Printable View
Where can these log files be found? Suppose i have remote access to a computer at a local business office. I use this for storage purposes. Lets say I accidently send something to that computer, realize it was the wrong thing, and delete it. Where are the log files that show what has happened?
I dunno..... This post just doesn't seem right..... Is your remote access legal?
Suppose you learned some social engineering skills...
anyway....
hows the connect? FTP?
c:\winnt\system32\logfiles\.....
web access is here too...
So you have remote access to a local business where you use a computer to store info.
So, unless you are working on top secret government work, why do you care what shows in the log once you delete it?
Can you provide a little background?
One would really have to know that system inside out before anyone can answer you that. I once caught a hacker with a software called marketPro, which I used for marketing purposes and even had forgot it existed on that server. He was very good at deleting all his logged activities but he was being logged by a stand alone application.
No offence to you, Spydrpop, but I strongly agree with the other members... That does sound fishy, perhaps too much to be legal. Are you saying the machine you're trying to access is running WinXP? And what application are you using to connect? Amnesiac is right - most stand-alone applications have their own set of logs.
But anyway - you'll have to make your case more worthy. "Say/Suppose that" is not enough :)
It amazes me that you all simply won't help him. By basing whether you will provide information or not on the assumption that his words "add up" to you is horrid. A small SE trick and you all would be giving the next bank robber full information to a security system if he sounded "legal". In the same sense, a legit network admin looking to secure his own network could be rejected because he isn't nearly as skilled with words as he is computers... and you would reject him.
So, in the light of what I like to call "knowledge", I'll help him. It isn't our choice to stop or hinder him because we can't trust ASCII text on a website, it's our knowledge that we are meant to share, and his choice to decide how to use it.
What transfer system was used? What protocol did you use? What system is the main computer? When was the last access made?
Answer me that, and I can begin to give you a pinpoint and exact answer.
What transfer system was used? What protocol did you use? What system is the main computer? When was the last access made?
FlashFXP, FTP, WinXP, A few hours ago.
In relation to all other posts, I just want to know where winxp/2k logfiles are stored...not that 'fishy' of a question...
I hate to tell you this, but Windows keeps very very few log files. I doubt there will be a log to file changing references, but the FTP server should also have it's own logs. This is what you need to do:
1. You need to physically be at the computer in question
2. Start button > settings > control panel > Administrative Controls > Event Viewer
Within the event viewer are 3 logs, ranging from system errors to program errors. While it may not have the logs you are looking for, these are the only logs the Windows XP/2k system makes on it's own.
Pooh's right -- you're best bet is the Event Viewer. However, it's unlikely that even that will have logged what you're looking for. You're probably out of luck with that. How handy it would be if there were more comprehensive logs!
Pooh:
If the FTP he referenced was Windows own FTP then the files will be found in %sysyem root%\logfiles\ftp-something or other.... (it's late...ok ;))
At the same time - I go back to my original statement..... The question was badly put, no further information of use has been offered but statements like "a few hours ago" coupled with "I just want to know where...." when the original question is two days old doesn't make me feel good about the author.....
Spydrpop: With luck you don't have the rights required to access the logfiles.... If your access is illegal that will serve you right and I hope you get caught. If your access is legal then I apologize but still question what it was you put there that you want no evidence of..... Finally, if you want to ask questions either learn to "couch" them in a non-conspiratorial fashion or ask them somewhere else. I only supplied my answer to your problem for future, legal users, rather than let them be led down a different path.
Pooh: In response to your comments made privately you stated that I "badgered someone for their grammatical skills". I didn't mention grammar at all. I pointed out that the question was badly put. Grammar is irrelevant, (and I had no problem with his grammar). The question came with no reasoning as to why or what, simply that the location of the logfiles was required because he had clearly done something he wasn't proud of, (whatever that might be). Had it been an honest mistake, (put the wrong clients fiscal data on this machine for example), then to have said so would have gone a long way to assauging my suspicious mind. As it was he made that post around 1:30 on 3/8. He then comes back 24 hours later and states that the "deed" took place a "few hours ago"..... Hmmm..... Let me see..... most people would have said "yesterday" or "the day before yesterday" had the deed taken place prior to the initial post. The implication is that he came looking to see what would be required to cover his tracks in a situation that was still being planned. He may have thought he had the information required and gone ahead only to find that the information provided, (a result of his lack of information), was not what he needed and has now returned hoping to find the "key" by providing information that will elicit a satisfactory result.
