Questions tagged [file-access]
The file-access tag has no usage guidance.
145
questions
0
votes
0
answers
97
views
Can I know if someone transferred files from my mobile to their computer
If someone connected my phone through USB to computer or laptop and transferred files from my mobile, is there any option to check in my mobile that they used particular apps or opened and transferred ...
1
vote
1
answer
58
views
Can websites, through cookies or other usual means, access PDFs opened in browser?
Can websites through the use of cookies or other usual means, see the content in a PDF (saved and opened locally or opened from the web) that is also opened in the browser at the same time, or in the ...
0
votes
1
answer
255
views
PHP - How to block files access in specific directory from the external
I made a very simple dashboard with HTML/PHP/JS (and a MySQL database) where some users (after a secure login with username and password) can access and insert some activities with details and attach ...
- 1
0
votes
1
answer
60
views
Ways to inject malicious content during a HTTP file transfer
Assume an Apache server (http, no authentication just hosting static files) is running in my local network which is hosting some zip files. Assume User A is requesting a zip file from the Apache ...
0
votes
1
answer
33
views
How to prevent a user retaining file access with an open handle on Windows?
Suppose a user is a member of a group, and they open (in the Windows API sense) a file whose DACL grants access to that group.
Then, the user stops being a member of the group.
Since access checks are ...
- 4,610
0
votes
1
answer
84
views
How can opening a non-existing file cause a security vulnerability?
I was reading on race conditions when I encountered the paragraph below:
How exactly does trying to read a non-existing file cause a security vulnerability?
0
votes
0
answers
21
views
Possible pitfalls with filesharing using local account instead of domain account
I've recently eradicated Active Directory from my network. However, I'm having trouble verifying there is no issue with sharing files using a local account instead of a domain account.
I have exactly ...
- 1
0
votes
3
answers
320
views
If email is an insecure medium, why are usernames and passwords sent via email (albeit in separate ones)?
At work we are using a secure file transfer utility that, after setting it up, sends you and the participants you want to share those files with, two emails. One email contains the randomised username,...
- 195
1
vote
1
answer
168
views
Does adding a randomized string in S3 file path has equal security to Google Drive shared link
I would like to use an AWS S3 bucket to store my IoT firmware file and allows all of my IoT devices to access it to update the firmware to the latest version.
I want that the firmware file in the S3 ...
- 385
0
votes
3
answers
134
views
How to technically introduce my boss to computer file security?
My boss truly believes that keeping files on paper and locked in his drawer is the safest place ever. He is the type of guy that processes a file in Word/Excel, prints it, delete the file and store ...
- 493
0
votes
0
answers
54
views
OpenSSH artifacts, remote system access? [duplicate]
After stumbling upon some unknown folders in my unused OneDrive (posted question), I did some digging arround and found some interesting logs. Apparently, OpenSSH had been used for remote access on my ...
- 101
0
votes
1
answer
505
views
Unknown folders in OneDrive
Today I opened OneDrive by accident, since I do not use it. To my surprise, inside there were unknown folders, in foreign (to me) languages. Namely, "document" and "photo" folders ...
- 101
1
vote
1
answer
140
views
Generate C File Stream Object on remote machine without fopen()
Let's say we have an elf a and a textfile a.txt in the same directory.
The a elf is a program, that is remotely accessible/executable.
In addition a contains the instruction fgets(buf,len,stdin); and ...
1
vote
1
answer
162
views
Host filesystem manipulation from docker vs. virtual machine
When reading about docker, I found a part of the documentation describing the attack surface of the docker daemon. From what I was able to understand, part of the argument is that it is possible to ...
- 111
2
votes
2
answers
3k
views
Can my school computer see my files via USB?
I was issued a chromebook, as was everyone at my school, to use for work in class and in case school has to shut down again. We bring it home so it connects to my personal Wi-Fi when I'm at home. I ...
- 21
46
votes
2
answers
12k
views
Claim that Skype is an unconfined application able to access all one's own personal files and system resources
Situation
I was about to install Skype on a laptop driven by Ubuntu 18.04 LTS Desktop.
The software installation helper graciously informs me that Skype
is unconfined. It can access all your personal ...
- 965
1
vote
1
answer
1k
views
Secure File Replication between LAN and DMZ
Our support staff established remote access connection from jumphosts that are isolated within a DMZ. To provide support they need project files (up to a few GB of size) which are stored on a file ...
