Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [file-access]

The tag has no usage guidance.

1
vote
1answer
53 views

How can I block access to module for Firefox? (gmail accessing camera)

I run the following command in the background constantly to check for camera access on Ubuntu Linux: lsmod | grep ^uvcvideo I noticed that every time I load into gmail my check is triggering my ...
0
votes
1answer
87 views

Tomcat application arbitrary file read exploitation

In recent black-box pen-test of a webapp hosted on CentOS, I found a vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the home path of Tomcat. In ...
1
vote
2answers
155 views

What can a site visitor do with a 777 file on my web server?

Sometimes I prefer working with text files instead of database as I can later manually edit the file content. Imagine I have created a text file blacklist and chmodded it to 777. Let's say it is ...
2
votes
0answers
32 views

Is it possible for a remote machine to “escape” from a folder mapped through RDP?

Although most people seem to share entire drives with RDP, it is possible to share individual folders, by mapping them to a drive for example with subst <lettertomap>: <pathtofolder> (for ...
2
votes
1answer
516 views

Hacked Wordpress /index.php and /wp-content/themes/Avada/footer.php

I woke up today to see the top and bottom pages of my website displaying a link with text "Cheap Jerseys Free Shipping". I quickly went in and saw that /index.php and /wp-content/themes/Avada/footer....
2
votes
0answers
104 views

Concerns about LaTeX 3 shell escape code

What are the security risks in this line of LaTeX code, and what can be done to reduce them? The LaTeX3 project wants TeX macros to be able to do file operations via shell escape. { cp~-RLf~ \...
43
votes
3answers
6k views

Reason to not use chmod -R 777 on internal server for project source code?

From my days of amateur web development the principle of least privilege has beaten into me not to use chmod -R 777 dir. I have personally never needed it, so I've never used it. I now work on a ...
126
votes
9answers
33k views

What stops Google from saving all the information on my computer through Google Chrome?

I noticed that in Google Chrome, if I type in file:///C:/Users/MyUsername/Desktop/ it shows me all of the folders on my Desktop, and I can type open up PDFs and such in chrome just by typing in the ...
3
votes
1answer
62 views

To workaround a FreeBSD ACL bug I need to grant “read attributes/ACLs” to untrusted Samba users. Not happy about security - can practical harm result?

I've found either one, or more than one, bug, in ACL evaluation, when running Samba on FreeBSD. I can't be sure if these are facets of the same bug or related bugs - they're very similar but do have ...
1
vote
0answers
63 views

How to deny execution of any file on a specific directory?

I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the ...
0
votes
1answer
56 views

Permission to a user in a subfolder inside a folder to which he does not have access [closed]

I have a Windows Server 2012 and I need to configure the privileges to a group called DP_Preven. This is the scenario: I have a folder called X where only a few groups have access, inside that ...
0
votes
2answers
91 views

How to give someone access to a file, on a website, securely without relying on a single password?

I have created an online donation form for a Public Library. The form collects names, phone numbers, emails, addresses (a lot of personal info). The form is submitted to a PHP script that saves the ...
2
votes
1answer
51 views

Erasing files and passes - how to understand them? [duplicate]

A few months ago, I downloaded Edenwaith Permanent Eraser from the edenwaith website and set it to DoE (3x) in the preferences. I am using Mac Mini 2011, MacOS Sierra, and use it to delete files and ...
1
vote
1answer
185 views

How secure is it to store passwords in a non-accessible file?

So, I was thinking about workarounds for saving passwords in text files (just because I'm curious), and I thought, what if I saved my file somewhere that is non-accessible? My server has a public_html ...
2
votes
1answer
96 views

Protecting folder contents from processes

Let's consider the following: Linux is the platform I am referencing here There exists a partition on the system that's encrypted with a strong password (via the LUKS mechanism, if it's relevant to ...
3
votes
2answers
1k views

Where are NTFS security ACLs stored on Windows systems?

Are per-file and directory access permissions for an user or a group stored as part of the NTFS structures on-disk? Or are they recorded in the registry database for an installed Windows OS, or ...
2
votes
1answer
327 views

Can a smartphone be accessed only by knowing its IMEI?

