Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [file-access]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
0 answers
43 views

How to create read-only pendrive (no availability of coping, deleting or overwriting) [duplicate]

I want to create pendrive or external HDD, that is read only. To be precise - I want to be open to read files on it (documents or video files), but to prevent files from being copied off disk. As I ...
Herman Pompka's user avatar
0 votes
1 answer
69 views

SACL for shadow copies

I'm researching the topic of detecting registry dump from disk shadow copies and realize that I don't see any specific events in the Windows and Sysmon logs. I tried a simple copy with the command: ...
ganbg's user avatar
  • 11
1 vote
0 answers
65 views

Best collaboration and file sharing platform across multiple organizations (and IT ecosystems) [closed]

Four discrete organizations wish to share calendars, files, and folders for collaboration purposes on multi-year projects (including regular online and in-person events). Each one has their own ...
Bashi's user avatar
  • 11
1 vote
1 answer
194 views

Unlisted directory discovery of a web server without using bruteforce attacks

Some creator I support on SubscribeStar hosts their files on a dedicated AWS web storage server of theirs and the names are easily accessible and sometimes guessable without any kind of security or ...
Matcha's user avatar
  • 111
1 vote
0 answers
2k views

Can I know if someone transferred files from my mobile to their computer

If someone connected my phone through USB to computer or laptop and transferred files from my mobile, is there any option to check in my mobile that they used particular apps or opened and transferred ...
Shekar Bodhanapu's user avatar
1 vote
1 answer
201 views

Can websites, through cookies or other usual means, access PDFs opened in browser?

Can websites through the use of cookies or other usual means, see the content in a PDF (saved and opened locally or opened from the web) that is also opened in the browser at the same time, or in the ...
AndroidUser558's user avatar
0 votes
1 answer
766 views

PHP - How to block files access in specific directory from the external

I made a very simple dashboard with HTML/PHP/JS (and a MySQL database) where some users (after a secure login with username and password) can access and insert some activities with details and attach ...
ducarpit's user avatar
0 votes
1 answer
120 views

Ways to inject malicious content during a HTTP file transfer

Assume an Apache server (http, no authentication just hosting static files) is running in my local network which is hosting some zip files. Assume User A is requesting a zip file from the Apache ...
patrick jason's user avatar
0 votes
1 answer
77 views

How to prevent a user retaining file access with an open handle on Windows?

Suppose a user is a member of a group, and they open (in the Windows API sense) a file whose DACL grants access to that group. Then, the user stops being a member of the group. Since access checks are ...
Quitting Due To Antisemitism's user avatar
0 votes
1 answer
134 views

How can opening a non-existing file cause a security vulnerability?

I was reading on race conditions when I encountered the paragraph below: How exactly does trying to read a non-existing file cause a security vulnerability?
true_north_404's user avatar
0 votes
0 answers
66 views

Possible pitfalls with filesharing using local account instead of domain account

I've recently eradicated Active Directory from my network. However, I'm having trouble verifying there is no issue with sharing files using a local account instead of a domain account. I have exactly ...
NRA's user avatar
  • 1
0 votes
3 answers
540 views

If email is an insecure medium, why are usernames and passwords sent via email (albeit in separate ones)?

At work we are using a secure file transfer utility that, after setting it up, sends you and the participants you want to share those files with, two emails. One email contains the randomised username,...
Alex Ixeras's user avatar
1 vote
1 answer
261 views

Does adding a randomized string in S3 file path has equal security to Google Drive shared link

I would like to use an AWS S3 bucket to store my IoT firmware file and allows all of my IoT devices to access it to update the firmware to the latest version. I want that the firmware file in the S3 ...
asinkxcoswt's user avatar
0 votes
3 answers
169 views

How to technically introduce my boss to computer file security?

My boss truly believes that keeping files on paper and locked in his drawer is the safest place ever. He is the type of guy that processes a file in Word/Excel, prints it, delete the file and store ...
RA828's user avatar
  • 473
0 votes
0 answers
55 views

OpenSSH artifacts, remote system access? [duplicate]

After stumbling upon some unknown folders in my unused OneDrive (posted question), I did some digging arround and found some interesting logs. Apparently, OpenSSH had been used for remote access on my ...
user851's user avatar
  • 101
1 vote
1 answer
215 views

Generate C File Stream Object on remote machine without fopen()

Let's say we have an elf a and a textfile a.txt in the same directory. The a elf is a program, that is remotely accessible/executable. In addition a contains the instruction fgets(buf,len,stdin); and ...
Simon Huenecke's user avatar
1 vote
1 answer
230 views

Host filesystem manipulation from docker vs. virtual machine

When reading about docker, I found a part of the documentation describing the attack surface of the docker daemon. From what I was able to understand, part of the argument is that it is possible to ...
AlexV's user avatar
  • 111
1 vote
2 answers
4k views

Can my school computer see my files via USB?

