Tag Info

Hot answers tagged

64

There's an even easier way to bypass the "execute" permission: copy the program into a directory you own and set the "execute" bit. The "execute" permission isn't a security measure. Security is provided at a lower level, with the operating system restricting specific actions. This is done because, on many Unix-like systems (especially in the days of ...


31

RBAC (Role based access control) is based on defining a list of business roles, and adding each user in the system to one or more roles. Permissions and privileges are then granted to each role, and users receive them via their membership in the role (pretty much equivalent to a group). Applications will typically test the user for membership in a specific ...


22

You can set the execute bit, but not the read bit, on an executable file. That way, noone will be able to copy the file, but people can execute it anyway. This is quite pointless today, because a) it works for compiled programs only, not with scripts (on most systems); b) these days, with 90% of all unixes being linux, people can copy executables from just ...


18

If the system is private and you don't use any other infrastructure or services to carry out your testing, then you probably don't violate any statutes. However: If you are attacking through an ISP - get their agreement first, as they could see what you are doing as an attack and pass the info to law enforcement If there is data on the server which could ...


15

In computer security, they are used interchangeably. In the context of rights, permission implies consent given to any individual or group to perform an action. Privilege is a permission given to an individual or group. Privileges are used to distinguish between different granted permissions (including no permission.) A privilege is a permission ...


13

If the only user on the database that can change records is root and your CMS uses the root user to perform queries then you have a problem. Your root user should never be used by a website. Get a limited user which can only access the tables and records he needs to access restricted with the right permissions. If he doesn't need delete or update, then ...


12

I would be reluctant to parcel out blame, particularly when it is clearly an honest mistake. Too much focus on blame on one incident can poison the well and make people more reluctant to report security incidents in the future. Even without any blame involved, it is already embarrassing enough to have to report that you screwed up and may have contributed ...


12

Get a known clean version of your site and identify the differences between the known good code the and current (hacked) production code. Study how the changes may have been made and repair. Update the passwords. Fix the FTP certificate issue - consider using 2 factor authentication. Find a way to scan your code for vulnerabilities - peer review or ...


11

The concept is that on a given "object" (say, a file), you have access permissions which detail who can access the object and under which conditions. The owner is an optimization: usually, among all the users who have permissions for a given object, one of them should have "all the permissions" and be generally considered as responsible for this object. On ...


10

Restrict the daemon with MAC No matter how you cut it, wrapping Apache in a mandatory access control layer like AppArmor or SELinux is a good first step. That will allow you to restrict the daemon's allowable operations even if otherwise has permissions to do so. That will prevent Apache from ever modifying your files. Use version control with automatic ...


9

This constitutes as a fairly regular pentest and is indeed legal if the victim system's legal owner (your friend) allows you to perform this test. Make sure to have the entire scope of the test declared in a written contract between the two of you just to be sure if he should change his mind later on. The scope would include the physical equipment involved, ...


9

You're absolutely right, keeping the user running the webserver process, in your case apache isolated from writing to the webroot is a good idea. It is one of the basic hardening guides for a reason. If the user can write to the files or directories, then it makes it easier for a malicious user to modify the filesystem. One thing you aren't taking into ...


8

No, you can't. You can't ssh to folders, only to accounts. You might be able to mount the /tmp folder on another machine without a password if the server is running NFS or Samba and has fairly relaxed permissions.


7

The user part of the registry(HKey_Current_User) is writable by unprivileged applications. The machine part of the registry (HKey_Local_Machine) is only writable by privileged programs. Some subkeys might require different permissions, but this is true for most keys To change the shell for the current user, you can modify ...


7

By default, only administrators can create symbolic links, because they are the only ones who have the SeCreateSymbolicLinkPrivilege privilege found under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\ granted. Symbolic links (symlinks) can expose security vulnerabilities in applications that aren't ...


