Questions tagged [file-access]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
42 views

OpenSSH artifacts, remote system access? [duplicate]

After stumbling upon some unknown folders in my unused OneDrive (posted question), I did some digging arround and found some interesting logs. Apparently, OpenSSH had been used for remote access on my ...
0
votes
1answer
57 views

Unknown folders in OneDrive

Today I opened OneDrive by accident, since I do not use it. To my surprise, inside there were unknown folders, in foreign (to me) languages. Namely, "document" and "photo" folders ...
0
votes
0answers
29 views

Generate C File Stream Object on remote machine without fopen()

Let's say we have an elf a and a textfile a.txt in the same directory. The a elf is a program, that is remotely accessible/executable. In addition a contains the instruction fgets(buf,len,stdin); and ...
1
vote
1answer
63 views

Host filesystem manipulation from docker vs. virtual machine

When reading about docker, I found a part of the documentation describing the attack surface of the docker daemon. From what I was able to understand, part of the argument is that it is possible to ...
2
votes
2answers
109 views

Can my school computer see my files via USB?

I was issued a chromebook, as was everyone at my school, to use for work in class and in case school has to shut down again. We bring it home so it connects to my personal Wi-Fi when I'm at home. I ...
0
votes
0answers
47 views

Can Citrix Workspace access host filesystem?

I'm doing freelancing for multiple clients and one asked me to work on their computer using Citrix Workspace. Can it access my computer's local file system (even on metadata level, like filenames)? ...
46
votes
2answers
11k views

Claim that Skype is an unconfined application able to access all one's own personal files and system resources

Situation I was about to install Skype on a laptop driven by Ubuntu 18.04 LTS Desktop. The software installation helper graciously informs me that Skype is unconfined. It can access all your personal ...
1
vote
1answer
269 views

Secure File Replication between LAN and DMZ

Our support staff established remote access connection from jumphosts that are isolated within a DMZ. To provide support they need project files (up to a few GB of size) which are stored on a file ...
0
votes
0answers
680 views

How to encrypt user files securely on the server with PHP

Description: I want to create an upload center for small files (word/excel/zip documents etc) with PHP. I want to protect files uploaded by user as much as possible, so if server is breached, ...
1
vote
0answers
79 views

How is mkdir subject to a TOCTOU attack?

My answer here, resulted in this comment: This could be subject to a TOCTOU1 attack and needs to be developed to be correct. The answer is in Rust, but here's some equivalent bash: p=/home/roger/...
5
votes
1answer
172 views

Can a non-privileged user modify the file descriptor table of an elevated process?

In Linux, every process holds its own file descriptor table, which keeps references to all opened files and file-like devices. This table is managed by the kernel. Is it possible that a non-...
3
votes
0answers
63 views

Storing user's private files on S3 and securing access using signed URLs - good idea?

I will be storing private user's files on S3. The files will be PDFs, possibly containing private financial information. I'm considering letting users directly access the files on S3, without ...
23
votes
1answer
4k views

Does a single fopen introduce TOCTOU vulnerability?

I'm actually fixing driver under Linux. Klokwork said that code like: file = fopen(fileName, "w+"); // w+,r,a and any mix of those is used here if (file != NULL) { /* do things*/ } else { /* throw ...
1
vote
1answer
108 views

Can script steal sensitive data in home directory on Linux and is SELinux optimal way/tool to prevent it

The premise: on a Linux workstation I regularly download and use various software, let's say Perl or Nodejs modules. When I use them they run on the machine with me as the owner and can do whatever I ...
0
votes
2answers
61 views

Encrypted folder with different access rights for different users

With the GDPR (General Data Protection Regulation of EU) comes the necessity for many companies to store certain personal data (CVs, certificates, passport copies, etc.) centrally and encrypted. The ...
0
votes
2answers
69 views

Preferred access mode for a directory with PHP scripts and the PHP script itself

The people I work with have the tendency to set the access mode in numerical notation to 777 every time they face access right problems. The mess is caused by using many users. The creator of ...
0
votes
1answer
137 views

How to prevent a specific program from reading my files?