I was issued a chromebook, as was everyone at my school, to use for work in class and in case school has to shut down again. We bring it home so it connects to my personal Wi-Fi when I'm at home. I ...
Sandy's user avatar
  • 11
45 votes
2 answers
12k views

Claim that Skype is an unconfined application able to access all one's own personal files and system resources

Situation I was about to install Skype on a laptop driven by Ubuntu 18.04 LTS Desktop. The software installation helper graciously informs me that Skype is unconfined. It can access all your personal ...
XavierStuvw's user avatar
1 vote
1 answer
2k views

Secure File Replication between LAN and DMZ

Our support staff established remote access connection from jumphosts that are isolated within a DMZ. To provide support they need project files (up to a few GB of size) which are stored on a file ...
gumlozol's user avatar
0 votes
0 answers
2k views

How to encrypt user files securely on the server with PHP

Description: I want to create an upload center for small files (word/excel/zip documents etc) with PHP. I want to protect files uploaded by user as much as possible, so if server is breached, ...
J. Doe's user avatar
  • 61
1 vote
0 answers
311 views

How is mkdir subject to a TOCTOU attack?

My answer here, resulted in this comment: This could be subject to a TOCTOU1 attack and needs to be developed to be correct. The answer is in Rust, but here's some equivalent bash: p=/home/roger/...
Roger Lipscombe's user avatar
5 votes
1 answer
372 views

Can a non-privileged user modify the file descriptor table of an elevated process?

In Linux, every process holds its own file descriptor table, which keeps references to all opened files and file-like devices. This table is managed by the kernel. Is it possible that a non-...
user avatar
3 votes
0 answers
169 views

Storing user's private files on S3 and securing access using signed URLs - good idea?

I will be storing private user's files on S3. The files will be PDFs, possibly containing private financial information. I'm considering letting users directly access the files on S3, without ...
ssobczak's user avatar
  • 131
24 votes
1 answer
6k views

Does a single fopen introduce TOCTOU vulnerability?

I'm actually fixing driver under Linux. Klokwork said that code like: file = fopen(fileName, "w+"); // w+,r,a and any mix of those is used here if (file != NULL) { /* do things*/ } else { /* throw ...
user209896's user avatar
1 vote
1 answer
368 views

Can script steal sensitive data in home directory on Linux and is SELinux optimal way/tool to prevent it

The premise: on a Linux workstation I regularly download and use various software, let's say Perl or Nodejs modules. When I use them they run on the machine with me as the owner and can do whatever I ...
d.k's user avatar
  • 281
0 votes
2 answers
150 views

Encrypted folder with different access rights for different users

With the GDPR (General Data Protection Regulation of EU) comes the necessity for many companies to store certain personal data (CVs, certificates, passport copies, etc.) centrally and encrypted. The ...
gebrerv's user avatar
0 votes
2 answers
147 views

Preferred access mode for a directory with PHP scripts and the PHP script itself

The people I work with have the tendency to set the access mode in numerical notation to 777 every time they face access right problems. The mess is caused by using many users. The creator of ...
Julian's user avatar
  • 101
1 vote
2 answers
2k views

How to prevent a specific program from reading my files?

My issue is more towards blocking a specific application/program (In this case, the Epic Games Launcher) from accessing my files. I know the best answer is just to remove that software. The reason ...
Noah Persons's user avatar
0 votes
0 answers
170 views

How to protect certain macOS user directory from unauthorized access?

I have several directories on my Mac, two most popular examples are: ~/.aws ~/.ssh They can be read by any script file or third-party app in system. I do not see a way to protect them in macOS (...
Croll's user avatar
  • 163
0 votes
3 answers
489 views

How to protect company sensitive data from being deleted by a user when data is on their computer?

There more than 300 computers and more than 400 users are available. We face two incidents recently when critical users(who has critical data) leave from company.We have deleted their data when they ...
Infra's user avatar
  • 655
2 votes
1 answer
218 views

How can I block access to module for Firefox? (gmail accessing camera)

I run the following command in the background constantly to check for camera access on Ubuntu Linux: lsmod | grep ^uvcvideo I noticed that every time I load into gmail my check is triggering my ...
David Kamer's user avatar
1 vote
2 answers
11k views

Tomcat application arbitrary file read exploitation

In recent black-box pen-test of a webapp hosted on CentOS, I found a vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the home path of Tomcat. In ...
puni aze's user avatar
1 vote
2 answers
473 views

What can a site visitor do with a 777 file on my web server?