So, as you can see I do not "trust people alone based on ASCII text". Far from it. I look at each post, I look at the posting history if I think I need to. I look at their profile and then determine whether or not I will try to get some more information which is what my original post was intended to do. If a response was got I would then look at the consistency of the statements in comparison with other posts in the thread and in the profile to determine whether or not I should provide any information I have that might be of use.
Am I immune from being "socially engineered"..... <ROFLMAO> Of course not. Do I try to ensure that I am not becoming an accomplice in a crime? You bet your sweet A$$ I do. If you look through my posting history you will find many occasions where I have jumped in and stated that "so-and-so" should be helped not castigated for a badly put question or whatever but that is because on balance they do not appear to be attempting something "bad".
Pooh, you have no idea how close that is to what I have told others here in the situations I mention above.... It's almost word for word.Quote:
This is a forum about security, not a forum about elitist one-sided security
But, a word to the wise..... The most important thing you can possess in this field is a healthy yet oversized suspicion gland. Without it you will dismiss some little detail with a half-assed "logical reason" when it really is the little red flag you should be acting upon.
Lastly, security is absolutely "one-sided". The bad guys aren't into security. They specialize in _In_security. The two are mutually exclusive. The best security people have an understanding of the other "teams" speciality and visca-versa.
Who are you to dare badger the other side? Whitehats, blackhats, they both need each other. If it were not for the continually skills and tests of blackhats, whitehats would have no idea what they would need to be defending, and the number of security patches would be down.
So tell me this, would you rather have the exploits found by others kept secret so that whitehats could never learn how insecure they really are (not like they can figure it out), or would it be better to the entire security community as a whole, to let them do their job so whitehats can do their own jobs.
You can't honestly say that without exploitation testing by black/grey hats, that the world would be a better/secure place? I've personally submitted plenty of exploits to BugTraq because I understand the value of greyhat penetration testing. Without someone having that curiosity to exploit/test, there would be no word of the exploits avaliable for you to do your job. Without someone having that curiosity and then publishing it, the information and exploit would stay underground, leaving you vunerable to exploits you would never have known existed as a whitehat. And yes, I know you in short agreed with what I just said from your previous post.
So, instead of asking outright "are you legit"... try to help him. He is going to get the information whether you help him or not, thus -- If you refuse to help him, leave him alone. Brings up a saying my father told me all during my teenage years : "If you can not help someone, do not choose to hurt them instead"
End of story. Show respect for the side of people that help you get your job done :)
pooh sun tzu, that is circular logic. In other words, you are saying that if it wasn't for the crooks and murderers, than cops wouldn't be able to do their jobs. And the bad guys help the good guys to catch the bad guys who help the good guys catch the bad guys, who help................Quote:
Who are you to dare badger the other side? Whitehats, blackhats, they both need each other. If it were not for the continually skills and tests of blackhats, whitehats would have no idea what they would need to be defending, and the number of security patches would be down.
I aggree that preknowledge of an exploit will allow for security to defend against it, but to publish the exploit for some skiddie to use, so that you can justify your job is slightly over the top.
Pooh:
It's my JOB to badger, harass, be deceptive with, deny information to and generally make thier lives as difficult as possible. I don't give a rats ass if it makes their little lives problematic... I could care less if their little bottom lip curls and the pitch a bitch fit..... In fact it's my aim in life These liitle monkeys are little short of cyber terrorists and we have seen what happens when you don't make terrorists lives difficult. It's no different in our virtual world.Quote:
Who are you to dare badger the other side?