I have an old smartphone that I want to use only as a media player/portable radio/voice recorder. It doesn’t have a SIM card and it’s not connected to WiFi. I am curious however can the files on it ...
3
votes
1answer
95 views

Which is the most recommended way to expose a file to a computer in an external network in a secure way?

I have two machines in an internal network. One is a development server, which is isolated from external communications (neither through HTTP, HTTPS, SSH, etc). The last one is a production server (...
2
votes
1answer
69 views

How to get sticky bit like ACL but for specific Linux user only?

Sticky bit set for a directory is a mean for "Restricted Deletion" — according to manual: For directories, it prevents unprivileged users from removing or renaming a file in the directory unless ...
1
vote
1answer
115 views

How can I capture files malware creates and then deletes? [closed]

Malware on Windows often creates and deletes files. How can I capture the files it creates if it deletes them too quickly to copy?
0
votes
1answer
121 views

Best way to secure documents? [closed]

I'm currently tasked with securing our documents stored in our NAS. Basically, the minimum requirements that is needed are; 1) Watermarking Ability(Any file viewed/downloaded or printed will have the ...
1
vote
0answers
346 views

user permissions and nginx with git hook for deployment

So I am trying to set up a webserver which will use nginx to serve a static site (for now). I set up a git repo that I want to push to in order to make deployment easy (using this guide: https://www....
6
votes
1answer
179 views

If forced to download files using FTP, what steps can be taken to provide security?

I am in a situation where I must access data via FTP on a regular basis (for argument's sake, updated every 10 minutes). No other protocol is available for this operation. This data needs to be put ...
1
vote
1answer
74 views

How would rw permissions on an Apache directory actually be compromised?

I have a directory on an Apache server dedicated to serving images, and I have those images rw for www-data (Apache process runs as www-data). I've configured it like this, because in the ...
1
vote
3answers
256 views

Rationale behind SELinux preventing file access

Some of the few times I've had to deal with SELinux were when I setup a local webserver on a Fedora box. Problems occurred when a web application tried to write files to the file system. I'm used to ...
2
votes
4answers
118 views

Security and conventions. DB or File?

Let me start off by stating I know the benefits of a database but that is not the question. I want to know if the security makes sense with an added benefit of speed. By using PHP 7.0, Test 1: I ...
8
votes
5answers
309 views

Could ransomware be stalled while encrypting?

I have been reading about ransomware, and I was wondering if it could be defended against by having certain "trap" files on a drive. Sometimes I look through Code Golf and am thoroughly impressed by ...
1
vote
1answer
141 views

A file that doesn't allow copy/paste or print

We know that Adobe pdf's convenient control features for discouraging copy/paste and print are not real security measures. We are searching for a way to create a file that has default security set ...
0
votes
1answer
466 views

Limit file access to admin and application on Windows 10?

I'm looking for a way to secure special made config files on an Windows 10 installation: A user without admin rights must not have direct access to the unencrypted text file. A closed source ...
1
vote
1answer
166 views

How did stuxnet hid it's files after the infection?

I've noticed that when ~WTR4141.tmp is loaded, it doesn't set hidden file attributes to .lnk files and on the other .tmp rootkit file of the Stuxnet bundle. I've seen that these are all the possible ...
0
votes
0answers
25 views

Will this authorized resource handling method work for my purposes?

So I'm working on a database for sensitive information where users can remotely access this data while unauthorized users can't. Pretty simple concept and I just wanted to see if my design was going ...
3
votes
1answer
601 views

Do AppArmor/SELinux provide any security for workstation?

I decided to harden security on my primary workstation a bit. Before I used to use firejail for certain less trusted apps (all apps with internet access) but it's kind of toy. Didn't work really well ...
0
votes
1answer
27 views

Debugging self recreating files

While cleaning up a portable HD I came across a directory that I cannot delete with the error that it is not empty, and that despite trying to delete it with the -rf flags (I am running linux). I ...
1
vote
1answer
432 views

Security in unofficial telegram apps(that use Telegram API)

I was wondering that can developers of an unofficial Telegram apps gain access to media and files that users send over the app? (Unofficial Telegrams use the Telegram API and connect to Telegram ...
0
votes
0answers
55 views

How to know which files a process is accessing?

