Data-leakage is the uncontrolled, unauthorized transmission of classified information from a data centre or computer system to the outside. Such leakage can be accomplished by physical removal of data storage devices (diskettes, tapes, listings, printouts and photographs of screen copies or ...

learn more… | top users | synonyms

4
votes
2answers
396 views

Preventing information from leaving corporate network

How do you prevent confidential information from leaving the network.? Nowadays online storage facilities are in abundance. e.g. Google Drive, One Drive ...etc. Any employee can just upload sensitive ...
0
votes
1answer
55 views

Can a QR code steal my mobile's data?

For example https://web.wechat.com By scanning the QR code from my mobile, it automatically logs in with my wechat account. Here, can QR web sever or QR devices steal the mobile data?
-2
votes
1answer
284 views

What is one way to verify emails of compromised website if registrations are not validated?

There was recently a massive personal data leak, and the data seems to be from Ashley Madison - a site providing dating services to married men. The site takes any email and does not verify them while ...
0
votes
0answers
36 views

Is Chrome for Android leaking my phone number?

I accidently clicked on an advert, and opened it with chrome. It was one of those things where you can subscribe to an App Store for £4.50 a week for apps which are usually free anyway. This is ...
1
vote
2answers
43 views

Should Android apps for communication encryption and security require permissions like identity, device ID, contacts, etc.?

There is a Android application Threema for communication encryption and that says it does not collect user data, but it requires the following permissions: identity, contacts and device ID. Can ...
0
votes
1answer
64 views

How secure are the passwords stored at Google Passwords? [closed]

It seems Google activated central place for storing app/website passwords which is accessible at https://passwords.google.com/ and all the remembered Chrome passwords are synched there. In what ...
0
votes
0answers
88 views

Wifi Card Removed, computer still shows data packets sent/received [migrated]

I have purposely removed the wifi card on my macbook in order to work offline securely. The "Activity Monitor" still shows packets are being sent/received. How is this possible? Of particular ...
3
votes
3answers
207 views

Website knows that I'm connected via OpenVPN

When I'm connected to a OpenVPN server and visit http://ip-api.com/ I get this: OpenVPN UDP bs128 SHA256 Can somebody explain to me how this is possible and how can I stop this information leak?
0
votes
0answers
22 views

Restricting Vmware View Copy/Paste functionality

Does anybody know if it's possible to restrict VMware View copy/paste functionality depending on the source of the client? It seems VDIs can have GPOs set to configure copy/paste functionality, but ...
7
votes
3answers
3k views

I found my user details on already old, leaked account information list

I came across an old (>3 years) accounts information list which has been leaked to the web. The list included thousands (>10.000) of account details from a service or services. Apparently the event ...
17
votes
5answers
2k views

At what point in their employment should security policies be explained to an employee?

There are the basic things that need to be explained to every employee about a security policy. For example: How sensitive information must be handled. How to properly maintain your ID, and ...
3
votes
1answer
66 views

Secure text document's fingerprint

The purpose is the same as with hashing: given set of confidential documents, I want to process them and store something secure like salted hashes/bcrypt. Later, when new document is given, I want to ...
4
votes
1answer
113 views

How to detect a database leak

Website keep getting hacked every day and every now and then we hear website owners react and tell "affected users that their password might had been compromised". Most sites that disclose such leaks ...
7
votes
3answers
2k views

How are leaked government credentials possible and what's the point?

In the wake of all these leaked/stolen/hacked government login/passwords being stolen it got me thinking. How is the leaking of these passwords even possible? Or are they of any real use? Aren't all ...
-2
votes
1answer
99 views

Data security is not perfectly possible, laws exist but no one uses them. What is missing on international level? [closed]

In my country (Austria) I was a member of the team that made laws for protecting the personal data of every person. In the meantime I realise that we have the laws but nobody claims them in ...
2
votes
1answer
64 views

What's the mechanism used to extract my user name on a website? [closed]

I was browsing this forum http://openelec.tv/forum/64-installation/40869-putting-openelec-onto-sd-card-using-usb-reader-from-a-mac-for-raspberry-pi ,and realised that they show my hostname and my ...
6
votes
2answers
323 views

Does reboot clear RAM?

