Questions tagged [privileged-account]
A user account with permissions to perform administrative actions within an operating system or application.
1
vote
1answer
38 views
Running jobs as local administrator vs domain administrator and their risks
I know for best practices we should always give an account least privilege and use that account to run jobs etc. However our windows jobs often require elevated privileges in order to perform the ...
1
vote
3answers
50 views
Is “permission (role) granting” safer, than giving direct access to primary account?
The role assignment is excellent feature over the various platforms (Google, GitHub, Facebook, etc. ).
However, I've been thinking about a specific security "threat" which might arise from that.
Let'...
2
votes
3answers
179 views
What's the best practical way to protect our IT administrators?
We're a medium-sized enterprise with many different IT administrators (e.g. domain admins, Azure admins, DB admins, ...). We're worried that hackers can easily breach an admin's laptop and through ...
0
votes
0answers
62 views
How to run command as privileged Windows service account against Active Directory domain controller?
I've compromised a Windows machine that leaks the password of a privileged service account ("Domain Admin") in memory (legal penetration test).
Since the account is a service account, it cannot be ...
0
votes
1answer
112 views
Principle of Least privilege; is it ever a 'good idea' to give standard users administrative privileges?
There are a number of users in the business who are required to perform administrative tasks on machines, not least the IT Service Desk, also Devs etc.
The only requirement for administrative access ...
3
votes
3answers
123 views
Why is it recommended to use accounts without sysop rights for everyday work?
Another recommendation I fail to understand.
The explanation is that, if I use admin account and manage to have my computer infected, the malware is able to take control over my entire system. But:
...
1
vote
3answers
181 views
Do large companies storing private user data ensure no single insider can abuse user data? if so, how?
Let's say we have a large company X which stores private user information. For example an e-mail provider, or social network provider. I mainly have GMail and Facebook in mind. So the company has ...
2
votes
2answers
194 views
Does clicking “no” to “Do you want to allow the following program … to make changes to this computer” mean I'm safe?
I recently got an unwanted exe automatically downloaded by my browser, and on going to delete it my useless trackpad registered misplaced my click and I ran it. I got the usual dialog about making ...
0
votes
1answer
319 views
Mysql user privileges for update query
In Mysql DBMS is it possible to assign USAGE privileges to a user which can do an update query? In order to prevent SQL-injection.
1
vote
1answer
190 views
Mysql Information schema column_privileges empty
I can try some SQL-injection against a ad-hoc damn web application in my virtual enviroment for educational purpose.
In one of these I obtain the table column_privileges (of Mysql Information schema) ...
21
votes
2answers
7k views
Backdoor account in passwd file
Long story short I was making sure a web app didn't create a LFI vuln by attempting to open /etc/passwd with it. My first attempt to prevent LFI was unsuccessful and listed out the file, and I noticed ...
4
votes
3answers
255 views
Should inactive administrator accounts be DELETED/expunged?
Given:
A web application
Some active administrator accounts.
Some inactive administrator accounts.
No existing "audit" mechanism to keep old accounts for.
Inactive administrators cannot log in.
Is ...
78
votes
8answers
10k views
Should the sole user of a *nix system have two accounts?
Should the sole user of a *nix (particularly Linux and MacOS) have two accounts, one with sudo privileges and one without? Years ago I read that on your personal computer you should do your daily ...
34
votes
4answers
4k views
Why is it a bad idea for management to have constant access to every employee's inbox?
This was prompted by my CEO asking to get permanent access to everyone's inbox.
He wants for his email client to be configured so that as well as his own email account, he can see the contents/...
0
votes
3answers
763 views
Software installations without local admin rights
In the light of fewer technicians to visit sites and install software on to PC's, users are requesting Local Admin rights to do it themselves.
Is there a safe way or procedure of doing this for users ...
1
vote
2answers
86 views
Why do websites still suffer from OS injections if by default web-servers are not assigned a shell?
So even if there is some poor php written which allows a shell_exec() and that someone disabled safe mode on it, what exactly are the risks? Do admins just change the default group or are most attacks ...
-1
votes
1answer
279 views
How does the ERAD device gain access to your personal bank account?