One of the running applications on my windows occasionally uses the internet bandwidth. It might be updating itself, but who knows, maybe it's accessing my private files and documents and is sending ...
2
votes
2answers
88 views

Ensuring File is Write-Only For Specific Program

So in this scenario there are several programs that exist that can open and read a binary file, but my program must be the final arbitrator in creating and writing to these files. In this program I ...
1
vote
2answers
473 views

How to eliminate data leaks when accessing encrypted data?

Goal: Encrypt/secure and access sensitive files (PDFs, etc.) locally. Method 1: Store files in a VeraCrypt file-hosted volume (container). Concern: Data Leaks. When mounting and reading files from ...
2
votes
2answers
697 views

How to secure Web directories allowing only me to access them

I have a web folder with some PHP files that are hosted in my website(e.g. www.mysite.com/myfiles/my_file.php) that I access and trade information using ajax for a Web App that I have. My question is,...
2
votes
2answers
106 views

Is there such a thing as application-specific encryption?

I am looking for a way to encrypt certain files (.jpg, .pdf, standard file extensions) such that they can only be opened by a certain application (assuming this application will have the relevant file ...
1
vote
1answer
48 views

Should pypi subdirectories be accessible from web browser?

I am a security researcher and when I was fingerprinting one web application I found out that all the subdirectories of domain.com/pypi were accessible from the web browser. The main directory pypi ...
1
vote
0answers
129 views

File sharing solution with approval workflow [closed]

Is there any solution out anyone is aware of that does secure file sharing but with the facility of an approval workflow. A case being a person can upload a file to the secure file sharing solution ...
-1
votes
1answer
513 views

How to protect EXIF data against editing/deleting in jpeg file?

Is there any option to protect EXIF data against editing or provide password protection? I came accross the idea of creating executable file from image file, so that someone can view image the way is ...
3
votes
1answer
153 views

Can email services upload files from your computer without your permission/knowledge?

The company I work for is involved in security clearance work, and thus all company computers are monitored (files, screenshots, etc). I am routinely logged onto my company email service with my ...
3
votes
2answers
3k views

How to detect if files were saved or copied from an external hard drive/USB?

Is it possible? If so, how? This is needed to alert on the copying of "important" files. An example of what I need: There is a document on an external hard drive/USB. You're just allowed to ...
21
votes
3answers
3k views

Would it be plausible to write your own anti-crypto-ransomware tool? [closed]

Question After reading about how basic ransomware targets and encrypts your files. I was wondering if it would be plausible to write your own script to try and detect such activities? Initial ...
1
vote
2answers
41 views

Protect Public Directories Linux

Just for a brief overview. I have a system that can generate invoices and has a login system for a user to generate his/her invoices. Lets say the platform resides at /platform and the invoices in /...
7
votes
1answer
332 views

How to spare file server data from being held hostage by client ransomware?

Suppose in a network there is a file server which's storage is shared between all workstations and all users require full read/write access to this storage for their cooperation workflow. (Over samba, ...
1
vote
0answers
37 views

Why doesn't homebrew fix file access problems by itself?

Before I took ownership of /usr/local, "brew link" caused a "/usr/local/..." not writeable. Is there any particular security reason why the program didn't say something like "The operating system won'...
5
votes
2answers
1k views

The history of thumbnails (or just a previous thumbnail) is embedded in an image file?

I was surprised when I cropped an image on Windows Phone, saved it, sent it via e-mail to a PC, and then downloaded it - and the thumbnail in the download folder was the one of original, not cropped ...
10
votes
3answers
4k views

Is denying write access an effective way to stop ransomware?

I'm looking for ways to defend against ransomware. As part of this strategy I've come up with the idea to block myself from writing to as many locations (and files) as possible. It may be assumed ...