Sometimes I prefer working with text files instead of database as I can later manually edit the file content. Imagine I have created a text file blacklist and chmodded it to 777. Let's say it is ...
Mehdi Haghgoo's user avatar
3 votes
0 answers
137 views

Is it possible for a remote machine to "escape" from a folder mapped through RDP?

Although most people seem to share entire drives with RDP, it is possible to share individual folders, by mapping them to a drive for example with subst <lettertomap>: <pathtofolder> (for ...
gbr's user avatar
  • 270
4 votes
1 answer
3k views

Hacked Wordpress /index.php and /wp-content/themes/Avada/footer.php

I woke up today to see the top and bottom pages of my website displaying a link with text "Cheap Jerseys Free Shipping". I quickly went in and saw that /index.php and /wp-content/themes/Avada/footer....
Waqas Tariq's user avatar
2 votes
0 answers
383 views

Concerns about LaTeX 3 shell escape code

What are the security risks in this line of LaTeX code, and what can be done to reduce them? The LaTeX3 project wants TeX macros to be able to do file operations via shell escape. { cp~-RLf~ \...
Jonathan Fine's user avatar
46 votes
3 answers
10k views

Reason to not use chmod -R 777 on internal server for project source code?

From my days of amateur web development the principle of least privilege has beaten into me not to use chmod -R 777 dir. I have personally never needed it, so I've never used it. I now work on a ...
user1717828's user avatar
  • 2,402
128 votes
8 answers
35k views

What stops Google from saving all the information on my computer through Google Chrome?

I noticed that in Google Chrome, if I type in file:///C:/Users/MyUsername/Desktop/ it shows me all of the folders on my Desktop, and I can type open up PDFs and such in chrome just by typing in the ...
Pro Q's user avatar
  • 1,349
3 votes
1 answer
224 views

To workaround a FreeBSD ACL bug I need to grant "read attributes/ACLs" to untrusted Samba users. Not happy about security - can practical harm result?

I've found either one, or more than one, bug, in ACL evaluation, when running Samba on FreeBSD. I can't be sure if these are facets of the same bug or related bugs - they're very similar but do have ...
Stilez's user avatar
  • 1,694
1 vote
1 answer
229 views

How to deny execution of any file on a specific directory?

I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the ...
Luca Reghellin's user avatar
0 votes
1 answer
169 views

Permission to a user in a subfolder inside a folder to which he does not have access [closed]

I have a Windows Server 2012 and I need to configure the privileges to a group called DP_Preven. This is the scenario: I have a folder called X where only a few groups have access, inside that ...
U. Busto's user avatar
  • 101
0 votes
2 answers
173 views

How to give someone access to a file, on a website, securely without relying on a single password?

I have created an online donation form for a Public Library. The form collects names, phone numbers, emails, addresses (a lot of personal info). The form is submitted to a PHP script that saves the ...
user7886229's user avatar
2 votes
1 answer
138 views

Erasing files and passes - how to understand them? [duplicate]

A few months ago, I downloaded Edenwaith Permanent Eraser from the edenwaith website and set it to DoE (3x) in the preferences. I am using Mac Mini 2011, MacOS Sierra, and use it to delete files and ...
avenas8808's user avatar
1 vote
1 answer
478 views

How secure is it to store passwords in a non-accessible file?

So, I was thinking about workarounds for saving passwords in text files (just because I'm curious), and I thought, what if I saved my file somewhere that is non-accessible? My server has a public_html ...
Joshua Sparkel's user avatar
2 votes
1 answer
347 views

Protecting folder contents from processes

Let's consider the following: Linux is the platform I am referencing here There exists a partition on the system that's encrypted with a strong password (via the LUKS mechanism, if it's relevant to ...
Alex's user avatar
  • 167
4 votes
3 answers
6k views

Where are NTFS security ACLs stored on Windows systems?

Are per-file and directory access permissions for an user or a group stored as part of the NTFS structures on-disk? Or are they recorded in the registry database for an installed Windows OS, or ...
NimbUs's user avatar
  • 101
2 votes
1 answer
4k views

Can a smartphone be accessed only by knowing its IMEI?

I have an old smartphone that I want to use only as a media player/portable radio/voice recorder. It doesn’t have a SIM card and it’s not connected to WiFi. I am curious however can the files on it ...
peter_s's user avatar
  • 23
3 votes
1 answer
402 views

Which is the most recommended way to expose a file to a computer in an external network in a secure way?

I have two machines in an internal network. One is a development server, which is isolated from external communications (neither through HTTP, HTTPS, SSH, etc). The last one is a production server (...
addictedtohaskell's user avatar
1 vote
1 answer
270 views

How to get sticky bit like ACL but for specific Linux user only?

Sticky bit set for a directory is a mean for "Restricted Deletion" — according to manual: For directories, it prevents unprivileged users from removing or renaming a file in the directory unless ...
poige's user avatar
  • 126