Phase 5 – Covering your tracks – Clearing logs and evidence

So, why do we clear our tracks?

First, we want to remain obscure. We don't want somebody knowing that we've gotten into the system. Otherwise, all our hard work has gone to waste.

Second, we want to avoid tracebacks. This is where the victim hires a forensic expert to figure out exactly what happened. Back in the day when I had my own internet service provider (ISP) service, I had a customer who was complaining he wasn't getting the speeds he was paying for. Together with one of my friends, a white hat from Microsoft and author of several security and integrated security system (ISS) books, we saw something going on with this customer's antenna. We discovered the customer had plugged the internet connection directly into his company laptop without going through a router, and he got totally pwned. We found out the reason he wasn't getting the speeds is because somebody had uploaded...