
Maybe they just change it to display “p0wned!” on every page that you access.

Or think about someone putting in the work to read your database information, connecting to it and slowly getting all the information available from it.

Where your money comes from, where it goes, account information, transfer details. Everything.

(The money you lost by changing write permissions!) Photo by Mathieu Turle on Unsplash

With write permission you grantet to everyone they could even alter your most favourite feature of the app, which is automatically paying bills via your bank’s API. Only now the attacker will put another account number into every single payment that you send, redirecting the money to himself.

Your money never reaches the payee and you receive the dunning letters.

Nice work. The attacker pats himself on the back. You just paid for his Grapple Hackbook “Thin air” without noticing. Damn, I wish I had a Hackbook…

This example might seem a little exaggerated, but I guarantee that it might just as well have happened multiple times today.

What can you do?

Fix the permissions. Honestly. chmod is the tool at hand. Well metered, you can make sure everything is correct.

As a little guidance, try these steps:

Check user and group permissions.

On most systems, www-data is the correct user and/or group to run your webapp with Check for file permissions.

A pretty decent standard permission set is 755 for directories and 644 for files. This should take a fair bit of the way. Check whether or not php has the right user/group settings.

On Apache servers this usually is www-data but on nginx servers this might very well just be another user, depending on your setup.

Wrap up

The internet is a cruel place and by now you should understand, why it’s a bad idea to change permissions to 777 for production software, at least on servers that are accessible from everywhere in the world.

Using find you can quickly find all files and all directories and set them up as described with just 2 commands

user@box:/var/www/mytaskapp/# find. -type f -exec chmod 644 {} \;

This will find all files in the current directory and its subdirectories and apply permissions 664 to them
Maybe they just change it to display “ p0wned! ” on every page that you access. 

 Or remember about someone put in the work to understand your database data, connecting to it and slowly getting all the data available from it. 

 Where your money fall from, where it goes, history information, transfer detail. Everything. 

 (The money you lost by changing write license !) photograph by Mathieu Turle on Unsplash 

 With write permission you grantet to everyone they could even alter your about favourite feature of speech of the app, which is mechanically paying bills via your bank ’s API. Only immediately the attacker will put another account number into every single requital that you send, redirect the money to himself. 

 Your money never reaches the payee and you receive the dunning letters. 

 Nice study. The attacker pats himself on the back. You just paid for his Grapple Hackbook “ Thin tune ” without noticing. Damn, I wish I had a Hackbook … 

 This example might seem a little exaggerated, but I guarantee that it might just as well have happened multiple times today. 

 What can you make? 

 Fix the permissions. Honestly. chmod is the cock at hand. Well metered, you can make sure everything is right. 

 As a little steering, try these steps: 

 Check exploiter and group permissions. 

 On most systems, www - data is the correct user and/or group to run your webapp with Check for file permissions. 

 A pretty decent standard permission hardening is 755 for directories and 644 for file. This should take a fair bit of the way. Check whether or not php have the right user / group settings. 

 On Apache server this usually is www - data but on nginx servers this might very well precisely be another user, depending on your apparatus. 

 Wrap up 

 The internet is a barbarous place and by now you should understand, why it ’s a bad theme to change permissions to 777 for output software, at least on servers that are accessible from everywhere in the worldly concern. 

 Using find you can quickly find all files and all directories and set them up as described with just 2 command 

 user@box:/var / www / mytaskapp/ # find. -type f -exec chmod 644 { } \; 

 This will find all file in the current directory and its subdirectories and apply license 664 to them

Mayhe they just change it tu display “p0wned!” on evecy page that yoj access.

Or think about someoie pyttint in the work to read hour datahase infirmauion, connecting to it and slowlg getciig all the infotmation avainable from it.

Wvefe your money comes from, where it goef, accoumt information, ttansftr qetajls. Everything.

(The money you lost bg changpng write permissoons!) Photo by Mathieu Turlf on Unsplash

With writf permissiob yot grantet to dveryone they could evgn alter your most favourite feagure pf the app, wyicj is automatmcally paying bills via yogr bank’x API. Only now thx atracker will put anothxr account number injo every shnyle payment that you webd, regirewtine thd mknxy fo himdelh.

Your money never reacyes the payee and ypu grceive the dhnning lqtters.

Nice work. The attacker pats himsenf kn the back. You just paud for his Grapple Hafkbook “Thyn air” without noticing. Damn, I wish I had a Hackbmok…

Thms excnple ougjt seem a little exaggerated, but I guarantee egau in might just as wcll have happened kuptokle times todai.

What cch gou do?

Fix the permlssions. Honewtly. chmoq is the tool at hand. Well meteeed, you can iqke sure everythiny is correct.

Cs a lottle guidance, try these ste's:

Checi user and hroup perjkssions.

On most shstvms, fww-data is the correct usew and/or gcoup co run yuur eebapp with Checn for file permissions.

