2016 Postmortem

lovuian

(19,362 posts)

32. from the article

Fri Mar 4, 2016, 01:21 AM

Mar 2016

Mr. Pagliano told the agents that nothing in his security logs suggested that any intrusion occurred. Security logs keep track of, among other things, who accessed the network and when. They are not definitive, and forensic experts can sometimes spot sophisticated hacking that is not apparent in the logs, but computer security experts view logs as key documents when detecting hackers.

time will tell

Edit history

Please sign in to view edit histories.

81 replies

= new reply since forum marked as read

Highlight:

Breaking News: Clinton email server secure - never hacked. [View all] kstewart33 Mar 2016 OP

Because malware writes to the syslog. jeff47 Mar 2016 #1

malware on a enterprise grade Fortinet firewall, I don't think so BlueStateLib Mar 2016 #8

Read the story. They're talking about the mailserver's logs. jeff47 Mar 2016 #9

article says "he provided agents the security logs" BlueStateLib Mar 2016 #19

Doesn't say which security logs AgerolanAmerican Mar 2016 #34

Wouldn't the FBI have recovered any security log files on the Server HDD BlueStateLib Mar 2016 #39

Security logs from the potentially compromised system tells you nothing. jeff47 Mar 2016 #49

Exactly: compromised systems' logs are useless. Lizzie Poppet Mar 2016 #63

Maybe on your home computer MaggieD Mar 2016 #10

Reading. Try it this time. jeff47 Mar 2016 #11

I read it MaggieD Mar 2016 #12

Again, do you think nation-state-level attacks would write to log files? jeff47 Mar 2016 #13

I think they wouldn't have a chance to.... MaggieD Mar 2016 #14

Of course they have a choice. jeff47 Mar 2016 #16

No, not with the proper security MaggieD Mar 2016 #22

There's no way that can be said for sure AgerolanAmerican Mar 2016 #35

The state department server was never hacked either. jeff47 Mar 2016 #42

State was hacked pretty severely about 18 months ago (nt) Recursion Mar 2016 #71

Digital certificate analysis for clintonemail.com BlueStateLib Mar 2016 #38

That's a wonderful thing, not a flaw, as far as that goes Recursion Mar 2016 #43

Then you can't authenticate the remote server. jeff47 Mar 2016 #47

Of course you can. What a ridiculous claim. You *manage key exchange* Recursion Mar 2016 #48

That would be the pre-shared keys I talked about. jeff47 Mar 2016 #51

You're half right Recursion Mar 2016 #53

Not quite. jeff47 Mar 2016 #56

You're nearly understanding it Recursion Mar 2016 #58

Nope, you're still missing a certificate. jeff47 Mar 2016 #66

And the government root CA cert is installed by the government IT admins on the client computers Recursion Mar 2016 #68

We started it because Clinton's server used a self-signed certificate jeff47 Mar 2016 #72

We have absolutely zero evidence of that Recursion Mar 2016 #74

We don't have any evidence of a non-self-signed certificate either. jeff47 Mar 2016 #75

Well, my web server and mail server are at the same IP address and use different certificates Recursion Mar 2016 #77

Yeah, but you're actually serving web pages. jeff47 Mar 2016 #80

And just to be clear, that was supposed to be "nearly every government mail server" Recursion Mar 2016 #81

Nope. jeff47 Mar 2016 #44

And a CA-signed certificate only authenticates to the extent you trust the CA. And some of those CAs Recursion Mar 2016 #50

Again, pre-shared keys only protect you as long as the cert is not stolen. jeff47 Mar 2016 #55

Well, first off, you are confusing pre-shared keys with public/private key pairs Recursion Mar 2016 #57

Yes, I used 'pre-shared key' when I should have used 'pre-shared certificate'. jeff47 Mar 2016 #62

It would look self-signed to an outside observer Recursion Mar 2016 #65

It would be chained to a root CA that the outside observer does not trust. jeff47 Mar 2016 #70

Right, but a self-signed certificate is still strictly better Recursion Mar 2016 #73

Why would you access an email server through HTTP? (nt) Recursion Mar 2016 #69

Business-level security would be a 3-tier minimum server layer, Bus Architecture to the back-end. TheBlackAdder Mar 2016 #20

Not necessarily - you don't seem up to date on the latest tech MaggieD Mar 2016 #23

There's new and there's secure. Play in your world, I have responsibilities to secure billions. TheBlackAdder Mar 2016 #25

That's nice MaggieD Mar 2016 #26

Let me get this straight! You think a stand-alone server is secure in any configuration? TheBlackAdder Mar 2016 #27

A stand-alone Windows server no less AgerolanAmerican Mar 2016 #36

I agree Bob41213 Mar 2016 #64

Apparently magic gnomes can detect the attack from the compromised server itself. jeff47 Mar 2016 #45

Sounds like more Hillary tales LittleBlue Mar 2016 #37

k&r DesertRat Mar 2016 #2

That sort of misses the point of the investigation tularetom Mar 2016 #3

Thank you - I was scratching my head when I read this. What does this have to do with anything? jillan Mar 2016 #30

Defense by non sequitur is mostly for show HereSince1628 Mar 2016 #41

Gosh, if only they had the logs 8 months ago this security review Press Virginia Mar 2016 #4

Your headline is misleading nichomachus Mar 2016 #5

Our guys are as good as their guys. kstewart33 Mar 2016 #21

How do you know our guys are as good? JonLeibowitz Mar 2016 #33

Well if Hillary's aide said it, case closed! morningfog Mar 2016 #6

This! NWCorona Mar 2016 #7

Actually the FBI said it.. DemocratSinceBirth Mar 2016 #59

Great news, if true. Link to FBI confirmation? The article in the OP and what I have read only morningfog Mar 2016 #61

Not an official confirmation DemocratSinceBirth Mar 2016 #67

Okay, I see what you are saying. morningfog Mar 2016 #79

When I was enlisted... LP2K12 Mar 2016 #15

I'm glad renate Mar 2016 #17

Log files are just like any other, subject to edit with tools, including its timestamps! TheBlackAdder Mar 2016 #18

MMWWAAAAAA, MMWWWAAAAAA MMWWAAAAAA Darb Mar 2016 #54

Unsinkable HRC. oasis Mar 2016 #24

Great silenttigersong Mar 2016 #28

Bernie supporters are not RWers calguy Mar 2016 #31

This story is being grasped at all over the place mindwalker_i Mar 2016 #29

from the article lovuian Mar 2016 #32

Why would we have to worry about hackers? Nuclear Unicorn Mar 2016 #40

Great news, but no surprise. MoonRiver Mar 2016 #46

So if a top secret email isn't hacked, is it still a crime? Chemisse Mar 2016 #52

what OS was the private email server using? lapfog_1 Mar 2016 #60

no evidence of foreign hacking does not equal "never hacked", but then you might not know that. Kip Humphrey Mar 2016 #76

Same staffer who pleaded the 5th and got immunity lynne Mar 2016 #78