Hot answers tagged

189

Hacks that work just by changing the URL One legit and one malicious example Some examples require URL encoding to work (usually done automatically by browser) SQL Injection code: $username = $_POST['username']; $pw = $_GET['password']; mysql_query("SELECT * FROM userTable WHERE username = $username AND password = $pw"); exploit (logs in as ...


80

There's an even easier way to bypass the "execute" permission: copy the program into a directory you own and set the "execute" bit. The "execute" permission isn't a security measure. Security is provided at a lower level, with the operating system restricting specific actions. This is done because, on many Unix-like systems (especially in the days of ...


63

You seem to have a pretty clear understanding of the risks. As others have stated it highly encouraged to use a strong password, so if you are running a sensitive service, then by all means, please use strong passwords only. When using a weak password, there are a couple risks that come to mind which you did not mention: There may be other services besides ...


46

You might have guessed this, but never use the terminals pasting functionality to paste things into vim/emacs. It's like sending a batch of commands to the editor, that can do anything. For these reasons, editors have their own copy-pasting functionality, which cannot be injected. For instance, in vim, you should use the + register to exchange data with the ...


42

Yes, something just has to execute it. The X flag hints to the shell that it can be directly executed, but that doesn't stop other programs from executing it if they know how. For example, if you have a file a.sh which is not executable to the shell, you can execute it by calling bash a.sh (which tells bash explicitly to execute it). If you have a non-...


38

Because sudo allows much finer-grained controls than "login as root then do whatever you want." For example you can configure sudo so that some users are only allowed to run certain commands (like wrapper scripts or "acceptable" binaries). You're concerned about a trojan horse compromising a single-user's computer, but sudo was created to allow logging and ...


27

Note that as of version 292, xterm removes ASCII control characters except \b, \r, \t, DEL (0x7f) and \n (it converts \n to \rs like other terminals), and you can bring them back with the allowPasteControls resource. VTE (the terminal emulator library used by gnome-terminal, terminator, xfce-terminal...) also does it since October 2015 So in those terminals,...


26

You can set the execute bit, but not the read bit, on an executable file. That way, noone will be able to copy the file, but people can execute it anyway. This is quite pointless today, because a) it works for compiled programs only, not with scripts (on most systems); b) these days, with 90% of all unixes being linux, people can copy executables from just ...


25

This is a poorly phrased question. For instance, it does not define what is meant by "secure". That makes it harder to provide a useful answer. Here are three possible security concerns, and how X11 fares: Isolation between apps. X11 does not isolate apps from each other. If one app is malicious, it can grab all keystrokes, tamper with other apps ...


24

The (currently) most common way in is through holes in PHP applications. There are dozens of ways in which this could work, but here's a simple, easy one: Imagine the unsuspecting site owner decides to take a shortcut in his code such that http://example.com/site.php?module=xyz actually first loads some template shell and then run "xyz.php" to fill in the ...


24

From their own FAQ: Q: Has your secure datagram protocol been audited by experts? A: No. Mosh is actively used and has been read over by security-minded crypto nerds who think its design is reasonable, but any novel datagram protocol is going to have to prove itself, and SSP is no exception. We use the reference implementations of AES-128 and OCB, and we ...


21

"Exploiting" an application means making it do, with the privileges under which it is running, some things that it was not meant to do. passwd runs as root because it needs to read and modify files (in particular /etc/shadow) that can be read and written only by root. The normal behavior of passwd is to alter the password of the user who runs it (passwd is ...


21

To answer my own question: It seems that some systems are, or rather were indeed insecure, leaking environment information to other processes. A similar issue to the present one is raised on github by user 'mitchblank' for the 'mosh' application (mobile shell). The author writes: Background: in the process image argv[] and envp[] are stored in the same ...


21

Basically it's using the suid bit. If you check the passwd command in your machine: -rwsr-xr-x 1 root root 43K Feb 15 2011 passwd SUID (Set owner User ID up on execution) is a special type of file permissions given to a file. Normally in Linux/Unix when a program runs, it inherits access permissions from the logged in user. SUID is defined as ...


19

Well, it turns out that my current approach to clipboarding is good at mitigating this. When copy pasting snippets between tabs, I just copy paste normally. However, when copy pasting into a terminal/PuTTY session, I (being a bit averse to editing the text in the terminal), usually assemble it in Notepad++ or Emacs (depending on OS) and then copy-paste ...


