Hot answers tagged

69

There's an even easier way to bypass the "execute" permission: copy the program into a directory you own and set the "execute" bit. The "execute" permission isn't a security measure. Security is provided at a lower level, with the operating system restricting specific actions. This is done because, on many Unix-like systems (especially in the days of ...


25

You can set the execute bit, but not the read bit, on an executable file. That way, noone will be able to copy the file, but people can execute it anyway. This is quite pointless today, because a) it works for compiled programs only, not with scripts (on most systems); b) these days, with 90% of all unixes being linux, people can copy executables from just ...


21

How secure is the data in a encrypted NTFS folder on Windows (XP, 7)? What is EFS? Folders on NTFS are encrypted with a specalized subset of NTFS called Encrypting File System(EFS). EFS is a file level encryption within NTFS. The folder is actually a specalized type of file which applies the same key to all files within the folder. NTFS on disk format ...


20

First of all (just to be on the safe side) verify the file isn't in the Recycle Bin. If it is, choose Restore and of course shred the recovered file (or maybe you can shred it while inside the Recycle Bin). If the file has been "truly deleted", recover it using an undelete tool such as Piriform's Recuva, then shred it for good. Note (suggested by Chris H): ...


13

When you copy a file to a different filesystem, what's going on under the hood is that a you create a new file and copy the contents. Moving a file to a different filesystem is done by copying then removing the source. So you have no more privileges when copying a file than at any other time you're creating a file. When you create a file, it belongs to you. ...


13

First a bit of background; Truecrypt uses a classic 2-stage approach: There is a small volume header, which the end user can decrypt with his password. Inside this header there is a master encryption key, which is the one Truecrypt uses to encrypt and decrypt the main user data volume. So your task right now is to recover or re-create the original volume ...


13

See SSD (Flash Memory) security when data is encrypted in place and watch the discussion links on hard drives. On older drives, it was likely possible to recover overwritten data. The density of modern drives for the past 5+ (and the plus may be 10, 15, or more) years has been so high that a single pass of random data means whatever was there before is just ...


12

If I have root on a system and really want to hide a file, the obvious answer is a rootkit, which can hide any files I want from almost all detection, by hooking filesystem reads etc. Rootkits are incredibly hard to find in a normal working environment, as you can't trust anything the OS reports. If you have Tripwire on a system, working correctly and ...


12

It's possible to use Group Policies to hide specific drives in My computer, windows explorer and similar file browsing mechanisms (Microsoft article on it here). It's been a while since I've seen this implemented, but back then there was usually a way around the restriction, so this kind of control would prevent casual access, but wouldn't stop a determined ...


12

The problem with deleting files is that the file data is just one small part of what really gets saved onto your disk. On a modern filesystem there will be lots of metadata and other artefacts scattered around the disk: Journal entries on journalling filesystems, e.g. NTFS, ext3, ext4. Search index entries. Prefetch / superfetch cache entries. Shadow ...


11

how can a bad guy recover data that's been overwritten just once, since it would change the reflective or height of the gap? There are three basic methods: multiple copies, error correction, and enhanced detection. A hard disk, or CD-ROM for that matter contains a filesystem. A filesystem is an organization of files in a way that makes sense to the ...


10

Forgive me, but the #1 solution for a real-time dependent system is to not let undesignated junk run on it. Users shouldn't be browsing the Internet with an RTOS setup. That needs to stop yesterday. At least in good theory, Deep Freeze type systems will protect your computer from any permanent modification. They intercept all write activity and remap it. ...


10

The right way to "wipe out" data is to use encryption: never let unencrypted data ever hit the disk. If you do that, then destroying the decryption key is sufficient to destroy the data. The decryption key is small and in many case you can keep it in RAM only (e.g. you type it upon boot, as a "password", which really means "a key that a human remembers"); if ...


10

NTFS sort of does if you include The Encrypting File System as part of it. The Encrypting File System (EFS) on Microsoft Windows is a feature introduced in version 3.0 of NTFS Secure deletion is supported by cipher.exe: You can use the Windows Cipher utility (with the /W option) to wipe free space including that which still contains deleted ...


9

You are correct, in order for a file to be deleted the actual disk blocks it previously inhabited must be overwritten. This is generally done with random data; for example, the Windows tool 'cipher' overwrites unused (e.g., formerly used) disk space with 0s, then 1s, and then random data. If a forensic investigator were to look at your computer's disk, and ...


8

A solution, which may be outwith scope here but could be useful if the code is that valuable, is to only allow the user a thin client (I'm thinking Citrix or similar) so they never actually run the code locally, only see screen views and output. It has a range of other useful benefits as well, not just limiting the movement of sensitive information, but ...


8

Files always have a owner-id and a group-id. But if the files are copied from another system (e. g. extracted from a tar archive), there may be no name assigned to those ids. At a later time a new user or group may be created which gets the next available id. This id, however, may be the same id as the one used improperly before. As a result the new ...


7

If an attacker gained administrator rights, he has direct access to hard drive in your computer and, as a result, he can recover any data from it. Just like "real" administrator. So answer to your question is YES.


7

On the Linux side you can do this kind of monitoring using the auditd subsystem and very cleverly written rules. It can be used to watch for changes to files or directories, entry or exits of system calls, etc.


7

If you're looking for something interactive, and not service-style long-term monitoring software, check out Microsoft's (nee SysInternal) Process Monitor. Very versatile.


7

Yes - live booting via removable media can enable the adversary access (read-only or read-write, depending on drivers) to the local HD. Without going into too many details, an OS can only provide protection while it's loaded. So if you bypass the OS, then the data is not protected. With that said, you can protect against this type of situation by ...


7

This idea is in no way specific to web browsers. You could make the same argument that every application the user runs deserves to have its own segregated user ID under which to run. Yes, some measure of security would arguably be gained by doing this because (for example) the malicious music player running in the same desktop session couldn't access the ...


7

See How can files be deleted in a HIPAA-compliant way? For OS X, the system includes a way to wipe all free space in the Disk Utility program, but that does not take care of slack space (the space between the end of a file and the end of its block). BCWipe can take care of slack space. HFS+ reserves chains of filesystem space before writes in order to ...


7

if the hard drive stolen and cross OS are two different condition! If stolen, mounted in another host, all permissions are compromised, everybody could be root in his host and mount hard-drive (maybe externaly by USB - Sata changer) with all needed rights. For this condition, (strong) encryption are the only way. About cross OS, if drive stay mounted in a ...


7

If you use sdelete from Microsoft (http://technet.microsoft.com/en-us/sysinternals/bb897443.aspx) you don't have to install anything. It has an option to fill the unused disk space with zeroes too. If you already deleted the files this is what I'd just to make sure that nothing remains of the original file.


7

Create a new user. Give that user access rights to only the folders you want to share. You can use the File and Folder Permission options on Windows, and simple chmod on Linux. Run your application (Dropbox, for example) under that user. You can use runas on Windows, and sudo -u on Linux. Please note that you might have to allow access to other folders ...


6

I agree with the Rorys. It's very difficult to allow someone to execute or read data without at the same time giving them the ability (either inherently or through user-implemented means) to copy it out. Physical access especially breaks most security measures short of at-rest encryption. That said, the suggestions of using Group Policies and/or Thin ...



Only top voted, non community-wiki answers of a minimum length are eligible