SecSyslog: an Approach to Secure Logging Based on Covert Channels

Today log traces are widely used to identify and prevent violations of corporate information systems. The most recent logging trend is to manage most level 3 ISO/OSI traffic via pcapcompatibile output. But use of syslog is still very widespread, as are the security issues it entails, especially in its 'pure' version. This paper outlines the basic syslog problems as foreseen in the RFCs, examines the 'secure' alternatives to the protocol (and relative implementations) and proposes a transmission approach based on covert channels which, applied on the LINUX platform, might answer some of the intrinsic reliability problems which undermine its effectiveness as a digital forensic tool.

• Type: Conference
• Year: 2005
• Where: SADFE
• Authors: Dario V. Forte, Cristiano Maruti, Michele R. Vetturi, Michele Zambelli
• Keywords: Basic Syslog Problems, Digital Forensic Engineering, Forensic Engineering, Intrinsic Reliability Problems, SADFE 2005, Today Log Traces