7

(In Darth Vader's voice): NOOOOOOOOOOOOOOOOOOOOOOO That's not the way you use or configure suPHP. Even if you somehow manage to get it run that way, it is more dangerous than useful. suPHP is supposed to be configured at Apache (or whatever your webserver is) level. The idea is to make Apache run suPHP instead of regular mod_php. How suPHP actually ...


7

The "777" is octal for local permissions in the Unix sense; this means that the file can be written to by any process on this machine (all users have read and write access to the file). This is local: this is about access rights for process which run on the machine. Someone from the outer world does not have, by default, the possibility to make arbitrary ...


6

Was I at fault for assuming that either the IT staff or the web developer should have dealt with this? Usually, you try to keep internal affairs unreachable from the outside world. Anything that goes into production must be checked and verified (at least by administrator). Well, and then double checked. Who is responsible for making sure that ...


6

Are there steps beyond checking logs that I should take? Although I'm sure you are asking what specific operational things should be done to try to ensure that the sensitive material has not been disclosed or altered, I'm going to answer this at a higher level of abstraction. In cases like this, I like to ask myself the Five Whys. Work backwards from ...


6

Potentially, sure. If permissions are viewable, that gives an attacker a list of valid usernames and tells the attacker which accounts are the best candidates to attack. An attacker is much more likely to want to break in to the jdoe account in the HR system if they know, for example, that jdoe has the ability to see everyone's salary. Making ...


6

I have never asked for permission in advance (that I can recall), but I can say clients on many occasions have reported IP addresses under my control to be attacking them. For example: TOS Violation - Malicious Activity We have received a report of malicious activity originating from an IP address assigned to (redacted). Please investigate this ...


6

(This is only a general comment on the "why", not on the specific attack you are alluding to.) Unfortunately, the Java designers found that it was highly possible to paint yourself into a corner, structurally speaking. For instance, there are classes in java.io and in java.net, which are both involved in doing I/O. Let's assume that a given JVM has special ...


6

What you are looking for is Windows Powershell. It is the windows equivalent to the unix terminal. Using the command line for administrative task is so much more efficient compared to using GUIs once you get past the learning curve. In Powershell, the dir or ls command allows you to list files and directories together with the permissions. I am not that ...


6

Disabling .htaccess doesn't in itself provide any additional security benefit to your website. As @Xander mentioned the primary reason I've seen .htaccess disabled is performance (although I would suspect the performance improvement is negligible in many cases). However from the hosts perspective it could provide some security benefit, in that it may help ...


6

They are normally pretty interchangeable, though I've heard some systems where the permission is the thing that an action demands and the privilege is what the user has. So a user might be granted a privilege that corresponds to the permission being demanded, but that would really be semantics of some systems and isn't always the case. Either way, unless ...


6

Normal user and sudo, always: you want to spend as little time being root as possible. As a bonus, the act of sudoing before giving a command reminds you to be careful.


6

There's no inherent security issues with this architecture. Any risks will come from the implementation errors or vulnerabilities in MySQL. It sounds like you are considering this method in order to provide separation between different networks' data, however it does sound a bit excessive. I know you tested for performance, however in a large scale this ...


5

027 on most systems. This gives a default of rw-,r--,--- which is suitable for me. I have seen some environments use 077, but unless the users are very limited in what the can do (so why give them a shell at all?) or experienced it just causes helpdesk/IT issues.


5

Why don't you just knock up some virtual servers to play with .. or get some vulnerable iso's to play with (metasploitable comes to mind for one) You could always do a p2v of a physical system so you have it as a virtual machine. That way you can take backups and restore points etc. Otherwise, as the posts above state, get a written agreement, and ensuer ...


5

I agree with Gilles that disabling perl is not effective security; as there are numerous other ways you could be attacked (e.g., a python script; a bash script; a php script; an executable) and that restricting /usr/bin/perl to certain users groups may have side effects (e.g., that program that calls a perl script as an ordinary user). However as an aside, ...



Only top voted, non community-wiki answers of a minimum length are eligible