Unit 8 Logging

Warm Up

1. Which threats against the logging components can you name?

2. What damage can log bypass and log tampering cause?

3. Which measures can be taken to secure the logging subsystems?

Reading

1. Read the text below and fill in the gaps in the following sentences.

1) It is a good practice to consider the possible …………. to the logging subsystem.

2) All log files should have strong ………………. to protect them from an attacker’s wiping.

3) Typical log bypass attacks are directed at flooding the log to reach ……………………...

4) …………….. can result in critical vulnerabilities especially because the log files are typically viewed by administrative or power users.

5) Log levels can also be used to …………………………. that will be written.

The Main Concepts of Logging

Logging is critical to the security of the application; there are a few considerations that must be kept in mind in order to securely create a logging implementation. It is therefore critical when creating the threat model for the system to consider the threats to the logging subsystem. The common threats against the logging component include:

Denial of Service – The logging subsystem should be implemented to account for disk space utilization. Since the logger will be typically saving all the logs to some persistent data store, it is critical to ensure that the logger is not responsible for exhausting the disk space.

Log Wiping – All log files should have strong access controls defined on them so that they cannot be deleted by an attacker. As one would expect this is a typical step in the attacker’s methodology so as to wipe out any traces of his malicious activity. Storing the log files on a separate and hardened log server as mentioned above is therefore regarded as a good practice.

Log Bypass – Attackers will often try and bypass the logger again as part of being stealthy. Typical log bypass attacks attempt to flood the log so that the maximum log quota is reached. A number of systems will at that point stop logging entirely thus allowing all future actions to go through without ever being logged. This would allow an attacker to perform malicious activity without resulting in that activity showing up as an audit trail.

Log Tampering – Attackers may also attempt to tamper with the contents of the log files, either to wipe out their activities or to create false or malicious log entries. Having discussed the former above, the latter is typically performed by injecting malicious metacharacters such as the carriage returns and line feeds or cross site scripting characters – especially when the log is viewable in a browser as part of a web application. This last threat can result in critical vulnerabilities especially because the log files are typically viewed by administrative or power users.

Besides the threats described above two other issues are critical – log overhead and log overload. Log overhead is unavoidable and the effort must be to minimize it. Many different strategies exist to optimize the logger. Hence it is important to avoid opening and closing file system handles or database connections for every log operation. Along similar lines it is vital to batch log operations together. Log levels can also be used to control the volume of information that will be written to the persistent data stores.