- 21
0
votes
0
answers
2k
views
How to encrypt user files securely on the server with PHP
Description:
I want to create an upload center for small files (word/excel/zip documents etc) with PHP.
I want to protect files uploaded by user as much as possible, so if server is breached, ...
- 61
1
vote
0
answers
212
views
How is mkdir subject to a TOCTOU attack?
My answer here, resulted in this comment:
This could be subject to a TOCTOU1 attack and needs to be developed to be correct.
The answer is in Rust, but here's some equivalent bash:
p=/home/roger/...
- 2,317
5
votes
1
answer
311
views
Can a non-privileged user modify the file descriptor table of an elevated process?
In Linux, every process holds its own file descriptor table, which keeps references to all opened files and file-like devices. This table is managed by the kernel.
Is it possible that a non-...
user163495
3
votes
0
answers
133
views
Storing user's private files on S3 and securing access using signed URLs - good idea?
I will be storing private user's files on S3. The files will be PDFs, possibly containing private financial information.
I'm considering letting users directly access the files on S3, without ...
- 131
24
votes
1
answer
6k
views
Does a single fopen introduce TOCTOU vulnerability?
I'm actually fixing driver under Linux.
Klokwork said that code like:
file = fopen(fileName, "w+"); // w+,r,a and any mix of those is used here
if (file != NULL) { /* do things*/ }
else { /* throw ...
- 243
1
vote
1
answer
249
views
Can script steal sensitive data in home directory on Linux and is SELinux optimal way/tool to prevent it
The premise: on a Linux workstation I regularly download and use various software, let's say Perl or Nodejs modules. When I use them they run on the machine with me as the owner and can do whatever I ...
- 281
0
votes
2
answers
109
views
Encrypted folder with different access rights for different users
With the GDPR (General Data Protection Regulation of EU) comes the necessity for many companies to store certain personal data (CVs, certificates, passport copies, etc.) centrally and encrypted. The ...
- 1
0
votes
2
answers
122
views
Preferred access mode for a directory with PHP scripts and the PHP script itself
The people I work with have the tendency to set the access mode in numerical notation to 777 every time they face access right problems.
The mess is caused by using many users.
The creator of ...
- 101
0
votes
2
answers
1k
views
How to prevent a specific program from reading my files?
My issue is more towards blocking a specific application/program (In this case, the Epic Games Launcher) from accessing my files. I know the best answer is just to remove that software. The reason ...
0
votes
0
answers
116
views
How to protect certain macOS user directory from unauthorized access?
I have several directories on my Mac, two most popular examples are:
~/.aws
~/.ssh
They can be read by any script file or third-party app in system.
I do not see a way to protect them in macOS (...
- 163
0
votes
3
answers
430
views
How to protect company sensitive data from being deleted by a user when data is on their computer?
There more than 300 computers and more than 400 users are available. We face two incidents recently when critical users(who has critical data) leave from company.We have deleted their data when they ...
- 670
2
votes
1
answer
187
views
How can I block access to module for Firefox? (gmail accessing camera)
I run the following command in the background constantly to check for camera access on Ubuntu Linux:
lsmod | grep ^uvcvideo
I noticed that every time I load into gmail my check is triggering my ...
- 456
1
vote
2
answers
9k
views
Tomcat application arbitrary file read exploitation
In recent black-box pen-test of a webapp hosted on CentOS, I found a vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the home path of Tomcat.
In ...
- 11
1
vote
2
answers
300
views
What can a site visitor do with a 777 file on my web server?
Sometimes I prefer working with text files instead of database as I can later manually edit the file content.
Imagine I have created a text file blacklist and chmodded it to 777. Let's say it is ...
- 233
3
votes
0
answers
98
views
Is it possible for a remote machine to "escape" from a folder mapped through RDP?
Although most people seem to share entire drives with RDP, it is possible to share individual folders, by mapping them to a drive for example with subst <lettertomap>: <pathtofolder> (for ...
- 260
4
votes
1
answer
3k
views
Hacked Wordpress /index.php and /wp-content/themes/Avada/footer.php
I woke up today to see the top and bottom pages of my website displaying a link with text "Cheap Jerseys Free Shipping".
I quickly went in and saw that /index.php and /wp-content/themes/Avada/footer....
