Print-Time Audit-Log Integrity Below the Operating System
An audit log is written by the very host an attacker sets out to compromise. Between the instant a record is produced and the instant it becomes immutable lies a race window in which a host-root adversary can delete or rewrite it, and the forensic record is exactly what the attacker edits first. Tamper-evident logging...