Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote -1 down vote favorite

Is it possible to use information in an access log to identify the true identity of an impostor who has acquired unauthorized access to a computing system (Perhaps by combining several different pieces of information )?

share|improve this question
Well that kind of "use information" do you have in the access log? You most likely won't be able to do it though without requiring the use of the authorities. Unless the "imposter" was pretty stupid. – Austin Oct 13 '12 at 11:24
1  
You haven't given us much information. What OS? What login service? What log format? What kind of breach? – Polynomial Oct 13 '12 at 11:53
1  
I could write a book on the subject. We need specifics, otherwise this question would be closed. – Polynomial Oct 13 '12 at 14:24
@Polynomial I am using LAMP, I can log any log-able data if they help to detect impostor – PHPst Oct 13 '12 at 14:29
How do you believe that the unauthorized person accessed the system? Can you trace the userID that you suspected was used to an IP address that userID would not normally use? – HeatfanJohn Oct 13 '12 at 20:47
show 1 more comment

3 Answers

up vote 2 down vote accepted

I'd say the answer is possibly. As you have a web server (LAMP stack comment) you have access to the web server logs, so you could log quite a bit of information about visitors to the site, and you might be able to use that to specifically identify someone visiting the site regardless of who they log in as

If you look at something like panopticlick

If you then have access to the client systems of the potential imposter you could use the browser fingerprint to provide evidence that it was them who accessed the system.

Of course if you have a clever attacker they may take steps to foil this approach (anonymising their browser, changing systems etc)

share|improve this answer
up vote 2 down vote

You will be able to log IP addresses, but this is far from "true identity", since one can use proxies, chain shells and so on. Most likely the answer to your question is "no"

share|improve this answer
up vote 1 down vote

Theoretically, the system will not be able to detect unauthorized access, as a false authentication must have taken place first. If it could, there wouldn't be any impostors. How a specific system deals with logging is different in each case. Most, I guess, will log IP addresses, but more detailed information is hard to log.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.