Pooh, gimme a break..... If Spy is malicious he's not someone who is teaching me anything. He doesn't know where to find the goddamn log files.... Yeah, he's l337 :rolleyes:. More likely, (should he be malicious), that he is one of the little monkeys I refer to above that wants to be l337 but doesn't have a clue. (NOTE: I am not making judgement on Spy himself at this point).Quote:
So tell me this, would you rather have the exploits found by others kept secret
I don't say that. I agree. But you are utterly out of context. When a know-nothing script kiddie comes here asking how to cover his tracks after his successful "sploit" we aren't talking about a blackhat hacker/cracker. We are talking about a malicious little child who is too lazy or too stupid to be able to research the subject for themselves so they come here hoping for the "quick fix". It pleasures me no end to send them away without the information because, in my mind I'm hoping that the admin who let them in, (and let's be honest here - if the kiddie can get in then the admin was not paying proper attention), is smart enough to realize he's been hacked and catches the perpetrator because the log files are still intact......Quote:
You can't honestly say that without exploitation testing by black/grey hats, that the world would be a better/secure place?
The best way I can help him is to not provide him with the information. If I give it to him this time he may get away with it and take on a bigger target with an admin that isn't as lax as the first. Then he goes to jail. How did I help him by making him think he is l337? Go back through my posting history..... You will find occasions where I, and others, have discussed the ethics of what they want to do and they have stated that we have changed their minds about their plans.... Can one truly believe them? No..... But making them at least think about it is much closer to helping them!!!!!!Quote:
try to help him.
Pooh.... If you attack, or intend to attack, myself, my family, my friends or my community you had better be prepared to deal with me if I find out about it. Anyone who partakes of mailicious activity, especially the kiddies who are really only preying on the most helpless, will be treated with utter contempt, will receive no assistance from me and if I can assist in harming them, (getting them in trouble with law enforcement), I will. It's really that simple.Quote:
"If you can not help someone, do not choose to hurt them instead"
If you are so keen on the free passage of information perhaps you would like to post your network's architecture, IP address range, implemented security systems etc. here for all of us to see. What, you won't! Why Pooh? Because it is a preposterous suggestion isn't it? But why is it any more preposterous than telling a know-nothing skiddie who is just a hair away from being caught because he didn't think things through properly how to get himself out of trouble????????
Freedom of and exchange of information is fine in most businesses. But not in security. The truly talented malicious crackers out there don't publish their findings.... They call them "zero-days" and use them against their victims. You seem to see them as some kind of knights in slightly tarnished armour. They aren't, and the sooner you understand that the better. They are the enemy and need to be treated as such lest they chose you next. They won't come nicely from the front, Pooh..... They will sneak up behind you and "stab you in the back" smiling all the while, because that's who they are.
OK, I read and read and read, but never post here........ but you guys
Why do you insist that every time someone doent word a question perfectly, you tear into them like they are a criminal....... I know spydrpop, and I know that he is always trying to learn new things about comps..... and im pretty certian that this is for his knowledge/legitimate uses
why do you guys always have to be elitists that are so judgemental....... its not too becoming
I only found one person who thinks right, poo sun tzu.
**puts on flame retardant suit**
Tiger, I've now lost all respect for you, because you have taken this down to insults.
That is, if you can see it happening right?Quote:
Pooh.... If you attack, or intend to attack, myself, my family, my friends or my community you had better be prepared to deal with me if I find out about it.
Yes, I will. In fact, that involved every single aspect of my security XP testing. Sorry, you missed out. All information, IP, network usage, and etc was disclosed and released.Quote:
If you are so keen on the free passage of information perhaps you would like to post your network's architecture, IP address range, implemented security systems etc. here for all of us to see. What, you won't!
Not a preposerous suggestion at all. As I said above, already did what you have asked. And while no one was able to break in, the reports and logs from their activities has made me a better admin because of it.Quote:
Why Pooh? Because it is a preposterous suggestion isn't it? But why is it any more preposterous than telling a know-nothing skiddie who is just a hair away from being caught because he didn't think things through properly how to get himself out of trouble????????
