undefined | Better HN

Skip to content

Top Best Ask Show New Jobs

0 pointsmywittyname6y ago0 comments

My line of thinking was theft or data modification.

I have access to this box and it has granted me access to some other system which has useful data, like a database, NFS mount, or S3 bucket. Let me hop in here and grep for something juicy to steal, maybe flip some bits around to fuck with people, or just delete shit.

0 comments

6 comments · 2 top-level

dependenttypes6y ago· 3 in thread

> theft

You can't steal data unless if you intentionally delete the original after copying, but then that is not really theft as any proper organisation will have backups.

Sohcahtoa826y ago

You know what is meant. This kind of pedantry doesn't add to the conversation.

"Theft" is a nice easy word for making a copy of data that you do not have permission to access.

mc326y ago

So someone steals a book from a library isn’t theft because they have secondary copies?

0_gravitas6y ago

A better analogy would be photocopying all the contents of one of the books and putting it back on the shelf

parliament326y ago· 1 in thread

But an unprivileged user can't do any of that. The entire point of unix permissions is so you can't mess with other users' files unless you've explicitly been granted permission. File owned by, say, mysql are owned by a separate "mysql" user by default.

mywittynameOP6y ago

If there are readable configuration file sitting around, then it's totally possible to get the credential for other systems. I see this stuff all the time and have leveraged t his fact for troubleshooting systems that I'm unfamiliar with.

j / k navigate · click thread line to collapse