How can I ensure that the whole RAM was zeroed-out? Does a reboot (Power On Self Test) clear whole memory before system is booted? Or does a Linux kernel zero memory before proceeding? I am familiar ...
1
vote
0answers
74 views

Vetting new IT development staff [closed]

In the realm of software development what would be the best way to vet prospective employees? We handle potentially sensitive information, and a code base which could be potentially lucrative to ...
0
votes
2answers
65 views

Is it safe to log JavaScript exceptions to the error console?

I know that on the server side it's very bad to display system-level errors instead of logging them to disk, because it could expose potentially sensitive information, but do the same concerns apply ...
1
vote
2answers
194 views

Possible to detect an/or shut off CryptoLocker by limiting total network bytes transferred?

Since a virus infected PC has to download (encrypt) reupload the entire file (to a file server), and repeat the process for every network drive, is is possible to detect this unusually high bandwidth ...
4
votes
2answers
154 views

Difference/Relationship between data leakage analysis and vulnerability analysis?

What is the difference/relationship between data leakage analysis and vulnerability analysis? How much and what kind of vulnerability testing is required for data leakage analysis? I have to give ...
3
votes
2answers
1k views

Anthem Leak - How do I find out if I'm affected?

Recently, Anthem (A health insurance company somehow associated with Blue Cross Blue Shield and potentially other insurance providers that I am unaware of) was the victim of a large data breach. I've ...
1
vote
1answer
113 views

Data classification and data leak prevention

We have several levels of data classification such as secret, confidential, etc for documents. To prevent leakage of such sensitive information to the outside, I am considering using a DLP solution. ...
6
votes
2answers
134 views

Invalid passwords leaked to logfiles

My company recently discovered that we're logging invalid login attempts, alongside with usernames and passwords. Those logfiles are stored on several machines and accessible to all team members. This ...
3
votes
1answer
165 views

What information could be gained from an Amazon shipping label?

My family has a bad habit of recycling Amazon shipping boxes without taking out the labels. We have been doing this for the past year or so and have noticed a slight and steady increase in the amount ...
0
votes
2answers
70 views

Web/App vulnerability responsibility [closed]

While auditing a few web apps and websites I uncovered a few serious vulnerabilities which I've since flagged (responsibly, of course). One of the things I noticed was that several development ...
10
votes
1answer
2k views

Who is responsible for leaking my personal information to companies? [closed]

Lets say I have a couple of friends who I have in my address book and of course they saved me in theirs. There might be the obvious information about me like my phone number and my email address but ...
0
votes
1answer
62 views

What are analytics APIs accessing when they run, and how do you block or spoof them?

What are analytics APIs accessing when they run, and how do you block or spoof them? Usually all apps from desktop or mobile app stores, MMO clients, Steam and many utilities, and many games and ...
0
votes
1answer
49 views

Securing Diskless Clients from Data Leakage

I am experimenting with securing diskless clients booting both RHEL 6.5 and Windows 7 via PXE (and iPXE in the future) from iSCSI targets. These computers run only on an internal network and are ...
0
votes
2answers
78 views

What is the severity if someone read the ConnectionStrings_Prod.config?

I was doing an pen test in a website and the programmer did a big mistake and I was able to read any file. So I read the web.config and see the password for database was in ...
1
vote
1answer
1k views

Flawed understanding of SQL Server Transparent Data Encryption (TDE)

We host a database for one of our applications on Microsoft SQL Azure. One of our clients was dissatisfied with the fact that TDE is not supported on SQL Azure (and the database is otherwise not ...
1
vote
2answers
366 views

How to implement password reset functionality without becoming susceptible to cross-domain referer leakage?

I have typically implemented password reset functionality by sending a link that included something like this: http://example.com/pwreset?id=userId&resetToken=superSecretResetToken On my pwreset ...
1
vote
2answers
87 views

Firewall Security vs Anti-Virus

Overview of my question I want to create a secure Window's system without the use of an Anti-Virus program. Whilst I know there are many on-demand and live-scanning anti-virus programs readily ...
6
votes
3answers
551 views

Can you recover original data from a screenshot that has been 'blacked out'?