My issue is more towards blocking a specific application/program (In this case, the Epic Games Launcher) from accessing my files. I know the best answer is just to remove that software. The reason ...
0
votes
0answers
50 views

How to protect certain macOS user directory from unauthorized access?

I have several directories on my Mac, two most popular examples are: ~/.aws ~/.ssh They can be read by any script file or third-party app in system. I do not see a way to protect them in macOS (...
0
votes
3answers
230 views

How to protect company sensitive data from being deleted by a user when data is on their computer?

There more than 300 computers and more than 400 users are available. We face two incidents recently when critical users(who has critical data) leave from company.We have deleted their data when they ...
2
votes
1answer
116 views

How can I block access to module for Firefox? (gmail accessing camera)

I run the following command in the background constantly to check for camera access on Ubuntu Linux: lsmod | grep ^uvcvideo I noticed that every time I load into gmail my check is triggering my ...
1
vote
2answers
5k views

Tomcat application arbitrary file read exploitation

In recent black-box pen-test of a webapp hosted on CentOS, I found a vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the home path of Tomcat. In ...
1
vote
2answers
186 views

What can a site visitor do with a 777 file on my web server?

Sometimes I prefer working with text files instead of database as I can later manually edit the file content. Imagine I have created a text file blacklist and chmodded it to 777. Let's say it is ...
3
votes
0answers
49 views

Is it possible for a remote machine to “escape” from a folder mapped through RDP?

Although most people seem to share entire drives with RDP, it is possible to share individual folders, by mapping them to a drive for example with subst <lettertomap>: <pathtofolder> (for ...
4
votes
1answer
2k views

Hacked Wordpress /index.php and /wp-content/themes/Avada/footer.php

I woke up today to see the top and bottom pages of my website displaying a link with text "Cheap Jerseys Free Shipping". I quickly went in and saw that /index.php and /wp-content/themes/Avada/footer....
2
votes
0answers
221 views

Concerns about LaTeX 3 shell escape code

What are the security risks in this line of LaTeX code, and what can be done to reduce them? The LaTeX3 project wants TeX macros to be able to do file operations via shell escape. { cp~-RLf~ \...
46
votes
3answers
8k views

Reason to not use chmod -R 777 on internal server for project source code?

From my days of amateur web development the principle of least privilege has beaten into me not to use chmod -R 777 dir. I have personally never needed it, so I've never used it. I now work on a ...
128
votes
9answers
34k views

What stops Google from saving all the information on my computer through Google Chrome?

I noticed that in Google Chrome, if I type in file:///C:/Users/MyUsername/Desktop/ it shows me all of the folders on my Desktop, and I can type open up PDFs and such in chrome just by typing in the ...
3
votes
1answer
121 views

To workaround a FreeBSD ACL bug I need to grant “read attributes/ACLs” to untrusted Samba users. Not happy about security - can practical harm result?

I've found either one, or more than one, bug, in ACL evaluation, when running Samba on FreeBSD. I can't be sure if these are facets of the same bug or related bugs - they're very similar but do have ...
1
vote
1answer
149 views

How to deny execution of any file on a specific directory?

I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the ...
0
votes
1answer
66 views

Permission to a user in a subfolder inside a folder to which he does not have access [closed]

I have a Windows Server 2012 and I need to configure the privileges to a group called DP_Preven. This is the scenario: I have a folder called X where only a few groups have access, inside that ...
0
votes
2answers
99 views

How to give someone access to a file, on a website, securely without relying on a single password?

I have created an online donation form for a Public Library. The form collects names, phone numbers, emails, addresses (a lot of personal info). The form is submitted to a PHP script that saves the ...
2
votes
1answer
62 views

Erasing files and passes - how to understand them? [duplicate]

A few months ago, I downloaded Edenwaith Permanent Eraser from the edenwaith website and set it to DoE (3x) in the preferences. I am using Mac Mini 2011, MacOS Sierra, and use it to delete files and ...
1
vote
1answer
255 views

How secure is it to store passwords in a non-accessible file?