This is where our little friendship ends. Sounds like you were burnt once, and that's too bad. But don't dare slap a lable across us other greyhats because you had a bad runin with a blackhat. For the same reason I won't say each and every whitehat is a snob that only reads the information grey/blackhats release later on, is the same reason you can not preassume the situation/intentions of each other hacker. That is NOT 'who they are'. Take your anger and frustration elsewhere, and next time you check BugTraq and the CERTS read the latest headline for a patch that needs to be placed ASAP, remember that it wasn't a whitehat who discovered it, it was a greyhat who discovered it and published it/and or/ patched a release for it.Quote:
Freedom of and exchange of information is fine in most businesses. But not in security. The truly talented malicious crackers out there don't publish their findings.... They call them "zero-days" and use them against their victims. You seem to see them as some kind of knights in slightly tarnished armour. They aren't, and the sooner you understand that the better. They are the enemy and need to be treated as such lest they chose you next. They won't come nicely from the front, Pooh..... They will sneak up behind you and "stab you in the back" smiling all the while, because that's who they are.
So wasn't there actually a security topic being discussed here at some point, prior to it becoming a philosophy class? :)
Knock it off guys, you can speculate intentions all day and get nowhere. Until someone around here becomes a mind-reader it's not going to be anything more. Don't give away too much info to make someone dangerous, and beyond that, just deal with the topic on hand.
whyjnot: Elitist has nothing to do with it.
If someone comes to you asking for the pin to your bank card with no explanation would you give it? Of course not! You probably shouldn't if they give an explanation but that's a whole other thread, ;). The point is that without making me feel all "warm and fuzzy" about your intent I may be giving you information that you are going to use against me in the near future.
Helping people is all fine and dandy. Helping people who you think may be doing illegal things is not the right thing to do. It's a moral issue not an "I'm better than you issue" and it's always better to err on the side of caution where security is concerned.
Tiger Shark: the elist part was taling about other threads that I have seen where the senior members/members basically crap on people that have less expierance than them
Pooh: I don't see any insult, nor did I intend to insult you or anyone else. If I did I apologize.
I haven't been "burned".... I haven't been hacked ever.... to my knowledge..... :eek:
Let me clarify my position a little here......... There are three kinds of "hats":-
1. Whitehats
2. Greyhats
3. Blackhats.
Whitehats are the good guys.... They are the ones that work on security, for security from the defender's point of view. I have nothing to fear from them.
Greyhats are the ones who work on security, for security from an attackers point of view. They warn the vendor, publish their results and suggest methods of mitigation until the patches arrive. I have nothing to fear from them.
Blackhats are a different breed altogether. They work on security for _in_security from an attackers point of view. They do not warn the vendors, publish their results or do anything else beneficial other than the eventual benefit that thier work is uncovered, analyzed and published by the other "hats" _or_ they "publish" their "results" into the malicious world to be used by others with malicious intent against those who do not know how to protect themselves. I have something to fear from these people. Their intent is self serving. Whatever their eventual goal is they move forward trashing systems, lives etc. with no regard for the rule of law or even civil behaviour. When they are done they let the less talented use their knowledge in handy dandy little packages, (scripts etc.), to unleashed their particular brand of mayhem upon others.
I fail to understand what you don't see here. People who maliciously attack others be it physically or virtually are criminals yet you are supporting them as I said in my previous post like they are some kind of "knights in slightly tainted armour". There is nothing honorable about them or their intentions. They are there for personal gain, (whatever they see that as), regardless of the cost to others.
You will note that throughout this exchange I have maintained a single thread.... the concept of malicious behaviour. This isn't a fun thing, nor is it an acceptable thing. It is behaviour designed to harm others. Sorry, but in my code of ethics that is unacceptable. I see myself as someone better able to protect myself, (both physically and virtually), than your average Joe on the street and, as such, have always "championed the underdog" both physically and in the virtual world. I am capable, (physically and virtually), of "picking on" a very large subset of the population just as a thug or a blackhat would do. But I chose not to. The fact is, I chose to use the physical and virtual "power" I have against those people who would harm the less "adept".
Now, maybe, you can see that I'm not picking on you for being a grey hat. Now, maybe, You can better understand the way _I_ see the world and understand that it is not unbalanced and is not based in anger or in frustration. I tend not to get angry - it clouds my thinking when I plan my response...... ;).