Is there a threat from screenshots with blacked out info? That is can someone take out that after market addition so to speak? For instance I take a screen shot (using MS snipper) Then I ...
1
vote
3answers
80 views

Variable scope and security

This question is directed at the .Net framework, but would hopefully be answered to encompass many languages & frameworks. Let's assume I have a two methods, one which actually decypts data and ...
0
votes
2answers
4k views

Trying to get rid of hackers who have access to all my devices [closed]

What is the best way to go about getting rid of hackers that have gained access to all my personal computers, (both old and recently purchased) phones, and even random computers I use to simply get ...
2
votes
2answers
147 views

Does NTP leak local system time?

As I understand the paper An Improved Clock-skew Measurement Technique for Revealing Hidden Services (6/23 = pdf page 3), it implies that a NTP client leaks the system's local time because of TCP ...
1
vote
1answer
249 views

What's this type of leak detection method called?

Suppose I want to figure out which of a group of people is distributing my content without authorization. So I create several different versions of the same content, each with a unique watermark ...
6
votes
3answers
1k views

Wordpress Brute Force Attacker knows real admin Username -

I've noticed a brute force attempt on several different Wordpress installs that know the right admin user name for those respective sites... It seems very strange that the hacker would be able to ...
3
votes
3answers
464 views

Could “system volume information” and $RmMetadata pose information leakage on a nuked HDD?

I recently nuked my HDD(s) via a Windows program (Disk Wipe to be precise: http://www.diskwipe.org/), now everything is fine when I try to retrieve the information on that disk by any program I can ...
12
votes
2answers
383 views

What sensitive information can be leaked in a Vim's swap file?

Often it occurs that when bulk uploading files somewhere, the author forgets that some of the files are being open by Vim and uploads their swap files as well. Can this leak some sensitive ...
1
vote
1answer
84 views

Linux file information leakage

What information is kept in a linux file about the user and/or system that created it? I want to make some files publicly available, posted on another server such as GitHub or FTP, but I'd rather the ...
0
votes
2answers
159 views

Blocking access to social media on Windows

I would like to block websites like Facebook, YouTube and other social sites as part of my job and would need your advice on how to manage that. There are about 120 PCs in the building. Is something ...
1
vote
2answers
147 views

Is there an example of a web server that does steganographic watermarking?

You could imagine a web app that serves subtly different versions of a page to each user. For example, it might encode the identity of the user in the images it serves. This would be a per-user ...
10
votes
1answer
477 views

Social Engineering and Police Officers

The Story: Yesterday at 12pm a neighbor of mine was pulling into his driveway, and saw that his van's back-window was shattered. Well, this neighbor and I have had some trouble with each other in the ...
1
vote
4answers
9k views

How do I securely erase USB flash drives?

I would like to know if there is a way to securely erase USB flash drives without a chance to recover data from it once it has been erased. I know, that programms like DBAN can be used to securely ...
2
votes
1answer
75 views

How to protect personal data requested by Certificate Authorities from data theft?

I recently uploaded images of my passport and driver's license to a Certificate Authority (CA) to apply for SSL certificates. The submission was rejected because I have added watermarks to prevent ...
1
vote
1answer
321 views

How to prevent users from copying their outlook pst file to an external disk or system

We allow 4 gb space per employee in outlook mail exchange, beyond that the user has to create a pst file . That is the policy. We have given admin rights to all employees since there is a lot of ...
1
vote
3answers
126 views

Is it possible to read files in a mobile phone for carriers through mobile network alone?

Say a smartphone does not have any (internet) data plans activated (no gprs, 3g data etc.). It just connects to the tower for calls. So is it technically possible for the carrier or law enforcement ...
4
votes
1answer
74 views

What is the security significance of Keyboard and Touchpad controller chips?

In this article from Privacy International, it indicates that when GCHQ undertook the task of destroying sensitive data on system belonging to the Guardian newspaper, in addition to the Storage media, ...