Tag Info

Hot answers tagged

15

How secure is the data in a encrypted NTFS folder on Windows (XP, 7)? What is EFS? Folders on NTFS are encrypted with a specalized subset of NTFS called Encrypting File System(EFS). EFS is a file level encryption within NTFS. The folder is actually a specalized type of file which applies the same key to all files within the folder. NTFS on disk format ...


12

It's possible to use Group Policies to hide specific drives in My computer, windows explorer and similar file browsing mechanisms (Microsoft article on it here). It's been a while since I've seen this implemented, but back then there was usually a way around the restriction, so this kind of control would prevent casual access, but wouldn't stop a determined ...


12

When you copy a file to a different filesystem, what's going on under the hood is that a you create a new file and copy the contents. Moving a file to a different filesystem is done by copying then removing the source. So you have no more privileges when copying a file than at any other time you're creating a file. When you create a file, it belongs to you. ...


11

If I have root on a system and really want to hide a file, the obvious answer is a rootkit, which can hide any files I want from almost all detection, by hooking filesystem reads etc. Rootkits are incredibly hard to find in a normal working environment, as you can't trust anything the OS reports. If you have Tripwire on a system, working correctly and ...


10

First a bit of background; Truecrypt uses a classic 2-stage approach: There is a small volume header, which the end user can decrypt with his password. Inside this header there is a master encryption key, which is the one Truecrypt uses to encrypt and decrypt the main user data volume. So your task right now is to recover or re-create the original volume ...


10

The right way to "wipe out" data is to use encryption: never let unencrypted data ever hit the disk. If you do that, then destroying the decryption key is sufficient to destroy the data. The decryption key is small and in many case you can keep it in RAM only (e.g. you type it upon boot, as a "password", which really means "a key that a human remembers"); if ...


9

Forgive me, but the #1 solution for a real-time dependent system is to not let undesignated junk run on it. Users shouldn't be browsing the Internet with an RTOS setup. That needs to stop yesterday. At least in good theory, Deep Freeze type systems will protect your computer from any permanent modification. They intercept all write activity and remap it. ...


9

See SSD (Flash Memory) security when data is encrypted in place and watch the discussion links on hard drives. On older drives, it was likely possible to recover overwritten data. The density of modern drives for the past 5+ (and the plus may be 10, 15, or more) years has been so high that a single pass of random data means whatever was there before is just ...


9

how can a bad guy recover data that's been overwritten just once, since it would change the reflective or height of the gap? There are three basic methods: multiple copies, error correction, and enhanced detection. A hard disk, or CD-ROM for that matter contains a filesystem. A filesystem is an organization of files in a way that makes sense to the ...


8

A solution, which may be outwith scope here but could be useful if the code is that valuable, is to only allow the user a thin client (I'm thinking Citrix or similar) so they never actually run the code locally, only see screen views and output. It has a range of other useful benefits as well, not just limiting the movement of sensitive information, but ...


8

Files always have a owner-id and a group-id. But if the files are copied from another system (e. g. extracted from a tar archive), there may be no name assigned to those ids. At a later time a new user or group may be created which gets the next available id. This id, however, may be the same id as the one used improperly before. As a result the new ...


7

You are correct, in order for a file to be deleted the actual disk blocks it previously inhabited must be overwritten. This is generally done with random data; for example, the Windows tool 'cipher' overwrites unused (e.g., formerly used) disk space with 0s, then 1s, and then random data. If a forensic investigator were to look at your computer's disk, and ...


7

Yes - live booting via removable media can enable the adversary access (read-only or read-write, depending on drivers) to the local HD. Without going into too many details, an OS can only provide protection while it's loaded. So if you bypass the OS, then the data is not protected. With that said, you can protect against this type of situation by ...


7

The problem with deleting files is that the file data is just one small part of what really gets saved onto your disk. On a modern filesystem there will be lots of metadata and other artefacts scattered around the disk: Journal entries on journalling filesystems, e.g. NTFS, ext3, ext4. Search index entries. Prefetch / superfetch cache entries. Shadow ...


7

Create a new user. Give that user access rights to only the folders you want to share. You can use the File and Folder Permission options on Windows, and simple chmod on Linux. Run your application (Dropbox, for example) under that user. You can use runas on Windows, and sudo -u on Linux. Please note that you might have to allow access to other folders ...


6

I agree with the Rorys. It's very difficult to allow someone to execute or read data without at the same time giving them the ability (either inherently or through user-implemented means) to copy it out. Physical access especially breaks most security measures short of at-rest encryption. That said, the suggestions of using Group Policies and/or Thin ...


6

Generally the best practice for web site permissions are to give the web user, in your case www-data, read, but not write, access to the data files. That is, something similar to: chown root:www-data -R /var/www/html find /var/www/html -type d -exec chmod 750 {} \; find /var/www/html -type f -exec chmod 640 {} \; The goal is to allow the web server ...


6

You could create big files until the disk is full. Something like this: dd if=/dev/zero bs=8192 of=junkfile # ... wait for the disk to fill up, at which point this command exits sync rm junkfile The sync command makes sure that all the zeros in the new file make it to the disk. Then, the rm gives you back your disk space. You should run these commands as ...


6

Sounds like a fun project. I know you said "simple," but here are my thoughts anyway. The data you're writing the file over with isn't random, and one pass will still leave traces of the original data. It depends on the storage medium. For example, with magnetic devices, there's magnetic force microscopy. Even after ten rounds of the same thing, I'm not ...


6

The short answer is simply: Yes. The longer answer, however, is much more fun. The specifics of how the raw data can be obtained is dependent on your specific infrastructure. First let's take a gander at Linux. Raw Data Exfiltration in Linux There is an excellent tool for Linux called 'dd'. It is a program that reads whatever input you specify and makes a ...


5

See How can files be deleted in a HIPAA-compliant way? For OS X, the system includes a way to wipe all free space in the Disk Utility program, but that does not take care of slack space (the space between the end of a file and the end of its block). BCWipe can take care of slack space. HFS+ reserves chains of filesystem space before writes in order to ...


5

Eric Filiol's paper Metamorphism, Formal Grammars and Undecidable Code Mutation pretty much shows that it can be made impossible for a virus to know if a metamorphosed copy of itself has infected a file. Sic transit gloria anti-virus.


5

There are pieces of software that prevent you from using the usb ports like Pointsec except if you have a "trusted" usb device. In case some people still need USB drives. But as many of us will agree, there is nothing better than to spray epoxy in your usb ports.


5

This idea is in no way specific to web browsers. You could make the same argument that every application the user runs deserves to have its own segregated user ID under which to run. Yes, some measure of security would arguably be gained by doing this because (for example) the malicious music player running in the same desktop session couldn't access the ...


5

What you're thinking of is mandatory access control enforced on applications. This is still developing in the consumer OS space, but here are some examples of this thinking: Qubes (uses VM containers) AppArmor SELinux Windows does have a context based system of Mandatory Integrity Control, it doesn't differentiate access between applications of the same ...


5

if the hard drive stolen and cross OS are two different condition! If stolen, mounted in another host, all permissions are compromised, everybody could be root in his host and mount hard-drive (maybe externaly by USB - Sata changer) with all needed rights. For this condition, (strong) encryption are the only way. About cross OS, if drive stay mounted in a ...


5

If the encryption software stores meta-data or other (unencrypted) signatures/magic-numbers, or verifiable structures, then these can be used for identification of course — but, since this gives the game away in a sense, you'll find that the better ones explicitly do not, e.g. from the Truecrypt volume format specification: TrueCrypt volumes have no ...



Only top voted, non community-wiki answers of a minimum length are eligible