Tag Info

Hot answers tagged

65

There's an even easier way to bypass the "execute" permission: copy the program into a directory you own and set the "execute" bit. The "execute" permission isn't a security measure. Security is provided at a lower level, with the operating system restricting specific actions. This is done because, on many Unix-like systems (especially in the days of ...


40

There are two main reasons why smartphones have fine-grained permissions while desktop computers don't. History. Mainframe operating systems have a tradition of giving permissions to the user rather than to the program, and this carried over into minicomputers/workstations/desktops; the desire to maintain compatibility with existing programs limits the ...


33

RBAC (Role based access control) is based on defining a list of business roles, and adding each user in the system to one or more roles. Permissions and privileges are then granted to each role, and users receive them via their membership in the role (pretty much equivalent to a group). Applications will typically test the user for membership in a specific ...


23

You can set the execute bit, but not the read bit, on an executable file. That way, noone will be able to copy the file, but people can execute it anyway. This is quite pointless today, because a) it works for compiled programs only, not with scripts (on most systems); b) these days, with 90% of all unixes being linux, people can copy executables from just ...


18

If the system is private and you don't use any other infrastructure or services to carry out your testing, then you probably don't violate any statutes. However: If you are attacking through an ISP - get their agreement first, as they could see what you are doing as an attack and pass the info to law enforcement If there is data on the server which could ...


18

For technical reasons it is not possible to tell which permissions an application needs until it tries to use them, which means that an application needs some way to declare this. Applications on desktop operating systems never did this. When the user starts a legacy application, you could only assume that it needs everything (training the user to accepting ...


16

In computer security, they are used interchangeably. In the context of rights, permission implies consent given to any individual or group to perform an action. Privilege is a permission given to an individual or group. Privileges are used to distinguish between different granted permissions (including no permission.) A privilege is a permission ...


13

I would be reluctant to parcel out blame, particularly when it is clearly an honest mistake. Too much focus on blame on one incident can poison the well and make people more reluctant to report security incidents in the future. Even without any blame involved, it is already embarrassing enough to have to report that you screwed up and may have contributed ...


13

If the only user on the database that can change records is root and your CMS uses the root user to perform queries then you have a problem. Your root user should never be used by a website. Get a limited user which can only access the tables and records he needs to access restricted with the right permissions. If he doesn't need delete or update, then ...


13

That the code "runs as root" is mostly irrelevant. Root or non-root is a distinction that makes sense only locally to a machine, and only if you want to contain some potentially hostile code (e.g. hijacked server code) without bringing down the whole machine. This is the mainframe model from a few decades ago. At that time, it was believed that you could ...


12

Get a known clean version of your site and identify the differences between the known good code the and current (hacked) production code. Study how the changes may have been made and repair. Update the passwords. Fix the FTP certificate issue - consider using 2 factor authentication. Find a way to scan your code for vulnerabilities - peer review or ...


11

The concept is that on a given "object" (say, a file), you have access permissions which detail who can access the object and under which conditions. The owner is an optimization: usually, among all the users who have permissions for a given object, one of them should have "all the permissions" and be generally considered as responsible for this object. On ...


10

Restrict the daemon with MAC No matter how you cut it, wrapping Apache in a mandatory access control layer like AppArmor or SELinux is a good first step. That will allow you to restrict the daemon's allowable operations even if otherwise has permissions to do so. That will prevent Apache from ever modifying your files. Use version control with automatic ...


9

This constitutes as a fairly regular pentest and is indeed legal if the victim system's legal owner (your friend) allows you to perform this test. Make sure to have the entire scope of the test declared in a written contract between the two of you just to be sure if he should change his mind later on. The scope would include the physical equipment involved, ...


9

You're absolutely right, keeping the user running the webserver process, in your case apache isolated from writing to the webroot is a good idea. It is one of the basic hardening guides for a reason. If the user can write to the files or directories, then it makes it easier for a malicious user to modify the filesystem. One thing you aren't taking into ...


