Hacker News
points by jagged-chisel 2 days ago | 0 comments
Should we expect logs from a compromised system to be truthful?
[–] smolder 2 days ago
No, of course not. Covering your tracks by manipulating logs and monitoring tools is stuff any sophisticated attacker would do
[–] lambdaone 2 days ago
Perhaps if those logs were streamed to a non-compromised machine and stored there
[–] jagged-chisel 2 days ago
And how do we know the logs that are emitted are trustworthy?