Data-leakage is the uncontrolled, unauthorized transmission of classified information from a data centre or computer system to the outside. Such leakage can be accomplished by physical removal of data storage devices (diskettes, tapes, listings, printouts and photographs of screen copies or ...

learn more… | top users | synonyms

0
votes
2answers
35 views

Is it safe to log JavaScript exceptions to the error console?

I know that on the server side it's very bad to display system-level errors instead of logging them to disk, because it could expose potentially sensitive information, but do the same concerns apply ...
1
vote
2answers
112 views

Possible to detect an/or shut off CryptoLocker by limiting total network bytes transferred?

Since a virus infected PC has to download (encrypt) reupload the entire file (to a file server), and repeat the process for every network drive, is is possible to detect this unusually high bandwidth ...
4
votes
2answers
120 views

Difference/Relationship between data leakage analysis and vulnerability analysis?

What is the difference/relationship between data leakage analysis and vulnerability analysis? How much and what kind of vulnerability testing is required for data leakage analysis? I have to give ...
3
votes
2answers
722 views

Anthem Leak - How do I find out if I'm affected?

Recently, Anthem (A health insurance company somehow associated with Blue Cross Blue Shield and potentially other insurance providers that I am unaware of) was the victim of a large data breach. I've ...
1
vote
1answer
50 views

Data classification and data leak prevention

We have several levels of data classification such as secret, confidential, etc for documents. To prevent leakage of such sensitive information to the outside, I am considering using a DLP solution. ...
6
votes
2answers
114 views

Invalid passwords leaked to logfiles

My company recently discovered that we're logging invalid login attempts, alongside with usernames and passwords. Those logfiles are stored on several machines and accessible to all team members. This ...
3
votes
1answer
92 views

What information could be gained from an Amazon shipping label?

My family has a bad habit of recycling Amazon shipping boxes without taking out the labels. We have been doing this for the past year or so and have noticed a slight and steady increase in the amount ...
0
votes
2answers
60 views

Web/App vulnerability responsibility [closed]

While auditing a few web apps and websites I uncovered a few serious vulnerabilities which I've since flagged (responsibly, of course). One of the things I noticed was that several development ...
9
votes
1answer
1k views

Who is responsible for leaking my personal information to companies? [closed]

Lets say I have a couple of friends who I have in my address book and of course they saved me in theirs. There might be the obvious information about me like my phone number and my email address but ...
2
votes
1answer
40 views

What are analytics APIs accessing when they run, and how do you block or spoof them?

What are analytics APIs accessing when they run, and how do you block or spoof them? Usually all apps from desktop or mobile app stores, MMO clients, Steam and many utilities, and many games and ...
0
votes
1answer
40 views

Securing Diskless Clients from Data Leakage

I am experimenting with securing diskless clients booting both RHEL 6.5 and Windows 7 via PXE (and iPXE in the future) from iSCSI targets. These computers run only on an internal network and are ...
0
votes
2answers
65 views

What is the severity if someone read the ConnectionStrings_Prod.config?

I was doing an pen test in a website and the programmer did a big mistake and I was able to read any file. So I read the web.config and see the password for database was in ...
1
vote
1answer
586 views

Flawed understanding of SQL Server Transparent Data Encryption (TDE)

We host a database for one of our applications on Microsoft SQL Azure. One of our clients was dissatisfied with the fact that TDE is not supported on SQL Azure (and the database is otherwise not ...
1
vote
2answers
185 views

How to implement password reset functionality without becoming susceptible to cross-domain referer leakage?

I have typically implemented password reset functionality by sending a link that included something like this: http://example.com/pwreset?id=userId&resetToken=superSecretResetToken On my pwreset ...
1
vote
2answers
73 views

Firewall Security vs Anti-Virus

Overview of my question I want to create a secure Window's system without the use of an Anti-Virus program. Whilst I know there are many on-demand and live-scanning anti-virus programs readily ...
6
votes
3answers
262 views

Can you recover original data from a screenshot that has been 'blacked out'?

Is there a threat from screenshots with blacked out info? That is can someone take out that after market addition so to speak? For instance I take a screen shot (using MS snipper) Then I ...
1
vote
3answers
71 views

Variable scope and security

This question is directed at the .Net framework, but would hopefully be answered to encompass many languages & frameworks. Let's assume I have a two methods, one which actually decypts data and ...
0
votes
2answers
1k views

Trying to get rid of hackers who have access to all my devices [closed]

What is the best way to go about getting rid of hackers that have gained access to all my personal computers, (both old and recently purchased) phones, and even random computers I use to simply get ...
2
votes
2answers
116 views

Does NTP leak local system time?

