Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
it was modified the asynchronous encryption caused a buffer overflow which in turn
caused the application to stop capturing events. There still remains the problem of the
possibility of a man-in-the-middle attack.
The HMAC hash is prone to a brute force attack and even more prone to a dictionarybased
attack. It had been found that 21,093 keys could be checked every second. The
only way to minimise the risks of brute force and dictionary attacks would be to use a
large random key, which should be changed at a predetermined interval, this could be
either monthly or yearly. Another problem that exists is the credibility of historical
events in the event log could become questionable. Perhaps these could be better
protected by archiving them using encryption.
Overall the system successfully managed to capture when the ‘SecEvent.txt’ file was
being modified while a large number of other events were happening at the same time.
These events were then securely stored on the Data Archiving system.
67