As to the end of our "friendship".... I wasn't actually aware that we had anything in particular going on.... ;) I don't have a lot of friends because most people simply do not measure up to the standards I set. Having said that I have seen nothing in the past from you that would exclude your from the rather small group I do dub friends. Your choice, I'm not one to force people to do things they don't want.
Accepted.Quote:
Pooh: I don't see any insult, nor did I intend to insult you or anyone else. If I did I apologize.
I said no one here was a blackhat, and thus do not treat new people to the forums as if they are. There is a difference between being silent and learning what kind of person someone may be, and dilberatly asking "what are you why prove it OMFG its illegal are you sure what are you going to do" and shoving them away. The only person I am defending here, is the parent poster, to whom you have somehow seen him to be a blackhat set to place havok across the world. I know you didn't say that, but I'm sure he felt that way. People's responces to anything not 100% whitehat within this forum are automagically flamed, questioned, and treated like a criminal. What a warm welcome into a community that could not only offer that person knowledge, but guide them.Quote:
I fail to understand what you don't see here. People who maliciously attack others be it physically or virtually are criminals yet you are supporting them as I said in my previous post like they are some kind of "knights in slightly tainted armour". There is nothing honorable about them or their intentions. They are there for personal gain, (whatever they see that as), regardless of the cost to others.
Let's ditch the elitism, and get back on the subject, shall we? Subject being, you either help or you don't. Never preassume someone is good or bad because of their ability to type words.Quote:
Sorry, but in my code of ethics that is unacceptable. I see myself as someone better able to protect myself, (both physically and virtually), than your average Joe on the street and, as such, have always "championed the underdog" both physically and in the virtual world. I am capable, (physically and virtually), of "picking on" a very large subset of the population just as a thug or a blackhat would do. But I chose not to. The fact is, I chose to use the physical and virtual "power" I have against those people who would harm the less "adept".
Something clouded it long enough for you to, instead of welcoming this new person who wanted information, treat him as the next possible cyber terrorist. Instead of showing him the ropes, taking a few minutes to hand information along with guidelines, you question as it he was a civilian bomber. Don't ever throw away the opprotunity to help someone rather than hurt. By guiding him and teaching him ethics, you help him build character... and maybe even a future whitehat. Why is this so important? Here is why:Quote:
Now, maybe, you can see that I'm not picking on you for being a grey hat. Now, maybe, You can better understand the way _I_ see the world and understand that it is not unbalanced and is not based in anger or in frustration. I tend not to get angry - it clouds my thinking when I plan my response...... .
BECAUSE HE IS GOING TO GET THE INFORMATION WHETHER YOU HELP HIM OR NOT, SO WHY NOT GIVE IT TO HIM WHILE ALSO TEACHING HIM RIGHT FROM WRONG
I have nothing further to say in this thread.
amen
Pooh: I don't help people that might be about to commit a crime just the same as I won't pick up a gun and hand it to the person walking into the bank who dropped it. They could be a police officer, but until I know that their gun will be stepped on and they have to move me. Make the move to move me and I get pissy..... show me your badge and I'll pick up the gun, hand it to him and ask if there is anything I can do to help.
I don't just blindly give out information. As I said "It's my job" to make those who have malicious intent's lives more difficult, (yours too actually - even as a grey hat otherwise you are approaching that _really_ dark grey that becomes indistinguishable from "light" black...;)). If someone with no malicious intent asks for information that could be used maliciously then they understand when someone asks "why". They only get "put out" if they want the information to do harm in the first place.
You seem to be under the impression that blackhats are all talented individuals that don't need any assistance. I believe you are wrong. "Blackhat" is a statement of intent not of skill. The most clueless skiddie in the world is a blackhat because their _intent_ is malicious. Similarly grey/whitehat is also a statement of intent not skill. There are clueless admins, (Oh Lordy how many there are ;)), that are still whitehats due to their lack of malicious intent.
