{"id":{"repo_id":"uiuc","oai_identifier":"oai:www.ideals.illinois.edu:2142/105946"},"canonical_url":"https://search.dev.ndltd.org/etd/uiuc/oai:www.ideals.illinois.edu:2142/105946","repository":{"repo_id":"uiuc","name":"University of Illinois - Urbana-Champaign","base_url":"https://www.ideals.illinois.edu/oai-pmh"},"display":{"title":"Towards trustworthy foundations for operating system Forensics","abstract":"System logging is an essential component of building and maintaining secure systems. Unfortunately, attackers regularly engage in anti-forensic activities after a break-in, covering their tracks from system logs in order to frustrate the efforts of investigators. In response to this threat, a variety of secure logging solutions have appeared in the industry and the literature that attempt to provide tamper-resistance (e.g., Write-Once-Read-Many drives, remote storage servers) or tamper-evidence (e.g., cryptographic integrity proofs) for system logs. However, these approaches have not seen widespread adoption and moreover do not address the operational requirements of system-layer auditing frameworks. As such, the vast majority of system logs today remain vulnerable to adversarial tampering and removal. In this thesis, we revisit the goal of secure logging within the context of standard operating system abstractions. We introduce Custos, a comprehensive framework for the detection and prevention of tampering in system logs. Custos enables real-time detection of log integrity violations within an enterprise-class network while being minimally invasive to the underlying logging framework. Next, we present and validate an in-memory attack on the integrity of auditing frameworks. Our attack exploits the intrinsically asynchronous nature of I/O and IPC activity, demonstrating that an attacker can snatch the very evidence of their own intrusion out of message buffers before it is securely recorded. Finally, we present KennyLoggings, the first kernel-based tamper evident logging scheme that cryptographically secures event records at the moment of the event’s occurrence. We demonstrate that our systems are practical and impose modest (< 10%) costs to the operating system, while being able to detect violations even in the presence of powerful distributed adversaries. More generally, the systems presented in this thesis dramatically mitigate the threat of a covert anti-forensic attacker, enabling analysts to inspect a verifiable chain of custody for forensic data. Thus, this thesis demonstrates a viable path forward to achieving trustworthy foundations for operating system forensics.","abstract_html":"System logging is an essential component of building and maintaining secure systems. Unfortunately, attackers regularly engage in anti-forensic activities after a break-in, covering their tracks from system logs in order to frustrate the efforts of investigators. In response to this threat, a variety of secure logging solutions have appeared in the industry and the literature that attempt to provide tamper-resistance (e.g., Write-Once-Read-Many drives, remote storage servers) or tamper-evidence (e.g., cryptographic integrity proofs) for system logs. However, these approaches have not seen widespread adoption and moreover do not address the operational requirements of system-layer auditing frameworks. As such, the vast majority of system logs today remain vulnerable to adversarial tampering and removal. In this thesis, we revisit the goal of secure logging within the context of standard operating system abstractions. We introduce Custos, a comprehensive framework for the detection and prevention of tampering in system logs. Custos enables real-time detection of log integrity violations within an enterprise-class network while being minimally invasive to the underlying logging framework. Next, we present and validate an in-memory attack on the integrity of auditing frameworks. Our attack exploits the intrinsically asynchronous nature of I/O and IPC activity, demonstrating that an attacker can snatch the very evidence of their own intrusion out of message buffers before it is securely recorded. Finally, we present KennyLoggings, the first kernel-based tamper evident logging scheme that cryptographically secures event records at the moment of the event’s occurrence. We demonstrate that our systems are practical and impose modest (&lt; 10%) costs to the operating system, while being able to detect violations even in the presence of powerful distributed adversaries. More generally, the systems presented in this thesis dramatically mitigate the threat of a covert anti-forensic attacker, enabling analysts to inspect a verifiable chain of custody for forensic data. Thus, this thesis demonstrates a viable path forward to achieving trustworthy foundations for operating system forensics.","abstract_has_math":false,"creators":["Paccagnella, Riccardo"],"institution":"University of Illinois at