I am trying to get specifics on how exactly this ERAD device is able to access and withdraw from personal bank accounts.
http://www.dailykos.com/stories/2016/6/8/1536190/-Oklahoma-has-started-using-...
3
votes
5answers
1k views
May be justified to use generic and shared user accounts in order to segregate and reduce risk?
Imagine I have a group of users called "support" that participates solving different kinds of problems. Each user has a nominal username like jsmith that has not much privileges but additional ...
1
vote
1answer
3k views
Default accounts shutdown, halt, and sync - still shipping?
I'm curious as to whether, and if so why, Unix and Linux distributions still ship with default accounts shutdown, halt and sync. Specifically (from a Red Hat document),
sync:x:5:0:sync:/sbin:/bin/...
1
vote
3answers
1k views
Is it safer to be setup as a user with 'standard' vs 'administrative' privileges in Windows 10?
I am setting up a relatives computer using Windows 10. I am going to create them a 'standard user' account which I will encourage them to use as their every day account.
In addition to that I will ...
2
votes
1answer
577 views
In Windows, what should I do to run a program with admin rights without concerns?
I'm currently using Windows 8.1 - 64 bits.
In my computer, I have 2 accounts, 1 with admin power (used to install programs), and another without admin power (for everyday usage).
There's a certain ...
4
votes
1answer
87 views
Citations for Least Privilege network services?
The Principal of Least Privilege suggests that network services should not run with powerful and unnecessary capabilities. History teaches us that this is painfully necessary; 25 years ago Sendmail ...
30
votes
4answers
4k views
Can the root user be removed from a *nix system to prevent privilege-escalation?
Once a *nix system is properly configured and hardened, is it a conceivable strategy to remove all super user/root users? Are there benefits to removing root from a system altogether to prevent super-...
1
vote
3answers
134 views
Root access and malware
Would it help to defend against malware if I use a less privileged Windows 7 account for my day-to-day work?
5
votes
1answer
125 views
How can I objectively evaluate trust in a person? (Systems Admin, or other)
When recruiting for positions that require a level of integrity and trust, I'm looking for objective ways of accessing that, either positively or negatively.
Is there any any guidance one should use ...
3
votes
3answers
6k views
Is it dangerous to have the built-in Administrator account enabled?
I've seen it said that when using the built-in Windows Administrator account, the best practice is to enable it (net user administrator /active:yes), use it, and then disable it.
I do realize it's a ...
1
vote
1answer
705 views
Is it ok to have GRANT ANY ROLE privilege granted to an Oracle account which is expired & locked?
I know it's not considered secure to grant GRANT ANY ROLE privilege to other users apart from admins. But what if the user is expired & locked? In particular, I see these 2 users having this ...
0
votes
1answer
440 views
What's a least-privilege way to allow node.js to access network adapters on Linux?
Linux naturally restricts all but superuser from pulling traffic directly from network adapters. In the case of Wireshark/dumpcap, setuid root is used ONLY for dumpcap, restricting the privileges ...
4
votes
4answers
5k views
Postfix master running as root
Does running /usr/lib/postfix/master as a root could cause a security threat ?
A fresh installation, gives this :
root 11622 0.0 0.0 4792 1432 ? Ss 19:11 0:00 /usr/lib/postfix/...
0
votes
1answer
465 views
Limiting account access based upon NIC used to connect on Linux
I have a server which has multiple NICs (ignoring redundant pairs):
'inward' facing production (connects to other servers);
'outward' external facing production (connects out to the internet via a ...
0
votes
1answer
509 views
How should privileged accounts be secured in both Linux and Windows?
I have recently started work in application security at a mid-sized firm, having transitioned away from 5+ years in security consulting (pentesting, etc). One of the biggest challenges I see here from ...
1
vote
2answers
102 views
How many accounts should I have in an information system?
Is it a problem to have more than one account in an information system from security point of view?
Let me clarify a bit. It is a bank system. I wonder if having a CSO (customer service officer) ...
0
votes
3answers
171 views
Protecting local admin password against 3rd party software
I'm using a standard user account and then run whatever as administrator so that I type in administrator password...
