Questions tagged [file-access]
The file-access tag has no usage guidance.
149
questions
1
vote
1
answer
60
views
Is it safe to store harmful files to storage like AWS S3?
I am new to security topics, please don't assume knowledge and spare no details if you're able to answer my questions.
I am trying to design a system that performs the basic functionality of ...
- 11
1
vote
0
answers
54
views
How to create read-only pendrive (no availability of coping, deleting or overwriting) [duplicate]
I want to create pendrive or external HDD, that is read only.
To be precise - I want to be open to read files on it (documents or video files), but to prevent files from being copied off disk.
As I ...
0
votes
1
answer
91
views
SACL for shadow copies
I'm researching the topic of detecting registry dump from disk shadow copies and realize that I don't see any specific events in the Windows and Sysmon logs.
I tried a simple copy with the command:
...
- 11
1
vote
0
answers
89
views
Best collaboration and file sharing platform across multiple organizations (and IT ecosystems) [closed]
Four discrete organizations wish to share calendars, files, and folders for collaboration purposes on multi-year projects (including regular online and in-person events).
Each one has their own ...
- 11
1
vote
1
answer
274
views
Unlisted directory discovery of a web server without using bruteforce attacks
Some creator I support on SubscribeStar hosts their files on a dedicated AWS web storage server of theirs and the names are easily accessible and sometimes guessable without any kind of security or ...
- 111
1
vote
0
answers
2k
views
Can I know if someone transferred files from my mobile to their computer
If someone connected my phone through USB to computer or laptop and transferred files from my mobile, is there any option to check in my mobile that they used particular apps or opened and transferred ...
1
vote
1
answer
233
views
Can websites, through cookies or other usual means, access PDFs opened in browser?
Can websites through the use of cookies or other usual means, see the content in a PDF (saved and opened locally or opened from the web) that is also opened in the browser at the same time, or in the ...
0
votes
1
answer
855
views
PHP - How to block files access in specific directory from the external
I made a very simple dashboard with HTML/PHP/JS (and a MySQL database) where some users (after a secure login with username and password) can access and insert some activities with details and attach ...
- 1
0
votes
1
answer
131
views
Ways to inject malicious content during a HTTP file transfer
Assume an Apache server (http, no authentication just hosting static files) is running in my local network which is hosting some zip files. Assume User A is requesting a zip file from the Apache ...
0
votes
1
answer
85
views
How to prevent a user retaining file access with an open handle on Windows?
Suppose a user is a member of a group, and they open (in the Windows API sense) a file whose DACL grants access to that group.
Then, the user stops being a member of the group.
Since access checks are ...
- 4,951
0
votes
1
answer
141
views
How can opening a non-existing file cause a security vulnerability?
I was reading on race conditions when I encountered the paragraph below:
How exactly does trying to read a non-existing file cause a security vulnerability?
0
votes
0
answers
83
views
Possible pitfalls with filesharing using local account instead of domain account
I've recently eradicated Active Directory from my network. However, I'm having trouble verifying there is no issue with sharing files using a local account instead of a domain account.
I have exactly ...
- 1
0
votes
3
answers
599
views
If email is an insecure medium, why are usernames and passwords sent via email (albeit in separate ones)?
At work we are using a secure file transfer utility that, after setting it up, sends you and the participants you want to share those files with, two emails. One email contains the randomised username,...
- 185
1
vote
1
answer
273
views
Does adding a randomized string in S3 file path has equal security to Google Drive shared link
I would like to use an AWS S3 bucket to store my IoT firmware file and allows all of my IoT devices to access it to update the firmware to the latest version.
I want that the firmware file in the S3 ...
- 395
0
votes
3
answers
176
views
How to technically introduce my boss to computer file security?
My boss truly believes that keeping files on paper and locked in his drawer is the safest place ever. He is the type of guy that processes a file in Word/Excel, prints it, delete the file and store ...
- 473
0
votes
0
answers
55
views
OpenSSH artifacts, remote system access? [duplicate]
After stumbling upon some unknown folders in my unused OneDrive (posted question), I did some digging arround and found some interesting logs. Apparently, OpenSSH had been used for remote access on my ...
- 101
1
vote
1
answer
231
views
Generate C File Stream Object on remote machine without fopen()
Let's say we have an elf a and a textfile a.txt in the same directory.
The a elf is a program, that is remotely accessible/executable.
