Covering Tracks
A detected attack is one that can be stopped, which is not a good result for an attacker. To stop an attack from being detected, attackers often make efforts to cover their tracks as completely and effectively as possible. To be successful, this must be a systematic process in which any evidence of the attack is erased. Such evidence includes logins, log files, error messages, files, and any other evidence that may tip off the system managers that something nefarious has occurred.
Disabling Auditing
One of the best ways attackers can cover their tracks is not to leave any in the first place. Disabling auditing is a way to do just that. Auditing is designed to allow the detection and tracking of events that are occurring on a ...
Get Ethical Hacking: Techniques, Tools, and Countermeasures, 4th Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
