Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
6.6 Experiment 3: Security
This experiment will be used to try and measure the whether or not the application
meets the security requirements. This will be done by checking the HMAC checksum
that is tagged onto each event and also the synchronous and asynchronous encryption.
When an event is generated it produces an XML string which (see Figure 51) contains
the following information:
Client Time
and Date
Computer and
Username
The Type of
Event
Figure 51: Client XML string without HMAC
The Full Path
of the File
This information is then passed into the HMAC checker, which calculates a value that
is based upon this information and a predetermined key. It will produce a value that is
tagged onto the end of the XML string. The XML string will now look like Figure 52.
Client Time
and Date
Computer and
Username
The Type of
Event
The Full Path
of the File
HMAC
Check
Figure 52: Client XML string with HMAC
To check that the HAMC value that is being produced is valid, the original XML
string along with the original key will be put through a separate hash calculator called
‘HashCalc’ (http://www.slavasoft.com/hashcalc/index.htm) , this will produce an
HMAC value which should be the same as the one that is tagged on the end of the
XML string. Figure 53 shows the data that was used to generate the HMAC hash.
Original Key: 123456789
Original String: 30/04/2008 11:19:28
PC3\BarrieCreated
c:\Test\Sample4591.txt
HMAC Output: 55B7839A807951FED96CD0927511962280258793
Figure 53: HMAC test data
61