Re: Web server response to attacks

On Thu, 2003-02-20 at 15:44, Michael Katz wrote:

> >Along those same lines, does this apply to the general class of exploits

That thinking is not quite correct. In general, I would not trust an application, and its logs, anymore after it has been compromised. Immediate off-site/off-host logging may yield usable log files, but local logs should be considered compromised if the host/application is compromised.

Using Terry's example: If I can compromise the IIS process through a buffer overflow and, say, get a remote shell, I can append a fake 40x entry to your log file. If you trust your logs that much, you may not notice me (ignoring for a moment that most b/o's will trash IIS. I haven't seen one yet that hijacks the process and restarts IIS... what a devil that would be...)

Anyhow, without some other, non-application bound, means of verifying the integrity of the host/app, such as virus scanners (for in-memory code) or H/NIDS, you can not make a sure statement about the status of a host/app (compromised or healthy). Most logs are written by the running app/process itself, so modifying/falsifying a process' own log would be much easier than modifying a different log on the same host. That's why I'm saying remote logs 'may' be useful, because they may not be. Assume a process logs to a remote host/logging facility. If I can hijack that process, I'm not able to delete/modify the remote log, but I maybe very well be able to send false logging statements from the hijacked app.

Seeing a 200 or 40x doesn't speak for the integrity of IIS...

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Regards,
Frank