- 141
2
votes
0
answers
305
views
Concerns about LaTeX 3 shell escape code
What are the security risks in this line of LaTeX code, and what can be done to reduce them? The LaTeX3 project wants TeX macros to be able to do file operations via shell escape.
{ cp~-RLf~ \...
- 121
46
votes
3
answers
10k
views
Reason to not use chmod -R 777 on internal server for project source code?
From my days of amateur web development the principle of least privilege has beaten into me not to use chmod -R 777 dir. I have personally never needed it, so I've never used it.
I now work on a ...
- 2,392
131
votes
8
answers
34k
views
What stops Google from saving all the information on my computer through Google Chrome?
I noticed that in Google Chrome, if I type in file:///C:/Users/MyUsername/Desktop/ it shows me all of the folders on my Desktop, and I can type open up PDFs and such in chrome just by typing in the ...
- 1,349
3
votes
1
answer
188
views
To workaround a FreeBSD ACL bug I need to grant "read attributes/ACLs" to untrusted Samba users. Not happy about security - can practical harm result?
I've found either one, or more than one, bug, in ACL evaluation, when running Samba on FreeBSD. I can't be sure if these are facets of the same bug or related bugs - they're very similar but do have ...
- 1,674
1
vote
1
answer
198
views
How to deny execution of any file on a specific directory?
I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the ...
- 111
0
votes
1
answer
112
views
Permission to a user in a subfolder inside a folder to which he does not have access [closed]
I have a Windows Server 2012 and I need to configure the privileges to a group called DP_Preven. This is the scenario:
I have a folder called X where only a few groups have access, inside that ...
- 101
0
votes
2
answers
146
views
How to give someone access to a file, on a website, securely without relying on a single password?
I have created an online donation form for a Public Library. The form collects names, phone numbers, emails, addresses (a lot of personal info). The form is submitted to a PHP script that saves the ...
- 650
2
votes
1
answer
108
views
Erasing files and passes - how to understand them? [duplicate]
A few months ago, I downloaded Edenwaith Permanent Eraser from the edenwaith website and set it to DoE (3x) in the preferences.
I am using Mac Mini 2011, MacOS Sierra, and use it to delete files and ...
- 121
1
vote
1
answer
408
views
How secure is it to store passwords in a non-accessible file?
So, I was thinking about workarounds for saving passwords in text files (just because I'm curious), and I thought, what if I saved my file somewhere that is non-accessible? My server has a public_html ...
2
votes
1
answer
247
views
Protecting folder contents from processes
Let's consider the following:
Linux is the platform I am referencing here
There exists a partition on the system that's encrypted with a strong password (via the LUKS mechanism, if it's relevant to ...
- 167
4
votes
3
answers
5k
views
Where are NTFS security ACLs stored on Windows systems?
Are per-file and directory access permissions for an user or a group stored as part of the NTFS structures on-disk? Or are they recorded in the registry database for an installed Windows OS, or ...
- 101
2
votes
1
answer
3k
views
Can a smartphone be accessed only by knowing its IMEI?
I have an old smartphone that I want to use only as a media player/portable radio/voice recorder. It doesn’t have a SIM card and it’s not connected to WiFi. I am curious however can the files on it ...
- 23
3
votes
1
answer
301
views
Which is the most recommended way to expose a file to a computer in an external network in a secure way?
I have two machines in an internal network. One is a development server, which is isolated from external communications (neither through HTTP, HTTPS, SSH, etc). The last one is a production server (...
2
votes
1
answer
226
views
How to get sticky bit like ACL but for specific Linux user only?
Sticky bit set for a directory is a mean for "Restricted Deletion" — according to manual:
For directories, it prevents unprivileged users from removing or renaming a file in the directory unless ...
- 128
1
vote
1
answer
572
views
How can I capture files malware creates and then deletes? [closed]
Malware on Windows often creates and deletes files. How can I capture the files it creates if it deletes them too quickly to copy?
- 11
0
votes
1
answer
171
views
Best way to secure documents? [closed]
I'm currently tasked with securing our documents stored in our NAS.
Basically, the minimum requirements that is needed are;
1) Watermarking Ability(Any file viewed/downloaded or printed will have the ...
1
vote
0
answers
657
views
user permissions and nginx with git hook for deployment
So I am trying to set up a webserver which will use nginx to serve a static site (for now). I set up a git repo that I want to push to in order to make deployment easy (using this guide: https://www....
