Reader Comments (rss)

(Flattened / Threaded)

1.  

   guess who else will use this ruse

   

   aNonMooseCowherd, Oct 9th, 2003 @ 4:43pm

   
   

   If RIAA sues the wrong people, they'll probably use this excuse as well.

   [ reply to this | link to this | view in thread ]

2.  

   Forensically sound???

   

   LittleW0lf, Oct 9th, 2003 @ 6:12pm

   
   

   This guy's argument about blocks being out of order when logs are edited after the fact is fine, and as far as I can see it is correct. But there are definately ways around this argument though, such as a hacker moving the log, or the victim "defragging" their hard drive.
   
   Windows logs may be protected from defrags and movement of the files within the OS, but in this case, shouldn't they also be protected from modification after the fact? Seems to me that the defense lawyer might be able to shoot holes through this argument.
   
   The only way I could truely say something wasn't modified is if they took cryptographically locked checksums of the files and compared them, then they could argue that the attacker didn't modify the logs. Otherwise it is swiss cheese. Not that I don't think the hacker is guilty (ok, so maybe I don't, I do not have all the facts.) However this expert cannot believe that this evidence alone will convience a smart jury, nor will it stand up to ridicule by the competent defense lawyer.

   [ reply to this | link to this | view in thread ]

3.  

   As somebody that *has* been used and abused....

   

   Anonymous Coward, Oct 11th, 2003 @ 5:21am

   
   

   ...I can't tell you how disconserting it is to hear the investigator say "but that's just a theoretical vulnerability in TCP/IP". Of course this was in the telnet to SSH transition period. Nobody uses telnet any more... still, 6 months after they were still trying to decide if they had a case, explits like hunt and jugernaught began to surface from the underground. Theoretical indeed...
   
   Computer "evidence" is *extremely* ephemeral and if the computer is connected to the Internet in any way, shape or form...
   
   Any good professional (and what I mean by "good professional" is that they don't have a record -- not even a FBI case file entry -- and they make a living from their efforts) cracker knows to get a patsy before doing anything that anyone will take any notice of.

   [ reply to this | link to this | view in thread ]

4.  

   Re: As somebody that *has* been used and abused...

   

   Anonymous Coward, Oct 11th, 2003 @ 5:23am

   
   

   > "but that's just a theoretical vulnerability in TCP/IP". Of course this was in the telnet to SSH transition period. Nobody uses telnet any more...< br>
   
   ...and nobody is even really sure SSH is completely safe these days either.

   [ reply to this | link to this | view in thread ]

Add Your Comment