Analysis and Evaluation of the Windows Event Log - Bill Buchanan

More documents

Recommendations

Info

Barrie Codona, BSc (Hons) Network Computing, 2007 5.3.4. Decrypting Messages…………………….……………………. 46 5.3.5. Saving to Disk………………….………..……………..…….… 47 5.4. Log Reader…………………………….………….……………..….…. 47 5.4.1. Opening File…………………………….……………………... 47 5.4.2. Decoding XML…………………..……….………………..….. 48 5.4.3. HMAC Checksum………………..………..……………….….. 49 5.5. Conclusions………………………………...………..…………….…… 49 6. Evaluation…………………………………..…….…………..………………. 51 6.1. Introduction………………………………….…………..………..…… 51 6.2. Initial Testing………………………………………..…..……….…….. 51 6.3. Maintenance………………………………………...……..…………… 52 6.4. Experiment 1 – Performance……………………………….….….…… 53 6.5. Experiment 2 – Accuracy…………………..………………………….. 59 6.6. Experiment 3 – Security……………………….………………………. 61 6.7. Experiment 4 – Conformance…………………..……………………… 65 6.8. Conclusions………………………….…………...…………….……… 66 7. Conclusions and Further Work..……………………..………………….….. 68 7.1. Conclusions…………………………………………………………….. 68 7.2. Further Work..………………………………………………………….. 69 8. References………………………..…………………………..………………... 70 9. Appendices………………………..….………………………………………... 73 9.1. Appendix A: Diary Sheets 9.2. Appendix B: Preliminary Gantt Chart 9.3. Appendix C: Client Code 9.4. Appendix D: Server Code 9.5. Appendix E: Event Viewer Code 9.6. Appendix F: Tester Application 9.7. Appendix G: Processor Monitor 9.8. Appendix H: HMAC Brute Force Cracker 9.9. Appendix I: Windows Event Log Tests 5
Barrie Codona, BSc (Hons) Network Computing, 2007 Table of Figures Figure 1: Log server protected by a firewall……………….………..……..………. 10 Figure 2: Log architecture with time stamping machine……………………..….… 18 Figure 3: Copying the Windows security log………………………………….…... 24 Figure 4: Replacing the Windows security log. ……………….…………..………. 25 Figure 5: 32 bit time. ……………………………………...……….….…………… 26 Figure 6: Modifying the 32 bit time. …………………….………………………… 27 Figure 7: Event logger schematics. ……………………………..………………… 31 Figure 8: Client-Server prototype. ………………………………………………… 33 Figure 9: Client generated XML string. ………………..…….…………………… 34 Figure 10: Client XML string with HMAC. ……………….……………………… 34 Figure 11: Server XML string. …………………………………….……………… 35 Figure 12: The event viewer interface. ………………..……..…………………… 35 Figure 13: Client side pseudo code. ………………………………………..……… 36 Figure 14: Server side pseudo code. …………………………….………………… 37 Figure 15: Event viewer pseudo code. ………………………………….………… 37 Figure 16: Testing design. ………………………………………………....……… 38 Figure 17: Generate a large number of files pseudo code. ……….…………….… 39 Figure 18: Generate files with error checking. ……………………………..…..… 39 Figure 19: Tester application. …………………………………………..………… 40 Figure 20: Connecting to a server. ………………………………..……..………… 41 Figure 21: The FileSystemWatcher class. ……………………..…………..……… 42 Figure 22: Capturing events. …………………………………………..………..… 43 Figure 23: Generating an HMAC hash signature. …….……..…………………… 43 Figure 24: Encrypting data. ………………………………….…………………… 44 Figure 25: Sending data to the server. ……………………….…………………… 44 Figure 26: Listening for a connection. ……………………….…………………… 45 Figure 27: Generating RSA key pair. …………………………..….……………… 45 Figure 28: Receiving a message. ………………………………..………………… 46 Figure 29: Decrypting a message. ………………………………..