EXERCISE 3 — Log tampering vs centralized write-once logging (breach detection) ================================================================================ HOW LOG TAMPERING DEFEATS BREACH DETECTION: FUNDAMENTAL PRINCIPLE: Logs are the primary forensic evidence of a breach. If an attacker can modify or delete logs, they erase the evidence of their crime. The organization is left blind: did a breach happen? What data was stolen? When? For how long? Without logs, you can't answer any of these questions. TAMPERED LOGS = NO DETECTION: - Attacker exfiltrates customer data (1000 credit cards, emails, passwords) over 3 days. - During exfiltration, the logs show: unusual API traffic, bulk exports, data downloads. - Attacker gains access to the app server and deletes/modifies logs to remove evidence of the exfiltration. - Organization's security team later checks logs for unusual activity: finds nothing. - Breach is never discovered from internal monitoring. (Discovery happens weeks later when a customer notices unauthorized charges, or the data appears in a dark-web marketplace.) CONSEQUENCES OF TAMPERED LOGS: - Breach detection is DELAYED or NEVER HAPPENS. - Scope of breach is unknown (how much data was stolen?). - Duration is unknown (how long was the attacker in the system?). - Forensics are impossible (who is the attacker? What did they access? Why?). - Compliance violations (GDPR, PCI DSS, HIPAA require breach notification within 30–72 hours; without logs, you can't meet the deadline). - Legal liability (you can't prove what happened; you can't prove you detected it quickly). --- WHY CENTRALIZED, WRITE-ONCE LOGGING IS CRITICAL: SCENARIO 1: LOGS ON THE APP SERVER (VULNERABLE) Setup: - App server: Ubuntu host with /var/log/app.log and /var/log/auth.log. - Logs are written locally; no backup or remote copy. Attack: - Attacker exploits an RCE vulnerability and gains shell access to the server. - First command: rm -f /var/log/app.log /var/log/auth.log (delete logs). - Attacker operates for 2 weeks, exfiltrating data, installing backdoors, creating admin accounts. - Organization's log retention: 7 days (oldest logs are auto-deleted). - After 2 weeks, when forensics try to investigate, all logs are gone. - Attacker is never caught; damage is never quantified. SCENARIO 2: CENTRALIZED WRITE-ONCE LOGGING (SECURE) Setup: - App server: logs are streamed in real-time to AWS CloudTrail (or similar write-once logging service). - CloudTrail enforces immutability: logs can only be appended; they cannot be deleted or modified by the app (or the app's creds). - Logs are encrypted at rest and signed for integrity (tamper-detection). Attack: - Attacker exploits RCE and gains shell access to the server. - Attacker tries: rm -f /var/log/app.log (the local log file is deleted, but that's noise). - All logs have already been sent to CloudTrail — REMOTE, IMMUTABLE, SAFE. - Attacker would need separate creds (AWS account creds) to access CloudTrail. - They don't have those creds (they only have app-server creds). - On-call security team sees real-time alerts (unusual data access, new admin account) within MINUTES. - Response: kill the attacker's session, force password resets, investigate. - Post-incident forensics: complete logs show exactly what happened, when, and how long. - Breach is contained within hours, not weeks. KEY DIFFERENCES: Local Logs | Centralized Write-Once ----------------------------------|------------------------------------- Attacker deletes after compromise | Attacker can't access central logs Forensics impossible | Complete forensics, signed/chained Detection delayed/nonexistent | Real-time alerts to on-call team Compliance violations | Audit trail intact for regulators Breach duration unknown | Exact timeline is clear --- CONCRETE ATTACK SCENARIO: ATTACKER COMPROMISES APP SERVER TIMELINE: Day 1, 9:00 AM: - Attacker finds an XSS vulnerability in the user dashboard. - Injects malicious JavaScript that steals session tokens. - Exfiltrates 100 customer sessions to attacker's server. INSUFFICIENT LOGGING (everything on app server): - Logs ARE written: XSS payload detected, unusual API calls, data downloads. - At 2:00 PM (5 hours later): - Attacker gains RCE via a session token / privilege escalation. - Shell command: rm -rf /var/log/* (delete all logs). - At 2:01 PM: - Attacker installs a backdoor for persistent access. - Creates admin account. - Exfiltrates sensitive data (customer PII, payment info). - At 2:02 PM: - Organization's on-call team has NO ALERTS (logs are gone, no one is monitoring them). - Days 2–14: - Attacker freely operates. Logs are non-existent. - Organization is BLIND. - Day 15: - A customer notices unauthorized charges. They contact support. - Support escalates to security. - Security checks logs: "No suspicious activity from May 1–14." - Organization delays incident response, notifying users WEEKS after the breach. - Regulatory fines, reputational damage, lawsuits. CENTRALIZED WRITE-ONCE LOGGING (logs sent to immutable service): - App logs are streamed to CloudTrail in real-time. - At 9:10 AM: - XSS payload detected; log entry: timestamp=09:10, event=xss_detected, payload=