So, I was thinking about workarounds for saving passwords in text files (just because I'm curious), and I thought, what if I saved my file somewhere that is non-accessible? My server has a public_html ...
2
votes
1answer
152 views

Protecting folder contents from processes

Let's consider the following: Linux is the platform I am referencing here There exists a partition on the system that's encrypted with a strong password (via the LUKS mechanism, if it's relevant to ...
3
votes
3answers
3k views

Where are NTFS security ACLs stored on Windows systems?

Are per-file and directory access permissions for an user or a group stored as part of the NTFS structures on-disk? Or are they recorded in the registry database for an installed Windows OS, or ...
2
votes
1answer
1k views

Can a smartphone be accessed only by knowing its IMEI?

I have an old smartphone that I want to use only as a media player/portable radio/voice recorder. It doesn’t have a SIM card and it’s not connected to WiFi. I am curious however can the files on it ...
3
votes
1answer
107 views

Which is the most recommended way to expose a file to a computer in an external network in a secure way?

I have two machines in an internal network. One is a development server, which is isolated from external communications (neither through HTTP, HTTPS, SSH, etc). The last one is a production server (...
2
votes
1answer
94 views

How to get sticky bit like ACL but for specific Linux user only?

Sticky bit set for a directory is a mean for "Restricted Deletion" — according to manual: For directories, it prevents unprivileged users from removing or renaming a file in the directory unless ...
1
vote
1answer
312 views

How can I capture files malware creates and then deletes? [closed]

Malware on Windows often creates and deletes files. How can I capture the files it creates if it deletes them too quickly to copy?
0
votes
1answer
127 views

Best way to secure documents? [closed]

I'm currently tasked with securing our documents stored in our NAS. Basically, the minimum requirements that is needed are; 1) Watermarking Ability(Any file viewed/downloaded or printed will have the ...
1
vote
0answers
510 views

user permissions and nginx with git hook for deployment

So I am trying to set up a webserver which will use nginx to serve a static site (for now). I set up a git repo that I want to push to in order to make deployment easy (using this guide: https://www....
6
votes
1answer
198 views

If forced to download files using FTP, what steps can be taken to provide security?

I am in a situation where I must access data via FTP on a regular basis (for argument's sake, updated every 10 minutes). No other protocol is available for this operation. This data needs to be put ...
1
vote
1answer
83 views

How would rw permissions on an Apache directory actually be compromised?

I have a directory on an Apache server dedicated to serving images, and I have those images rw for www-data (Apache process runs as www-data). I've configured it like this, because in the ...
1
vote
3answers
516 views

Rationale behind SELinux preventing file access

Some of the few times I've had to deal with SELinux were when I setup a local webserver on a Fedora box. Problems occurred when a web application tried to write files to the file system. I'm used to ...
2
votes
4answers
145 views

Security and conventions. DB or File?

Let me start off by stating I know the benefits of a database but that is not the question. I want to know if the security makes sense with an added benefit of speed. By using PHP 7.0, Test 1: I ...
8
votes
5answers
356 views

Could ransomware be stalled while encrypting?

I have been reading about ransomware, and I was wondering if it could be defended against by having certain "trap" files on a drive. Sometimes I look through Code Golf and am thoroughly impressed by ...
2
votes
1answer
162 views

A file that doesn't allow copy/paste or print

We know that Adobe pdf's convenient control features for discouraging copy/paste and print are not real security measures. We are searching for a way to create a file that has default security set ...
0
votes
1answer
768 views

Limit file access to admin and application on Windows 10?

I'm looking for a way to secure special made config files on an Windows 10 installation: A user without admin rights must not have direct access to the unencrypted text file. A closed source ...
1
vote
1answer
210 views

How did stuxnet hid it's files after the infection?

I've noticed that when ~WTR4141.tmp is loaded, it doesn't set hidden file attributes to .lnk files and on the other .tmp rootkit file of the Stuxnet bundle. I've seen that these are all the possible ...
3
votes
1answer
974 views

Do AppArmor/SELinux provide any security for workstation?

I decided to harden security on my primary workstation a bit. Before I used to use firejail for certain less trusted apps (all apps with internet access) but it's kind of toy. Didn't work really well ...