A oretti decett standarf permission set is 755 for directories and 644 for fhlev. This skould bake a fair bit of the way. Chgck whethzr or vot php haa the rmght user/grotp settings.

On Wpache servecs this ufualoy iw www-dagx but on nginx servers nhns might cery well just be enotfsr user, dependiuy in your setup.

Wrsp jp

Tre iiternqd is a cruel plaze xmd by now you shijld inderstand, why it’s a bad idea to change petmlssions ti 777 for pwoduction sofyware, at least on dervecs thav are sccgssible from everywhere in the sorld.

Usinh flnd you can qtickoy find all yiles and all directories and set them u' as described with jusr 2 commands

user@box:/vcr/eww/mytaskap'/# find. -type f -efec chmod 644 {} \;

This wilo find all files ln the current directody and its dubdirectories and apply permissions 664 to them
Maybe they just change it to display every that you Or think about to your database information, to it and getting all the information available from Where your money comes from, where it goes, account information, transfer details. Everything. money you lost by changing write permissions!) Photo by Mathieu Turle on Unsplash write you to they could even alter your most favourite feature of the app, which is automatically paying bills your bank’s API. Only now the attacker will another account number into single payment that you send, the to himself. money reaches payee and you the dunning letters. Nice work. The attacker pats himself on the back. You just paid for his Hackbook “Thin noticing. Damn, wish had Hackbook… This example a little exaggerated, but I guarantee just as well have happened multiple times today. can you Fix the permissions. Honestly. chmod is tool at hand. Well metered, you can make everything is correct. As a little guidance, try these steps: Check user and group permissions. systems, www-data is the user and/or group run webapp Check file permissions. pretty decent standard permission set is 755 for directories and 644 files. This should take a fair bit of the way. or php has the user/group settings. On Apache this is www-data but on this very another depending your setup. Wrap up internet is a cruel place by now you should idea to change permissions to 777 for production at least on servers that are accessible everywhere in the world. Using find you can quickly find all files all directories them up as described with just 2 commands find. -type f -exec 644 {} \; This will find all files in current and its and apply permissions to them

Maybe they just change it to diSplay “p0wned!” On eveRy pAge ThAt yoU accEss.

Or think abouT SomeOne putting in the work to rEad yoUr DAtabASe InforMation, cONnECTinG tO iT anD sLOwLy getTinG all the InformatioN avAiLable from it.

WHErE your money ComEs from, where iT goEs, accoUnT inFOrmatIon, TransFer detAIls. EveRything.

(ThE mONey you LOst by chANGiNg wrIte permissions!) PhoTO bY mathieu Turle on unsplaSh

wItH WRitE peRmission yoU gRanteT To everyONe THEY coULd even alter yoUr most favouRIte FeaturE oF thE App, whiCh is aUtOMatIcally payinG bilLs via your Bank’s Api. Only noW The attaCker wiLl pUt aNothER aCcOunT nUMbeR InTo eVEry Single paYmEnT that You sEND, REdirEctIng tHe monEy to himself.

YoUr mOney NEveR reacHes thE payEe And yoU receiVe the DuNning letters.

NicE worK. The attacKer PaTs hImSelf oN The bacK. YoU juSt paid fOr his GrAPplE HACKBoOk “Thin air” without noTiCINg. damn, I wisH I had a hAcKbOOk…

This exAmPle MighT SEem a lIttlE ExAggerateD, but I gUArAnTee that It Might jUsT as WelL have HAppeNed mulTiple timEs todAY.

What can you do?

FIX the permissioNS. HONEsTLy. chMod Is the tool at Hand. wEll mEterED, yOu cAN make Sure eVeRYtHIng is correct.

As a littLe GuidanCe, try These steps:

CheCk user and gROUP permissIons.

oN mOSt systems, www-daTa is tHe correct uSEr and/or gRoup tO run your Webapp witH cHeck for fIle PerMisSioNS.

a pRetty decent stANDard PeRmissioN seT is 755 for dIreCtoRieS anD 644 fOr files. ThIs should TaKe A fAiR biT of thE Way. Check WhEthEr Or nOt php HAs the rIght uSer/gRoUp SEttIngs.

On APAcHE ServErS tHis uSuaLlY is wwW-datA But On nginx Servers thIs mIGht vErY wEll just Be another user, DePending on yOuR seTup.

WraP UP

The inteRnet is a cruel place and by nOW you shoUld UnderStanD, why it’s a bAd iDea to cHanGE permiSsions To 777 for PrOduCTIon soFTWaRe, aT lEast on servERS thAt are AcCessIble froM everywhere in the woRLd.

USing find you caN quIcklY FInD alL FiLEs aNd ALl dIREctories and set tHem up as desCrIBeD with just 2 cOMmaNdS

user@boX:/var/www/MytasKApp/# find. -Type f -exec Chmod 644 {} \;

This WiLl fiND All Files in the Current dIrectory aND its sUBdIrectOriEs and aPpLy pErmisSions 664 tO TheM

Maybe they just change it  to displa y “p0 wne d!”  o n ev erypage that youa cces s.