I've said it before Pooh, and I'll say it again....... It's not the inability to type words that made me question Spy's intent. It was a badly worded post that, when further information was requested, no additional information was forthcoming. That's odd. Things that are "odd" in this business are things that absolutely require questioning. Someone with no malicious intent would not be unhappy revealing some more detail and when they did it would at least be consistent with the initial statement. To be honest, Spy's was sufficiently inconsistent for me to still have doubts about his intent. I am fully aware of the fact I might be wrong but I have to err on the side of caution. That business that he has access too could be my father's.... Think how friggin' silly I'm going to look explaining to Dad that I was the one that helped Spy ruin his business...... :o That's me cut out of what is left of the will for a start.... <LOL>
Finally.......
Pooh, go back and carefully read your posts in this thread, especially those that were directed at Spy. You will note the alarming lack of _any_ counselling with regard to ethics or guidance of any sort from you yet you chose to castigate me because I didn't respond in the same fashion as you. At least my questioning and my statements were clear indicators to Spy that he appears to to have done something bad that is not generally appreciated in the real world or here on AO. Funnily enough, I gave him the answer he probably needed even after my distrust of his motives. So please, don't hold me up as obstructionist and a nasty person when you are saying one thing and doing another. I, at least, am consistent whether or not you like my position.Quote:
By guiding him and teaching him ethics, you help him build character... and maybe even a future whitehat.
Time to get off your high throne. I offer information because I already have information concerning him. Do not dare to assume (you do that a lot) that I did not understand the circumstances. If I had no information (as you did not) then guidelines would have been put in place.Quote:
I, at least, am consistent whether or not you like my position.
Tiger, no one is impressed. You must learn to hesitate in speaking, because you run foward to massive assumptions before you even learn what is going on.
Someone close the thread.
"Nazi's"
There...... The thread has degenerated to the point where this word has been used and the thread is therefore automatically been closed by the invocation of whats-his-names- law.
Happy now..... ;)
PS: If you had information about Spy you could have offered it and saved us all this grief..... and to steal from Major David Stirling "Who dares wins"..... and I shall continue to dare whatever I please whenever I please it.... It's my ass going on the line..... You don't need to worry about it... It has broad shoulders above it too.
Sorry Tiger, I said I would stay out of this but ...... ;)
Take a look in a mirror pooh, I have seen more that one thread from you in which you get into these heated battles and no matter what is said, you always have to be right and the other person has always got to be wrong . Take a pill and calm down there are other people on this board that know what they are talking too.Quote:
Security professionals by their very nature are a paranoid bunch, if your not, your likely not a very good security person. Tiger is paranoid, it seems to have severed him well so far.
Now your jumping to conclusions, I'm impressed! :pQuote:
I don't think that's going to happen, I bet the mod's are getting as much of a chuckle out of this as everyone else is. :DQuote:
Cheers:
You are only paranoid if you do not understand the situation. Learn how a system works, and there is very little to be paranoid over.Quote:
Security professionals by their very nature are a paranoid bunch, if your not, your likely not a very good security person.
Wait, who else is laughing? I'm getting PM's, pos points, and people agreeing with me on the thread in regards to my stance of "helping and guiding" instead of "questioning to death". No, that isn't bragging, but I'm showing you that no one is impressed with his 'paranoia'. He was rude instead of helpful to the parent poster, end of story.Quote:
I bet the mod's are getting as much of a chuckle out of this as everyone else is.
I dont exactly have the time atm to make a long and serious post regarding all of the replies here. But I will say this:
You should not assume that everyone intends to participate in illegal actions based upon what they learn. I intend solely to use this information in a manner suiting to the law of the united states of america. I have no reason to not adhere to the law.
I just wanted information. Information that could have been found on google, *minus the twenty hours or so in finding it*, although that information may or may not be accurate, i was looking more for proffesional opinion.
Your opinion does not need to involve giving any personal background information. Me saying
"Where does Windows store log files?"
Should not be replied to as...well...how it was replied to as. I suppose I should not have included any information regarding my purposes or intent period, as if I would not have done, I may have gotten a more clear, LESS biased answer.
If my assumptions are correct, then Pooh has seen and understood that which I may be trying to do. I have noticed through lurking here, that 1:4 posts that start off nicely, just someone asking a simple question, get turned into, "Your pursuing illegal actions" That of which 99% of us are not. You assume quickly, and incorrectly. Do people a favor by giving them information they want and need. Wanting to know where windows stores log files isa legit question imo and should not have been replied to as such.