Urbana-Champaign","degree_name":"M.S.","degree_level":"Thesis","degree_discipline":"Computer Science","degree_department":null,"school":null,"contributors":["Bates, Adam M"],"advisors":[],"committee_chairs":[],"committee_members":[],"year":2019,"date_issued":"2019-11-26T20:59:48Z","date_published":"2019-11-26T20:59:48Z","updated_at":"2026-07-22T22:24:45Z","subjects":["operating systems","forensics","secure logging","audit logs","system auditing framework","tamper-evident logging","kernel race condition","asynchronous logging","forward integrity"],"languages":["en"],"rights":["Copyright 2019 Riccardo Paccagnella"],"rights_urls":[],"identifier_entries":[]},"links":{"outbound_url":"http://hdl.handle.net/2142/105946","outbound_label":"Handle","outbound_source":"dc:identifier"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor","label":"Contributor","values":["Bates, Adam M"]},{"key":"dc:creator","label":"Author","values":["Paccagnella, Riccardo"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date","label":"Dc Date","values":["2019-11-26T20:59:48Z","2021-11-26T10:15:26Z","2019-07-12","2019-08"]},{"key":"dc:type","label":"Dc Type","values":["text"]},{"key":"thesis:degree_discipline","label":"Discipline","values":["Computer Science"]},{"key":"thesis:degree_level","label":"Degree Level","values":["Thesis"]},{"key":"thesis:degree_name","label":"Degree Name","values":["M.S."]},{"key":"thesis:institution_name","label":"Thesis Institution Name","values":["University of Illinois at Urbana-Champaign"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["operating systems","forensics","secure logging","audit logs","system auditing framework","tamper-evident logging","kernel race condition","asynchronous logging","forward integrity"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language","label":"Dc Language","values":["en"]},{"key":"dc:rights","label":"Dc Rights","values":["Copyright 2019 Riccardo Paccagnella"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier","label":"Identifier","values":["http://hdl.handle.net/2142/105946"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description","label":"Description","values":["System logging is an essential component of building and maintaining secure systems. Unfortunately, attackers regularly engage in anti-forensic activities after a break-in, covering their tracks from system logs in order to frustrate the efforts of investigators. In response to this threat, a variety of secure logging solutions have appeared in the industry and the literature that attempt to provide tamper-resistance (e.g., Write-Once-Read-Many drives, remote storage servers) or tamper-evidence (e.g., cryptographic integrity proofs) for system logs. However, these approaches have not seen widespread adoption and moreover do not address the operational requirements of system-layer auditing frameworks. As such, the vast majority of system logs today remain vulnerable to adversarial tampering and removal. In this thesis, we revisit the goal of secure logging within the context of standard operating system abstractions. We introduce Custos, a comprehensive framework for the detection and prevention of tampering in system logs. Custos enables real-time detection of log integrity violations within an enterprise-class network while being minimally invasive to the underlying logging framework. Next, we present and validate an in-memory attack on the integrity of auditing frameworks. Our attack exploits the intrinsically asynchronous nature of I/O and IPC activity, demonstrating that an attacker can snatch the very evidence of their own intrusion out of message buffers before it is securely recorded. Finally, we present KennyLoggings, the first kernel-based tamper evident logging scheme that cryptographically secures event records at the moment of the event’s occurrence. We demonstrate that our systems are practical and impose modest (< 10%) costs to the operating system, while being able to detect violations even in the presence of powerful distributed adversaries. More generally, the systems presented in this thesis dramatically mitigate the threat of a covert anti-forensic attacker, enabling analysts to inspect a verifiable chain of custody for forensic data. Thus, this thesis demonstrates a viable path forward to achieving trustworthy foundations for operating system forensics.","Submission published under a 24 month embargo labeled 'Closed Access', the embargo will last until 2021-08-01","The student, Riccardo Paccagnella, accepted the attached license on 2019-07-12 at 10:57.","The student, Riccardo Paccagnella, submitted this Thesis for approval on 2019-07-12 at 11:11.","This Thesis was approved for publication on 2019-07-12 at 16:45.","DSpace SAF Submission Ingestion Package generated from Vireo submission #14300 on 2019-11-26 at 14:04:14","Made available in DSpace on 2019-11-26T20:59:48Z (GMT). No. of bitstreams: 2 PACCAGNELLA-THESIS-2019.pdf: 892535 bytes, checksum: f3d9f59b6d5c5551df9afa797d322349 (MD5) LICENSE.txt: 4217 bytes, checksum: 0c2dfa06c97a45cc30c4cfcdef7e316d (MD5) Previous issue date: 2019-07-12","Embargo set by: Seth Robbins for item 113093 Lift date: 2021-11-26T20:59:54Z Reason: Author requested closed access (OA after 2yrs) in Vireo ETD system","Embargoed Restriction set for Item 113093 on 2020-02-10T22:07:17Z with date 2021-11-26 by fschaef2@illinois.edu.","Embargoed Restriction set for Item 113093 on 2020-02-10T22:07:20Z with date 2021-11-26 by fschaef2@illinois.edu.","Embargoed Restriction Lifted for Item 113093 on 2021-11-26T10:15:26Z."]