In addition a contains the instruction fgets(buf,len,stdin); and ...
1
vote
1
answer
245
views
Host filesystem manipulation from docker vs. virtual machine
When reading about docker, I found a part of the documentation describing the attack surface of the docker daemon. From what I was able to understand, part of the argument is that it is possible to ...
- 111
1
vote
2
answers
4k
views
Can my school computer see my files via USB?
I was issued a chromebook, as was everyone at my school, to use for work in class and in case school has to shut down again. We bring it home so it connects to my personal Wi-Fi when I'm at home. I ...
- 11
45
votes
2
answers
12k
views
Claim that Skype is an unconfined application able to access all one's own personal files and system resources
Situation
I was about to install Skype on a laptop driven by Ubuntu 18.04 LTS Desktop.
The software installation helper graciously informs me that Skype
is unconfined. It can access all your personal ...
- 955
1
vote
1
answer
2k
views
Secure File Replication between LAN and DMZ
Our support staff established remote access connection from jumphosts that are isolated within a DMZ. To provide support they need project files (up to a few GB of size) which are stored on a file ...
- 21
0
votes
0
answers
2k
views
How to encrypt user files securely on the server with PHP
Description:
I want to create an upload center for small files (word/excel/zip documents etc) with PHP.
I want to protect files uploaded by user as much as possible, so if server is breached, ...
- 61
1
vote
0
answers
324
views
How is mkdir subject to a TOCTOU attack?
My answer here, resulted in this comment:
This could be subject to a TOCTOU1 attack and needs to be developed to be correct.
The answer is in Rust, but here's some equivalent bash:
p=/home/roger/...
- 2,317
5
votes
1
answer
385
views
Can a non-privileged user modify the file descriptor table of an elevated process?
In Linux, every process holds its own file descriptor table, which keeps references to all opened files and file-like devices. This table is managed by the kernel.
Is it possible that a non-...
user163495
3
votes
0
answers
173
views
Storing user's private files on S3 and securing access using signed URLs - good idea?
I will be storing private user's files on S3. The files will be PDFs, possibly containing private financial information.
I'm considering letting users directly access the files on S3, without ...
- 131
24
votes
1
answer
6k
views
Does a single fopen introduce TOCTOU vulnerability?
I'm actually fixing driver under Linux.
Klokwork said that code like:
file = fopen(fileName, "w+"); // w+,r,a and any mix of those is used here
if (file != NULL) { /* do things*/ }
else { /* throw ...
- 243
1
vote
1
answer
396
views
Can script steal sensitive data in home directory on Linux and is SELinux optimal way/tool to prevent it
The premise: on a Linux workstation I regularly download and use various software, let's say Perl or Nodejs modules. When I use them they run on the machine with me as the owner and can do whatever I ...
- 281
0
votes
2
answers
161
views
Encrypted folder with different access rights for different users
With the GDPR (General Data Protection Regulation of EU) comes the necessity for many companies to store certain personal data (CVs, certificates, passport copies, etc.) centrally and encrypted. The ...
- 1
0
votes
2
answers
152
views
Preferred access mode for a directory with PHP scripts and the PHP script itself
The people I work with have the tendency to set the access mode in numerical notation to 777 every time they face access right problems.
The mess is caused by using many users.
The creator of ...
- 101
1
vote
2
answers
3k
views
How to prevent a specific program from reading my files?
My issue is more towards blocking a specific application/program (In this case, the Epic Games Launcher) from accessing my files. I know the best answer is just to remove that software. The reason ...
- 11
0
votes
0
answers
177
views
How to protect certain macOS user directory from unauthorized access?
I have several directories on my Mac, two most popular examples are:
~/.aws
~/.ssh
They can be read by any script file or third-party app in system.
I do not see a way to protect them in macOS (...
- 163
0
votes
3
answers
496
views
How to protect company sensitive data from being deleted by a user when data is on their computer?
There more than 300 computers and more than 400 users are available. We face two incidents recently when critical users(who has critical data) leave from company.We have deleted their data when they ...
- 655
2
votes
1
answer
222
views
How can I block access to module for Firefox? (gmail accessing camera)
I run the following command in the background constantly to check for camera access on Ubuntu Linux:
lsmod | grep ^uvcvideo
I noticed that every time I load into gmail my check is triggering my ...
- 456
1
vote
2
answers
11k
views
Tomcat application arbitrary file read exploitation
In recent black-box pen-test of a webapp hosted on CentOS, I found a vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the home path of Tomcat.
