False Sense of Security

OSS can be great... sometimes. Other times it can produce some fairly terrible things, like this (taken from the now defunct GNU.Free project, laughably labeled at a 1.9 release) that only serve to act as security snake-oil:

/**
* Implements the org.apache.log4j.Appender interface to provide a secure
* addition to GNU.FREE logging.

*

* This class creates a chain of Message Digests, so that the every log entry creates a
* digest of itself with the previous entry. Thus altering the log would result in it
* being inconsistent with the digests unless the entire log was edited.
*
* @version 0.1  11 April 2001
* @author Jason Kitcat
* @since 1.6
*/
public class SecureAppender implements Appender {

private String previous_string;
private String name;

public SecureAppender(String previous_val) {

  super();
  previous_string = previous_val; // prime previous_string val

}

public void doAppend(LoggingEvent le) {
  try {
    FileWriter out = new FileWriter("erserver.sec.log", true);

    out.write(AuthSys.makeDigest(le.message + previous_string) + "\r\n");
    out.close();

    previous_string = le.message;
  } catch (Exception e) {
  }
} //EOF doAppend

// other methods removed for clarity
}

Oh dear. Where shall we start? Major points first:

1. The implementation is wrong. You need only alter the digest of the entry you've changed and the subsequent digest. I suspect the doAppend method was meant to look like:

public void doAppend(LoggingEvent le) {
 try {
   FileWriter out = new FileWriter("erserver.sec.log", true);

   string digest = AuthSys.makeDigest(le.message + previous_digest);

   out.write(digest + "\r\n");
   out.close();

   previous_digest = digest;
 } catch (Exception e) {
 }
} //EOF doAppend

2. The clear text log and the digest log are on the same machine, worse still in the same directory. If the clear text and the digests are on the same machine just forget about it. Anything like this is just wasting CPU cycles.

Minor stuff now:

3. Where the heck do the exceptions go when you can't write the event? Nowhere, which is bad practice in my codebook.

Just give it up. This sort of thing isn't simple, there's no hashing Holy Grail to solve these kinds of problems, the real solutions rely on defense in depth which involves separate logs on separate systems behind layers of security that you can't squeeze a gnat through.