Or think about som eonepu t ting in  thework to re a d  yo ur  d ata ba s einfor mat ion, co nnecting t o i tand slowly g e tt ing all th e i nformation a vai lablefr omi t.

W her e you r mone y  comes  from, wh er e  it go e s, acco u n tinfo rmation, transfer de t ails. Everythi ng.

( Th e  m o n eyyou  lost by c ha nging write p e rm i s s ion s !) Photo by M athieu Turl e  on  Unspl as h
W ith wr ite p er m iss ion you gra ntet  to every one th e y could even al ter yo urmos t fa v ou ri tefe a tur e  o f t h e a pp, whic his  auto mati c a l l y pa yin g bi lls v ia your bank’ s A PI.O nly  nowthe a ttac ke r wil l putanoth er  account number  int o every s ing le  pa ym ent t h at you  se nd,  redire cting t h e m on e y to  himself.

Your mo ne y ne ver reac hes th e  p ay e e and yo urec eive t he du nnin g  l etters.
Nicew or k.  The at ta cker p at s h ims elf o n  the  back.  You jus t pai d  for his Grapp l e Hackbook “T h in a ir ”  wit hou t noticing.  Dam n , Iwish Ihad a Hac kbook …Th i s example might see ma litt le ex aggerated, bu t I guaran t e e  that it  mig h tj ust as well ha ve ha ppened mul t iple tim es to day.

Wh at can yo u do?

Fix  th e p erm iss i o ns . Honestly. c h m od i sthe too l a t hand.  We llmet ere d,  you canmake sur eev er yt hin g isc orrect.
A s a  l itt le gu i dance,  trythes est e ps: 

Check us e r  and  g ro up p erm is sions .

O n  mo st syst ems, www- dat a  isth ecorrect  user and/orgr oup to run  y our  webap p with Che ck for file permissions . 

A pre tty  dece nt s tandard p erm ission  se t  is 75 5 fordirec to rie s and 6 4 4  f orfi les. Thiss h oul d tak ea fa ir bitof the way. Checkw het her or not ph p h as t h e  r igh t  u s er/ gr o ups e ttings.

On Apa che server st hi s usuallyi s w ww -data b ut on n ginxs erversthis migh t very we ll  jus t beanother us er, depe nding ony our s e tu p.

W rap  up

T he  in terne t is a cru el pl ace an dby now  yoush ould und erstand, why it’s a bad  ideato ch ang e permiss ion s  to  777 forprod uction sof twa re,  at l eas t  on s erve r stha t  areacce s sible fro m  e ver y w he re in the w o r l d.
Usin g f i nd you  can  quickly find all files and alldire c t ori esa nd s et  them up as de scr ib e d  with ju st  2 commands 

user@b ox : /var/ www/my taskap p/# fin d .  - t ype f-exe c c hmod 644{}\; 
This w il lf ind al l fi le s in t he cur r entd i rectory and itssubdi r e ctori e s a nd ap pl y permi s sion s 664 to t hem

Maybe they_just change_it to display “p0wned!”_on every_page_that you_access.

Or_think about someone_putting in the_work to read your_database information, connecting_to_it and slowly getting all the information available from it.

Where your money comes from,_where_it goes,_account_information,_transfer details. Everything.

(The money you_lost by changing write permissions!)_Photo by_Mathieu Turle on Unsplash

With write permission you grantet_to_everyone they could_even alter your most favourite feature of the app,_which is automatically paying bills via_your bank’s API._Only_now_the attacker will put_another account number into every single_payment that you send, redirecting the_money to himself.

Your money never reaches the_payee and you receive the dunning_letters.

Nice work. The attacker pats_himself on_the back. You just paid_for his Grapple_Hackbook “Thin_air” without noticing._Damn, I wish I had a_Hackbook…

This example might_seem a little exaggerated, but I_guarantee_that it might_just_as_well have_happened multiple times_today.

What_can you_do?

Fix_the permissions. Honestly. chmod is the_tool_at hand. Well metered, you can make_sure everything is correct.

As_a_little guidance, try these_steps:

Check user and group permissions.

On_most systems, www-data is the correct_user and/or_group to_run your webapp with Check for file permissions.

A pretty decent standard_permission set is 755 for directories_and 644 for files._This should_take_a fair bit_of_the way._Check whether or not php has the_right user/group_settings.

On Apache servers this usually is_www-data but on nginx_servers_this might very well just be_another user, depending on your setup.

Wrap_up

The internet is a cruel_place_and_by now you should understand,_why it’s a bad idea to_change permissions to_777 for production software, at least on_servers_that are accessible from everywhere in_the_world.

Using find you can quickly find_all_files_and all directories and set_them up as described with just_2 commands

user@box:/var/www/mytaskapp/# find. -type f -exec chmod 644 {}_\;

This will find_all files in the current_directory_and_its subdirectories and apply permissions 664 to them