However, there are a few people who have seen what I meant and have replied accordingly. I thank you for that.
And to more knowledge questing:
-I looked at my EventViewer and noticed that there IS nothing in the 'Security' section. Would anyone happen to know why this is? Surely windows does log intrustion attempts, portscans, and the like. Or will I have to rely on my firewall logs for that?
-shakes head-Quote:
-I looked at my EventViewer and noticed that there IS nothing in the 'Security' section. Would anyone happen to know why this is? Surely windows does log intrustion attempts, portscans, and the like. Or will I have to rely on my firewall logs for that?
It does not record intrusion attempts, port scans, etc because it is not an IDS nor firewall. AFAIK, a nix based system won't either, since log handling for security is controlled by iptables/chains. However, unlike Windows, nearly every service on a *nix distro has its own log file handling which is sent to /var/log. With Windows, unless you get 3rd party services (ftp, etc) that specifically log activity (apache for example logs proper accesses and failed accesses)... then you are in fact flying blind.
My best recommendation for Windows logs is to make sure the 3rd party program supports it. Now don't think Windows logging in the area I showed you is limited, not at all. You can set group policys and procedures to call certain events to the event/security log. Improper logins, banned accounts, etc etc, can logged so long as you tell it to. But that brings us back to my point, for the -kind- of logs you are looking for, 3rd party logs according to each service is your only hope.
Spy: You need to turn auditing on for any auditing to be done by windows. The Local security policy is the place to do that or the Group policy editor if you are in an AD environment.
Your posts were suspicious by my level of suspicion. It's not a bad thing for me to be suspicious and it's not a bad thing for my suspicion to cause me to ask you questions.... If you have nothing to hide then you will have no problem with the questions.
Pooh: I'm getting Pm's and AP's too.... Funny that isn't it? How there is more than one viewpoint to an issue and people wither agree or don't....... Feel free to do things your way and I'll feel free to do things mine. I will sit comfortably knowing that I haven't helped some clueless skiddie to victimize your granny by giving out information to anyone who asks.
Unless it comes off as rude. This is a forum about knowledge and asking questions, not a "show me some ID"Quote:
If you have nothing to hide then you will have no problem with the questions.
Getting friends to give you AP always helps, I'm sure. You sure won that important argument of the day, I tell you what.Quote:
I'm getting Pm's and AP's too.... Funny that isn't it?
My thanks for looking out for granny. Oh, and remember your granny as well, for the exploit code and revisions passed on via BugTraq and MS Bugtesting, tested by greyhats, so her good old windows computer would be running safe.... didn't come from you nor any other 'paranoid-snobbed-whitehat=user'Quote:
I will sit comfortably knowing that I haven't helped some clueless skiddie to victimize your granny by giving out information to anyone who asks.
As you saw in the last two posts, he does not want your opinion because you were rude. I do not want your opinion because you are ignorant to the larger process. Me and him will continue sharing information, so follow your own words, and sit comfortably instead of typing an argument out.
Pooh:
Ahh.... nice...... Accusing me of an AP alliance...... Time to grow up young man.Quote:
Getting friends to give you AP always helps
You show yourself for what you are pooh...... Your intellect has expired so your insults kick in. While it is a familiar pattern for the inadequate to turn this corner I really did think better of you. I guess I should have realized when you first negged me that this would be the probable outcome. There has been an overwhelming pattern to the private contacts I have had from others regarding you that have proven true. Pooh, is always right. Everyone else is wrong. Pooh always has to have the last word is the general concensus. These are clearly smart people for they have proven themselves to be right. And before you accuse them of being "my friends" again I don't believe I have _ever_ had private contact with any of them previously.Quote:
'paranoid-snobbed-whitehat=user'........ he does not want your opinion because you were rude. I do not want your opinion because you are ignorant to the larger process.....
Now.... The floor is yours to have the last word and tell me just how right you are and how wrong I am...... Then feel free to trot along and not bother me in the future......
You have proven that you do not reach my standards......
