. Background………………………………..…………………………… 10 1.3. Aims and Objectives………………………………..………………...... 11 1.4. Thesis Structure………………………………………………………... 11 2. Literature Review……………..…………………………………..………..… 13 2.1. Introduction……………………………..…………………………..…. 13 2.2. Digital Forensics….………………………..…………………………... 13 2.3. Anti-Forensics……………………………………………………..…… 15 2.4. Log Management……………………….…..………………………….. 17 2.5. Conclusions…………………………………..………………………… 19 3. Evaluation of the Windows Event Log…………………………………..….. 21 3.1. Introduction…………………………………..………………………… 21 3.2. Experiments………………………………………..…..……………..... 21 3.3. Experiment Results…………………………………………….………. 23 3.4. Conclusions…………………………………………………..……..…. 28 4. Design………………..…………………………………….…………..……… 30 4.1. Introduction………………………………………….……….………… 30 4.2. High Level Design……………………………………………………... 30 4.3. Event Logging……………………………………….……….………… 31 4.4. Data Archiving System…………..………………….……….……….... 32 4.5. Encryption and Authentication……………………….……….……….. 33 4.6. Event Viewer………………………………………………...………… 35 4.7. Pseudo Code…………………………………………………..……….. 36 4.7.1. Client Side Pseudo Code……………………………………….. 36 4.7.2. Server Side Pseudo Code…………..…..…………………….... 37 4.7.3. Event Viewer……………………..…….……………………… 37 4.8. Testing Design……………………………..……...………………….... 38 4.9. Conclusions………………………………..………..………………..... 40 5. Implementation……………………………………..…..….………………… 41 5.1. Introduction….………………………………………….……………… 41 5.2. Event Logger.…………………………………..………………………. 41 5.2.1. Connecting to a server…………………...…………………….. 41 5.2.2. FileSystemWatcher……………………….…………………… 42 5.2.3. Capturing Events……………………….……………………… 42 5.2.4. HMAC…………………………………..……………………... 43 5.2.5. Encrypting………………………………..……………….…… 43 5.2.6. Sending To Server….……………………..….……………..…. 44 5.3. Data Archiving System..…………………………..….…………..……. 45 5.3.1. Listening for a Connection…..…………………………….…… 45 5.3.2. Generating Keys……………….………….………………….… 45 5.3.3. Receiving Messages…………….………..……….…………..... 46 4
Page 1 and 2: Analysis and Evaluation of the Wind
Page 3: Barrie Codona, BSc (Hons) Network C
Page 7 and 8: Barrie Codona, BSc (Hons) Network C
Page 55 and 56:
Barrie Codona, BSc (Hons) Network C
Page 57 and 58:
Page 59 and 60:
Page 61 and 62:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Page 75 and 76:
Appendix A: Diary Sheets
Page 77 and 78:
NAPIER UNIVERSITY SCHOOL OF COMPUTI
Page 79 and 80:
Page 81 and 82:
Page 83 and 84:
Page 85 and 86:
Appendix B: Preliminary Gantt Chart
Page 87 and 88:
Nov '07 Dec '07 Jan '08 Feb '08 Mar
Page 89 and 90:
C:\Documents and Settings\Barrie\My
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Appendix D: Server Application Code
Page 97 and 98:
Page 99 and 100:
Appendix E: Event Viewer Code
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
Appendix G: Processor Monitor Code
Page 107 and 108:
Appendix H: HMAC Brute Force Cracke
Page 109 and 110:
Page 111 and 112:
Page 113 and 114:
Appendix I: Windows Event Log Tests
Page 115 and 116:
Copy Security Log C:\windows\system
Page 117 and 118:
Another look at the Security Log re
Page 119 and 120:
The Event Service is then restarted
Page 121 and 122:
Another look at the ‘c:\windows\s
Page 123 and 124:
CO42019 - Project 4 Computer Name P
Page 125 and 126:
CO42019 - Project 4 Turned off the
Page 127 and 128:
CO42019 - Project 4 And then restar
Page 129 and 130:
CO42019 - Project 4 Modify the ‘l
Page 131 and 132:
CO42019 - Project 4 Project - Week
Page 133 and 134:
Page 135 and 136:
Page 137 and 138:
CO42019 - Project 4 As previously d
Page 139 and 140:
CO42019 - Project 4 The screenshot
Page 141 and 142:
CO42019 - Project 4 Displaying the
Page 143 and 144:
CO42019 - Project 4 Modifying the r
Page 145 and 146:
CO42019 - Project 4 Master File Tab
Page 147 and 148:
CO42019 - Project 4 Modify the sect
Page 149 and 150:
CO42019 - Project 4 Sectors 3748520
Page 151 and 152:
CO42019 - Project 4 This now shows
show all

Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Create successful ePaper yourself

Delete template?

Save as template?