I wonder if potentially undetected malicious software such as a trojan is able to ...
5
votes
3answers
6k views
Can I use 2 factor authentication for shared accounts?
Is it possible to use SecurID 2FA for Highly Privileged shared accounts? I am currently using CyberArk to vault passwords for privileged accounts. when I checkout a password, I would like to make sure ...
4
votes
1answer
292 views
Safely Use sudo Without allowing Other applications root privileges on Mavericks
I have noticed recently on OS X Mavericks that running sudo will not only allow one to run it again in the same window or even the same application, but will permit any application to run shell ...
1
vote
1answer
7k views
Exploiting SUID Binary that connects to SSH server
While conducting a pentest on a Linux machine, I have a limited shell and trying to escalate privileges.
One interesting thing that i have found is a binary called connect installed under /usr/local/...
2
votes
2answers
435 views
Time based event, console application on Windows Server — security implications
I'm a software engineer, and I've written several discreet utilities that run at specific times on Windows Server 2008. Generally speaking, they are console applications, need to access SQL Server, ...
2
votes
1answer
244 views
Will “upgrading” www-data user open up known security issues?
On a isolated local test/dev server I have elevated the nature of the www-data user to enable a smooth workflow for using Dropbox in a web/webapp development pipeline.
It has worked quite smoothly in ...
17
votes
8answers
992 views
Should the requirement of admin privileges be extended?
Seeing this comic from xkcd.com made me thinking:
Is extending the requirement of admin privileges to things such as connecting to the internet, running the web browser, reading browser and other ...
2
votes
2answers
161 views
Database security: Remove superuser role
I've recently heard on some IT-SEC conference, that good idea to secure database (probably against privilege-escalation attack) is to remove superuser role, and leave only user roles.
I imagine that ...
4
votes
3answers
6k views
How is it possible that a virus can infect the system if the browser is started with non-admin rights
If I open my web browser (for example firefox) in Windows 7 with activated UAC as normal user (non admin) a virus - which uses a security leak in my browser - will only gets privileges of the normal ...
6
votes
2answers
3k views
Is privilege escalation possible when shell is under www user?
So, suppose that someone obtained a shell of a remote machine (of course via Internet). But the (linux) shell is under www user. Would there be any way of trying privilege escalation?
1
vote
3answers
236 views
Maintain User Privileges After Shutdown in Windows XP?
Is it possible, in Windows XP, to maintain user privileges of a command shell after a reboot?
For example, I'm running as a non-privileged account LocalMachine\Pete, but have a shell running as ...
1
vote
1answer
354 views
Privilege usage checks
What does it mean that "the permission system does not include checks for transitive privilege usage" (quote from a paper on Privilege Escalation Attacks on Android).
Android grants app privileges ...
13
votes
3answers
3k views
Should an admin user be able to edit passwords?
For your typical web app, should an admin superuser have the right to edit a user's password, or should only that user have the right? (Even with edit ability, the admin would never see the current ...
3
votes
3answers
912 views
Do you give local administrator account password to notebook users?
My notebook users need to travel a lot.
Quite often, they need elevated privileges on that machine, like when adding a printer or change network settings.
Should I give them local administrator's ...
6
votes
3answers
3k views
Privilege Escalation Ubuntu
I am trying to learn how an attacker can escalate privileges in Ubuntu 10.04. I have heard that this can be done but no one has ever said how to do it. The best defense is knowing how it is done and ...
4
votes
1answer
394 views
How do I use Windows 7 virtualization features to prevent transitive trust of admin credentials?
I am exploring using VMs to separate my administrative actions from standard user actions in Windows 7. The goal is to limit my risk and exposure when using "RunAs" to open an application or file ...
12
votes
2answers
4k views
Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email
Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance
MSFT even went to far as create ADMINSDUser rights to put ...
16
votes
3answers
1k views
Is it OK to tell your password to an admin? [duplicate]
Possible Duplicate:
From a security point : Is it OK to tell your password to an admin?
I am working in a small company (20 employees) as a senior SW engineer.
After having some email problems, ...