Bye now......
Ok guys, I have the end-all solution to this debate at hand: If you're "paranoid", don't answer the question. If you aren't, do answer the question. There ya go!
What Pooh and Tiger have so well demonstrated is that every security guru is going to have his/her own philosophy. Neither point of view is necessarily right or wrong, but comes from the shaping of experience. Despite my own lack of experience thus far, I've had enough to understand both viewpoints. Tiger, keep being paranoid, and Pooh, keep being generous, and as long as you let each other handle things your own way, things'll work without a hitch. Maybe you two are here to balance each other out in some greater AntiOnline fate. ;)
But as long as each of you tries to convince the other to the opposing viewpoint, it'll just go on and on while the rest of us are left asking "What was the question again?"
On another note, it's important for newbies to understand that truth is, more of us are highly paranoid than not, and should learn to expect the sketpical prodding questions without taking it personally. Don't be offended by them, just accept them as normal and keep asking your questions, and learn from what causes the vets to ask these questions in the first place. That is a valuable lesson. I learned that quickly as a newbie, and am actually suprised some of my own questions haven't been scrutinized yet.
AngelicKnight is the standard problem solver. :)
And thank you Pooh for the previous reply.
Pretty serious accusation pooh, and your proof of this is where........................Quote:
Cheers:
Welcome :) Let me know if you need anything elseQuote:
And thank you Pooh for the previous reply.
I feel I have to defend Tiger here, I have only seen Tiger show some serious knowledge about what he is doing. He has my complete respect.Quote:
Getting friends to give you AP always helps, I'm sure. You sure won that important argument of the day, I tell you what.
Not to say I don't respect you pooh, I felt what you did with the Windows "wargame" was pretty neat, and your tut's aren't too shabby either.
About the blackhat whitehat argument, I feel like I side more towards Tiger. I don't feel comfortable helping out someone when instinct tells me their intentions are malicious. Honeypots are used to investigate the 0-day tactics of the blackhat community, and greyhats are there to find them before blackhats do.
Me personally, I couldn't find an exploit with a map. So my arguments don't come with very much credibility. I'm just babbling now.
All done.
Soda
Albeit one of the better pissing contests Ive ever seen...Enough is enough guys. 2 pages ago, you said you were done with this thread. Let it GO already! sheesh
Its way off topic. Chalk me up to paranoid... I wont help a "improperly worded question".
Had he said "Im just curious how I might investigate intrusion attempts on my PC/network, and if I was comprimised, where might I find log files reflecting file transfers..." Or something to THAT affect, it sure works a lot better than his shady-as-hell "Suppose I did this, and then I wanted to do this, and how would one cover that up?" <-- my summary of his original question
YES IT SOUNDS LIKE A PLANNING QUESTION! It screams ANYTHING but help me learn about security. That was my read on it, and that is why (and will ALWAYS generate the same response) it got the response it did. Someone will always help these "eager young minds" to learn. But if it sounds malicious and Im going to be mopping up more "zero-day" activity later... no thank you. Some of us out here actually run businesses off our boxes. We dont want them turned into some kiddys toy.
Now dont bother (any of you) getting all high and mighty on me. The bottom line is I could care LESS about what you all think I SHOULD have replied like. This was my decision, and no one is going to make me less paranoid. I mean come on thats like saying, so? he sounded ok to me. YEp sure... And Mr. Atta was just another passenger on the plane....
Enough said. Like I said, exersize some restraint in telling me how and what to post. responses to this will go undefended, unanswered. Im just feeling the need to get above a pissing contest. Hopefully one of the nice mods will come along, after they are done laughing at a post that turned into a weed, and lock it up.
the logs are stored in three files in xp and 2k:
security:
c:\winnt\system32\config\SecEvent.evt
c:\windows\system32\config\SecEvent.evt
applications:
c:\winnt\system32\config\AppEvent.evt
c:\windows\system32\config\AppEvent.evt
system:
c:\winnt\system32\config\SysEvent.evt
c:\windows\system32\config\SysEvent.evt
**EDIT** got this in reply to the first page, haven't saw the others yet **EDIT**