In ...
- 11
1
vote
2
answers
507
views
What can a site visitor do with a 777 file on my web server?
Sometimes I prefer working with text files instead of database as I can later manually edit the file content.
Imagine I have created a text file blacklist and chmodded it to 777. Let's say it is ...
- 233
3
votes
0
answers
142
views
Is it possible for a remote machine to "escape" from a folder mapped through RDP?
Although most people seem to share entire drives with RDP, it is possible to share individual folders, by mapping them to a drive for example with subst <lettertomap>: <pathtofolder> (for ...
- 280
4
votes
1
answer
3k
views
Hacked Wordpress /index.php and /wp-content/themes/Avada/footer.php
I woke up today to see the top and bottom pages of my website displaying a link with text "Cheap Jerseys Free Shipping".
I quickly went in and saw that /index.php and /wp-content/themes/Avada/footer....
- 141
2
votes
0
answers
391
views
Concerns about LaTeX 3 shell escape code
What are the security risks in this line of LaTeX code, and what can be done to reduce them? The LaTeX3 project wants TeX macros to be able to do file operations via shell escape.
{ cp~-RLf~ \...
- 121
46
votes
3
answers
10k
views
Reason to not use chmod -R 777 on internal server for project source code?
From my days of amateur web development the principle of least privilege has beaten into me not to use chmod -R 777 dir. I have personally never needed it, so I've never used it.
I now work on a ...
- 2,422
128
votes
8
answers
35k
views
What stops Google from saving all the information on my computer through Google Chrome?
I noticed that in Google Chrome, if I type in file:///C:/Users/MyUsername/Desktop/ it shows me all of the folders on my Desktop, and I can type open up PDFs and such in chrome just by typing in the ...
- 1,349
3
votes
1
answer
232
views
To workaround a FreeBSD ACL bug I need to grant "read attributes/ACLs" to untrusted Samba users. Not happy about security - can practical harm result?
I've found either one, or more than one, bug, in ACL evaluation, when running Samba on FreeBSD. I can't be sure if these are facets of the same bug or related bugs - they're very similar but do have ...
- 1,694
1
vote
1
answer
238
views
How to deny execution of any file on a specific directory?
I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the ...
- 111
0
votes
1
answer
186
views
Permission to a user in a subfolder inside a folder to which he does not have access [closed]
I have a Windows Server 2012 and I need to configure the privileges to a group called DP_Preven. This is the scenario:
I have a folder called X where only a few groups have access, inside that ...
- 101
0
votes
2
answers
175
views
How to give someone access to a file, on a website, securely without relying on a single password?
I have created an online donation form for a Public Library. The form collects names, phone numbers, emails, addresses (a lot of personal info). The form is submitted to a PHP script that saves the ...
- 670
2
votes
1
answer
142
views
Erasing files and passes - how to understand them? [duplicate]
A few months ago, I downloaded Edenwaith Permanent Eraser from the edenwaith website and set it to DoE (3x) in the preferences.
I am using Mac Mini 2011, MacOS Sierra, and use it to delete files and ...
- 121
1
vote
1
answer
493
views
How secure is it to store passwords in a non-accessible file?
So, I was thinking about workarounds for saving passwords in text files (just because I'm curious), and I thought, what if I saved my file somewhere that is non-accessible? My server has a public_html ...
2
votes
1
answer
402
views
Protecting folder contents from processes
Let's consider the following:
Linux is the platform I am referencing here
There exists a partition on the system that's encrypted with a strong password (via the LUKS mechanism, if it's relevant to ...
- 167
4
votes
3
answers
6k
views
Where are NTFS security ACLs stored on Windows systems?
Are per-file and directory access permissions for an user or a group stored as part of the NTFS structures on-disk? Or are they recorded in the registry database for an installed Windows OS, or ...
- 101
2
votes
1
answer
4k
views
Can a smartphone be accessed only by knowing its IMEI?
I have an old smartphone that I want to use only as a media player/portable radio/voice recorder. It doesn’t have a SIM card and it’s not connected to WiFi. I am curious however can the files on it ...
- 23
3
votes
1
answer
424
views
Which is the most recommended way to expose a file to a computer in an external network in a secure way?
I have two machines in an internal network. One is a development server, which is isolated from external communications (neither through HTTP, HTTPS, SSH, etc). The last one is a production server (...
