Hot answers tagged permissions
18
If the system is private and you don't use any other infrastructure or services to carry out your testing, then you probably don't violate any statutes.
However:
If you are attacking through an ISP - get their agreement first, as they could see what you are doing as an attack and pass the info to law enforcement
If there is data on the server which could ...
17
RBAC (Role based access control) is based on defining a list of business roles, and adding each user in the system to one or more roles. Permissions and privileges are then granted to each role, and users receive them via their membership in the role (pretty much equivalent to a group). Applications will typically test the user for membership in a specific ...
12
Get a known clean version of your site and identify the differences between the known good code the and current (hacked) production code. Study how the changes may have been made and repair.
Update the passwords.
Fix the FTP certificate issue - consider using 2 factor authentication.
Find a way to scan your code for vulnerabilities - peer review or ...
12
If the only user on the database that can change records is root and your CMS uses the root user to perform queries then you have a problem. Your root user should never be used by a website.
Get a limited user which can only access the tables and records he needs to access restricted with the right permissions. If he doesn't need delete or update, then ...
11
I would be reluctant to parcel out blame, particularly when it is clearly an honest mistake. Too much focus on blame on one incident can poison the well and make people more reluctant to report security incidents in the future. Even without any blame involved, it is already embarrassing enough to have to report that you screwed up and may have contributed ...
9
This constitutes as a fairly regular pentest and is indeed legal if the victim system's legal owner (your friend) allows you to perform this test. Make sure to have the entire scope of the test declared in a written contract between the two of you just to be sure if he should change his mind later on.
The scope would include the physical equipment involved, ...
8
Restrict the daemon with MAC
No matter how you cut it, wrapping Apache in a mandatory access control layer like AppArmor or SELinux is a good first step. That will allow you to restrict the daemon's allowable operations even if otherwise has permissions to do so. That will prevent Apache from ever modifying your files.
Use version control with automatic ...
7
By default, only administrators can create symbolic links, because they are the only ones who have the SeCreateSymbolicLinkPrivilege privilege found under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\ granted.
Symbolic links (symlinks) can expose security vulnerabilities in
applications that aren't ...
7
(In Darth Vader's voice): NOOOOOOOOOOOOOOOOOOOOOOO
That's not the way you use or configure suPHP. Even if you somehow manage to get it run that way, it is more dangerous than useful.
suPHP is supposed to be configured at Apache (or whatever your webserver is) level. The idea is to make Apache run suPHP instead of regular mod_php.
How suPHP actually ...
7
The "777" is octal for local permissions in the Unix sense; this means that the file can be written to by any process on this machine (all users have read and write access to the file). This is local: this is about access rights for process which run on the machine. Someone from the outer world does not have, by default, the possibility to make arbitrary ...
6
Potentially, sure.
If permissions are viewable, that gives an attacker a list of valid usernames and tells the attacker which accounts are the best candidates to attack. An attacker is much more likely to want to break in to the jdoe account in the HR system if they know, for example, that jdoe has the ability to see everyone's salary.
Making ...
6
Are there steps beyond checking logs that I should take?
Although I'm sure you are asking what specific operational things should be done to try to ensure that the sensitive material has not been disclosed or altered, I'm going to answer this at a higher level of abstraction.
In cases like this, I like to ask myself the Five Whys. Work backwards from ...
6
You're absolutely right, keeping the user running the webserver process, in your case apache isolated from writing to the webroot is a good idea. It is one of the basic hardening guides for a reason. If the user can write to the files or directories, then it makes it easier for a malicious user to modify the filesystem. One thing you aren't taking into ...
6
Was I at fault for assuming that either the IT staff or the web developer should have dealt with this?
Usually, you try to keep internal affairs unreachable from the outside world. Anything that goes into production must be checked and verified (at least by administrator). Well, and then double checked.
Who is responsible for making sure that ...
6
The user part of the registry(HKey_Current_User) is writable by unprivileged applications.
The machine part of the registry (HKey_Local_Machine) is only writable by privileged programs.
Some subkeys might require different permissions, but this is true for most keys
To change the shell for the current user, you can modify ...
6
What you are looking for is Windows Powershell. It is the windows equivalent to the unix terminal. Using the command line for administrative task is so much more efficient compared to using GUIs once you get past the learning curve.