},{"key":"dc:format","label":"Dc Format","values":["application/pdf"]},{"key":"dc:title","label":"Title","values":["Towards trustworthy foundations for operating system Forensics"]}]}],"canonical_facts":{"dc:contributor":["Bates, Adam M"],"dc:creator":["Paccagnella, Riccardo"],"dc:date":["2019-11-26T20:59:48Z","2021-11-26T10:15:26Z","2019-07-12","2019-08"],"dc:description":["System logging is an essential component of building and maintaining secure systems. Unfortunately, attackers regularly engage in anti-forensic activities after a break-in, covering their tracks from system logs in order to frustrate the efforts of investigators. In response to this threat, a variety of secure logging solutions have appeared in the industry and the literature that attempt to provide tamper-resistance (e.g., Write-Once-Read-Many drives, remote storage servers) or tamper-evidence (e.g., cryptographic integrity proofs) for system logs. However, these approaches have not seen widespread adoption and moreover do not address the operational requirements of system-layer auditing frameworks. As such, the vast majority of system logs today remain vulnerable to adversarial tampering and removal. In this thesis, we revisit the goal of secure logging within the context of standard operating system abstractions. We introduce Custos, a comprehensive framework for the detection and prevention of tampering in system logs. Custos enables real-time detection of log integrity violations within an enterprise-class network while being minimally invasive to the underlying logging framework. Next, we present and validate an in-memory attack on the integrity of auditing frameworks. Our attack exploits the intrinsically asynchronous nature of I/O and IPC activity, demonstrating that an attacker can snatch the very evidence of their own intrusion out of message buffers before it is securely recorded. Finally, we present KennyLoggings, the first kernel-based tamper evident logging scheme that cryptographically secures event records at the moment of the event’s occurrence. We demonstrate that our systems are practical and impose modest (< 10%) costs to the operating system, while being able to detect violations even in the presence of powerful distributed adversaries. More generally, the systems presented in this thesis dramatically mitigate the threat of a covert anti-forensic attacker, enabling analysts to inspect a verifiable chain of custody for forensic data. Thus, this thesis demonstrates a viable path forward to achieving trustworthy foundations for operating system forensics.","Submission published under a 24 month embargo labeled 'Closed Access', the embargo will last until 2021-08-01","The student, Riccardo Paccagnella, accepted the attached license on 2019-07-12 at 10:57.","The student, Riccardo Paccagnella, submitted this Thesis for approval on 2019-07-12 at 11:11.","This Thesis was approved for publication on 2019-07-12 at 16:45.","DSpace SAF Submission Ingestion Package generated from Vireo submission #14300 on 2019-11-26 at 14:04:14","Made available in DSpace on 2019-11-26T20:59:48Z (GMT). No. of bitstreams: 2 PACCAGNELLA-THESIS-2019.pdf: 892535 bytes, checksum: f3d9f59b6d5c5551df9afa797d322349 (MD5) LICENSE.txt: 4217 bytes, checksum: 0c2dfa06c97a45cc30c4cfcdef7e316d (MD5) Previous issue date: 2019-07-12","Embargo set by: Seth Robbins for item 113093 Lift date: 2021-11-26T20:59:54Z Reason: Author requested closed access (OA after 2yrs) in Vireo ETD system","Embargoed Restriction set for Item 113093 on 2020-02-10T22:07:17Z with date 2021-11-26 by fschaef2@illinois.edu.","Embargoed Restriction set for Item 113093 on 2020-02-10T22:07:20Z with date 2021-11-26 by fschaef2@illinois.edu.","Embargoed Restriction Lifted for Item 113093 on 2021-11-26T10:15:26Z."],"dc:format":["application/pdf"],"dc:identifier":["http://hdl.handle.net/2142/105946"],"dc:language":["en"],"dc:rights":["Copyright 2019 Riccardo Paccagnella"],"dc:subject":["operating systems","forensics","secure logging","audit logs","system auditing framework","tamper-evident logging","kernel race condition","asynchronous logging","forward integrity"],"dc:title":["Towards trustworthy foundations for operating system Forensics"],"dc:type":["text"],"thesis:degree_discipline":["Computer Science"],"thesis:degree_level":["Thesis"],"thesis:degree_name":["M.S."],"thesis:institution_name":["University of Illinois at Urbana-Champaign"]},"updated_at":"2026-07-22T22:24:45Z"}