…..…………… 46 Figure 30: Saving event data to disk. ……………………………………………… 47 Figure 31: Reading a file. ………………………………………….……………… 48 Figure 32: Dividing up an XML string. …………………………….……..……… 48 Figure 33: Checking the hash signature. ……………………………..…………… 59 Figure 34: Data flow. ………………….……………………………………..…… 52 Figure 35: Updated Client-Server communications. ……………………………… 53 Figure 36: Processor monitor application. ………………………..….…………… 54 Figure 37: Generating 1,000 files with no encryption. ………..…..……………… 54 Figure 38: Generating 5,000 files with no encryption. ………..……..…………… 55 Figure 39: Generating 10,000 files with no encryption. ……………..…………… 55 Figure 40: Generating 20,000 files with no encryption. ……………..…………… 55 Figure 41: Generating 1,000 files with symmetric encryption………..…………… 56 Figure 42: Generating 5,000 files with symmetric encryption………..…………… 56 Figure 43: Generating 10,000 files with symmetric encryption………..………..… 57 Figure 44: Generating 20,000 files with symmetric encryption………..……..…… 57 Figure 45: Symmetric encryption comparison. ……………………….…………… 58 Figure 46: Asymmetric encryption comparison. ………………………..………… 58 Figure 47: Test directory structure. ………………………………………..……… 59 Figure 48: Tester application generating random event. …………………..……… 59 6
Page 1 and 2: Analysis and Evaluation of the Wind
Page 3 and 4: Barrie Codona, BSc (Hons) Network C
Page 5: Barrie Codona, BSc (Hons) Network C
Page 57 and 58:
Barrie Codona, BSc (Hons) Network C
Page 59 and 60:
Page 61 and 62:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Page 75 and 76:
Appendix A: Diary Sheets
Page 77 and 78:
NAPIER UNIVERSITY SCHOOL OF COMPUTI
Page 79 and 80:
Page 81 and 82:
Page 83 and 84:
Page 85 and 86:
Appendix B: Preliminary Gantt Chart
Page 87 and 88:
Nov '07 Dec '07 Jan '08 Feb '08 Mar
Page 89 and 90:
C:\Documents and Settings\Barrie\My
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Appendix D: Server Application Code
Page 97 and 98:
Page 99 and 100:
Appendix E: Event Viewer Code
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
Appendix G: Processor Monitor Code
Page 107 and 108:
Appendix H: HMAC Brute Force Cracke
Page 109 and 110:
Page 111 and 112:
Page 113 and 114:
Appendix I: Windows Event Log Tests
Page 115 and 116:
Copy Security Log C:\windows\system
Page 117 and 118:
Another look at the Security Log re
Page 119 and 120:
The Event Service is then restarted
Page 121 and 122:
Another look at the ‘c:\windows\s
Page 123 and 124:
CO42019 - Project 4 Computer Name P
Page 125 and 126:
CO42019 - Project 4 Turned off the
Page 127 and 128:
CO42019 - Project 4 And then restar
Page 129 and 130:
CO42019 - Project 4 Modify the ‘l
Page 131 and 132:
CO42019 - Project 4 Project - Week
Page 133 and 134:
Page 135 and 136:
Page 137 and 138:
CO42019 - Project 4 As previously d
Page 139 and 140:
CO42019 - Project 4 The screenshot
Page 141 and 142:
CO42019 - Project 4 Displaying the
Page 143 and 144:
CO42019 - Project 4 Modifying the r
Page 145 and 146:
CO42019 - Project 4 Master File Tab
Page 147 and 148:
CO42019 - Project 4 Modify the sect
Page 149 and 150:
CO42019 - Project 4 Sectors 3748520
Page 151 and 152:
CO42019 - Project 4 This now shows
show all

Analysis and Evaluation of the Windows Event Log - Bill Buchanan

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?