In Powershell, the dir or ls command allows you to list files and directories together with the permissions. I am not that ...
5
I have never asked for permission in advance (that I can recall), but I can say clients on many occasions have reported IP addresses under my control to be attacking them.
For example:
TOS Violation - Malicious Activity
We have received a report of malicious activity originating from an IP address assigned to (redacted). Please investigate this ...
5
Why don't you just knock up some virtual servers to play with .. or get some vulnerable iso's to play with (metasploitable comes to mind for one)
You could always do a p2v of a physical system so you have it as a virtual machine. That way you can take backups and restore points etc.
Otherwise, as the posts above state, get a written agreement, and ensuer ...
5
Your method #1 can be adapted to protect against symlink attacks:
lstat() the file path you want to chmod. Save the values of st_dev and st_ino in the struct stat that is returned. These two numbers uniquely identify the file on your system.
open() the file with O_RDONLY.
fstat() the open file descriptor. Check to make sure that st_dev and st_ino are ...
4
In my opinion, there are two problems here:
Your developer is directly spawning shells to perform operations. This is a sign of poor quality code, a dodgy workaround, or your developer not having enough time / experience to perform the operation himself. You need to find out which it is.
Allowing _IUSR access to cmd.exe opens up some nasty possibilities ...
4
I agree with Gilles that disabling perl is not effective security; as there are numerous other ways you could be attacked (e.g., a python script; a bash script; a php script; an executable) and that restricting /usr/bin/perl to certain users groups may have side effects (e.g., that program that calls a perl script as an ordinary user).
However as an aside, ...
4
Disabling perl is useless. The exploit that can be written in Perl can also be written in another language. Say, PHP, which you obviously aren't going to disable.
If you take a system that's already very secure (as in: vulnerabilities are rare and tend to affect only a small part of the system with no direct way of enabling the execution of arbitrary code), ...
4
(This is only a general comment on the "why", not on the specific attack you are alluding to.)
Unfortunately, the Java designers found that it was highly possible to paint yourself into a corner, structurally speaking. For instance, there are classes in java.io and in java.net, which are both involved in doing I/O. Let's assume that a given JVM has special ...
4
Beyond the general "don't tell anybody anything" advice, which is entirely true, there are a couple interesting things about process start time from an attacker's point of view.
if you manage to crash a process, its start time will be reset. You could use that info to figure out which other attacks were working.
some systems have had vulnerabilities where ...
4
This is most likely a PHP LFI (Local File Inclusion) attack. The .php.jpg "photo" actually contains valid PHP code that is then parsed by some other script on your site which is vulnerable to LFI.
The other files you found were dropped post-exploitation after the LFI vulnerability was exploited.
You can post the boy.php.jpg for further analysis. Host it ...
3
Summary
Some trusted methods need more permissions internally to fulfill their tasks. But if those methods have bugs, they may allow an untrusted attacker to execute undesired actions at an increased privilege level.
Background
We have a very similar situation at the operating system level. On Unix there are setuid/setgid flags and the sudo command. They ...
3
There's not a direct way to find out who exactly created the file on NTFS by hindsight. However, you might have a chance checking the event logs to determine who was logged in as an admin by that time. If you're lucky there was only one administrator present.
If you want to monitor such activities for certain directories from now on, there're various tools ...
3
The first thing to understand is that even in the best of systems mistakes will happen. The good news here is that your web developer did a good job of identifying the problem and reporting it promptly.
"Was I at fault for assuming" - do you remember what they say about assume? ass_u_me....
Safeguarding corporate assets (of all types) is a responsibility ...
3
The standard method is a Discretionary Access Control List (DACL). Such a structure maps entities (e.g. users, user groups, etc.) to resources (e.g. files, mutexes, sockets, etc.) with a defined set of permission attributes placed on each link.
For example, the following represents a simple read/write DACL:
Resource | Entity | R | W |
...
3
Linux user permissions are just a form of ACL, stored as data structure as part of the file system. They're enforced by the operating system, but not in any solid sense - a file system driver or OS that doesn't recognise Unix-style permissions will just ignore them. The same goes for Windows file permissions, which are ignored on Linux systems.
Transparent ...
Only top voted, non community-wiki answers of a minimum length are eligible