18

I could claim that any copy&paste of code snippets is a bad habit, but that's side-stepping the issue. I personally type such code elements instead of copying them, but that's because I usually want to change some things in them, or learn how to do the task at hand; or maybe I am just a raving maniac. What you could do is to automatically sanitize ...


18

Aside what's mentioned by the other users, sudo also keeps the original identity of the user that's executing the command. Meaning that you can track what userid performed the command. If you are using root in a multiuser environment, you will not be able to track the execution of a command to a single user as the uid will be 0.


17

There are valid convenience uses for sudo, but because they are already adequately explained in other posts, I won't elaborate on them much here. I will however point you to sudoers(5), which is the sudo configuration file. It shows some of the extensive configuration possible with sudo. I will be explaining when and why you should not use sudo to elevate ...


16

environ is a pointer to pointer, as it has the type char **environ. You have to try something like: (gdb) x/s *((char **)environ) 0xbffff688: "SSH_AGENT_PID=2107" (gdb) x/s *((char **)environ+1) 0xbffff69b: "SHELL=/bin/bash"


15

No, it's not entirely secure. Let's look at each of the commands: dd if=/dev/urandom bs=256 count=1 2> /dev/null This will read a single 256 byte block from /dev/urandom, a cryptographically secure random source. The problem starts here, and is related to this 256 byte limit. In fact, you do not even need to use dd here. The next command is perfectly ...


14

Linux passwords are stored in the /etc/shadow file. They are salted and the algorithm being used depends on the particular distribution and is configurable. From what I recall, the algorithms supported are MD5, Blowfish, SHA256 and SHA512. Most recent distributions should be on SHA512 by default if my memory serves me right.


14

You do not need a strong password. The advise about password, like so many others, is a safe default that we security professionals give because it is usually a good advise, many people (and companies) don't understand risk very good, and in case of doubt, err on the side of caution. If you not only understand, but already mitigated the risks, you are good....


14

Normally, when su runs, it runs setuid (as root). When you start it with gdb, the setuid bit doesn't take effect (because it's being ptraced), so even if you convince it that you entered the right password, it won't have permission to actually give you a new UID. The reason for this is to mitigate the exact attack you describe.


12

man chmod #Debian Linux RESTRICTED DELETION FLAG OR STICKY BIT The restricted deletion flag or sticky bit is a single bit, whose interpretation depends on the file type. For directories, it prevents unprivileged users from removing or renaming a file in the directory unless they own the file or the ...


12

The MySQL root user is an account inside the database only. It is called root because it is the most privileged user on the database server, and has access to everything. The root user on Linux (or any other Unix) is a completely separate thing. The maximum privilege that a MySQL user can have is equal to the privilege that the MySQL daemon runs at. On most ...


11

Use Samba 3.3.x+ and set server signing = [auto|mandatory|disabled] in the Global section (disabled by default). Share level SMB encryption is auto by default. This has been tested with WinXP/Win7 and AIX 5.3 running Samba 3.6.7. SMB encryption became available in Samba 3.2 but server signing did not appear until 3.3. These are required for Win7 clients ...


11

Very frightening! As a risk, this should be raised to the board - effectively an attacker on the internet only needs to find out that username and password (or an SSH 0-day) and your entire corporate network should be considered compromised. Could the business run without it? Is there anything sensitive on it? This is a bad idea in so many ways: It ...


11

There are 2 ways of looking at it, you could focus on the server itself, or focus on the web application that the server is running. As a server, it can have open ports running services that you can connect to and gain access to the server. By using known exploits, you could gain root access. For example, some FTP servers for Unix have vulnerabilities that ...


11

Let's say you have the file myscript containing the following: #!/bin/bash echo "Hello, World!" If you make this file executable and run it with ./myscript, then the kernel will see that the first two bytes are #!, which means it's a script-file. The kernel will then use the rest of the line as the interpreter, and pass the file as its first argument. ...


9

If someone has physical access to the machine they can modify these files to create a new root account or crack existing password hashes which is useful due to the prevalence of password reuse. Renaming or changing the location would be "(in)security though obscurity" and will provide no appreciable protection against this attack pattern. Steps to protect ...


Only top voted, non community-wiki answers of a minimum length are eligible