I feel like there should be some way to verify that logs have not been tampered with. For example, including a checksum of the file up until that point on each line. Unfortunately they could just be rewritten after the log has changed. The only real solution I can see is a dedicated logging server, giving true write-only or append-only access.

As far back as the 90's, I remember the log cleaners would only clean what they touched, so say utmp, read the structure and find all the time the user logged in and remove only this records. This one is wiping everything, you will know your logs have been tampered with, you won't have any logs. lol

> The only real solution I can see is a dedicated logging server, giving true write-only or append-only access.

Yup. It's not that hard to setup, and while running it in a VM isn't as secure as can be, it's still a step in the right direction.

systemd's journal does this:

https://lwn.net/Articles/512895/

But only every ~15 minutes or so.

Yeah, the entire script is horrifying. It's been a long time since I've seen malware source, especially targeting *nix.

Yes, among other lines:

   system 'find / -name *.bash_history -exec rm -rf {} \;';
   system 'find / -name "log*" -exec rm -rf {} \;';
   system 'find / -name *.log -exec rm -rf {} \;';

Not very subtle.