8

No, you can't. You can't ssh to folders, only to accounts. You might be able to mount the /tmp folder on another machine without a password if the server is running NFS or Samba and has fairly relaxed permissions.


8

There are at least two significant reasons why mobile operating systems have fine-grained permissions for apps, while desktop operating systems don't: History. Desktop operating systems date back several decades, when the primary threat model was different, and consequently have mechanisms designed to deal with that (now-largely-obsolete) threat model. ...


7

The user part of the registry(HKey_Current_User) is writable by unprivileged applications. The machine part of the registry (HKey_Local_Machine) is only writable by privileged programs. Some subkeys might require different permissions, but this is true for most keys To change the shell for the current user, you can modify ...


7

(In Darth Vader's voice): NOOOOOOOOOOOOOOOOOOOOOOO That's not the way you use or configure suPHP. Even if you somehow manage to get it run that way, it is more dangerous than useful. suPHP is supposed to be configured at Apache (or whatever your webserver is) level. The idea is to make Apache run suPHP instead of regular mod_php. How suPHP actually ...


7

The "777" is octal for local permissions in the Unix sense; this means that the file can be written to by any process on this machine (all users have read and write access to the file). This is local: this is about access rights for process which run on the machine. Someone from the outer world does not have, by default, the possibility to make arbitrary ...


7

Frankly, the relevant words are "custom code running as root and exposed to the Public." To justify the coding effort and delays, you will have to do some quick calculations on the impact of the code being exploited and a malicious actor gaining root access to the server it is running on. If the cost of a breach is more than the cost of the coding effort ...


6

Are there steps beyond checking logs that I should take? Although I'm sure you are asking what specific operational things should be done to try to ensure that the sensitive material has not been disclosed or altered, I'm going to answer this at a higher level of abstraction. In cases like this, I like to ask myself the Five Whys. Work backwards from ...


6

Was I at fault for assuming that either the IT staff or the web developer should have dealt with this? Usually, you try to keep internal affairs unreachable from the outside world. Anything that goes into production must be checked and verified (at least by administrator). Well, and then double checked. Who is responsible for making sure that ...


6

Potentially, sure. If permissions are viewable, that gives an attacker a list of valid usernames and tells the attacker which accounts are the best candidates to attack. An attacker is much more likely to want to break in to the jdoe account in the HR system if they know, for example, that jdoe has the ability to see everyone's salary. Making ...


6

I have never asked for permission in advance (that I can recall), but I can say clients on many occasions have reported IP addresses under my control to be attacking them. For example: TOS Violation - Malicious Activity We have received a report of malicious activity originating from an IP address assigned to (redacted). Please investigate this ...


6

(This is only a general comment on the "why", not on the specific attack you are alluding to.) Unfortunately, the Java designers found that it was highly possible to paint yourself into a corner, structurally speaking. For instance, there are classes in java.io and in java.net, which are both involved in doing I/O. Let's assume that a given JVM has special ...


6

By default, only administrators can create symbolic links, because they are the only ones who have the SeCreateSymbolicLinkPrivilege privilege found under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\ granted. Symbolic links (symlinks) can expose security vulnerabilities in applications that aren't ...


6

What you are looking for is Windows Powershell. It is the windows equivalent to the unix terminal. Using the command line for administrative task is so much more efficient compared to using GUIs once you get past the learning curve. In Powershell, the dir or ls command allows you to list files and directories together with the permissions. I am not that ...


6

Disabling .htaccess doesn't in itself provide any additional security benefit to your website. As @Xander mentioned the primary reason I've seen .htaccess disabled is performance (although I would suspect the performance improvement is negligible in many cases). However from the hosts perspective it could provide some security benefit, in that it may help ...


6

They are normally pretty interchangeable, though I've heard some systems where the permission is the thing that an action demands and the privilege is what the user has. So a user might be granted a privilege that corresponds to the permission being demanded, but that would really be semantics of some systems and isn't always the case. Either way, unless ...



Only top voted, non community-wiki answers of a minimum length are eligible