As I understand the paper An Improved Clock-skew Measurement Technique for Revealing Hidden Services (6/23 = pdf page 3), it implies that a NTP client leaks the system's local time because of TCP ...
1
vote
1answer
235 views

What's this type of leak detection method called?

Suppose I want to figure out which of a group of people is distributing my content without authorization. So I create several different versions of the same content, each with a unique watermark ...
5
votes
1answer
641 views

Wordpress Brute Force Attacker knows real admin Username -

I've noticed a brute force attempt on several different Wordpress installs that know the right admin user name for those respective sites... It seems very strange that the hacker would be able to ...
3
votes
3answers
328 views

Could “system volume information” and $RmMetadata pose information leakage on a nuked HDD?

I recently nuked my HDD(s) via a Windows program (Disk Wipe to be precise: http://www.diskwipe.org/), now everything is fine when I try to retrieve the information on that disk by any program I can ...
11
votes
2answers
255 views

What sensitive information can be leaked in a Vim's swap file?

Often it occurs that when bulk uploading files somewhere, the author forgets that some of the files are being open by Vim and uploads their swap files as well. Can this leak some sensitive ...
1
vote
1answer
75 views

Linux file information leakage

What information is kept in a linux file about the user and/or system that created it? I want to make some files publicly available, posted on another server such as GitHub or FTP, but I'd rather the ...
0
votes
2answers
124 views

Blocking access to social media on Windows

I would like to block websites like Facebook, YouTube and other social sites as part of my job and would need your advice on how to manage that. There are about 120 PCs in the building. Is something ...
1
vote
2answers
105 views

Is there an example of a web server that does steganographic watermarking?

You could imagine a web app that serves subtly different versions of a page to each user. For example, it might encode the identity of the user in the images it serves. This would be a per-user ...
7
votes
1answer
367 views

Social Engineering and Police Officers

The Story: Yesterday at 12pm a neighbor of mine was pulling into his driveway, and saw that his van's back-window was shattered. Well, this neighbor and I have had some trouble with each other in the ...
0
votes
3answers
5k views

How do I securely erase USB flash drives?

I would like to know if there is a way to securely erase USB flash drives without a chance to recover data from it once it has been erased. I know, that programms like DBAN can be used to securely ...
2
votes
1answer
68 views

How to protect personal data requested by Certificate Authorities from data theft?

I recently uploaded images of my passport and driver's license to a Certificate Authority (CA) to apply for SSL certificates. The submission was rejected because I have added watermarks to prevent ...
1
vote
1answer
194 views

How to prevent users from copying their outlook pst file to an external disk or system

We allow 4 gb space per employee in outlook mail exchange, beyond that the user has to create a pst file . That is the policy. We have given admin rights to all employees since there is a lot of ...
1
vote
3answers
118 views

Is it possible to read files in a mobile phone for carriers through mobile network alone?

Say a smartphone does not have any (internet) data plans activated (no gprs, 3g data etc.). It just connects to the tower for calls. So is it technically possible for the carrier or law enforcement ...
4
votes
1answer
68 views

What is the security significance of Keyboard and Touchpad controller chips?

In this article from Privacy International, it indicates that when GCHQ undertook the task of destroying sensitive data on system belonging to the Guardian newspaper, in addition to the Storage media, ...
34
votes
1answer
7k views

Does WinRAR leave traces of temporarily extracted files?

If I have an encrypted RAR file which will only open using a password, and I opened a file directly from within WinRAR by double clicking the file inside WinRAR, I assume that WinRAR will create a ...
0
votes
1answer
98 views

Is a properly configured server secure against unauthorized data access?

Take for example a game. Typically, when you buy or download a game that can be played offline, all of the data required to run the game is shipped with the executable. In order to protect these ...
0
votes
1answer
158 views

HTTP Status Codes - security considerations [duplicate]

I am designing an authorization framework and now I am thinking about the error codes which I should return when someone is trying to access a resource and he doesn't have the required permissions. ...
5
votes
3answers
118 views

Fixing security issues without boss/client's authorisation

I have a fair number of security concerns with a client's operation and it made me think about all the security concerns I've observed and noticed throughout the years with different clients/jobs. ...
2
votes
1answer
99 views

Tools for Verifying Secure Deletion [closed]

It is recommended to verify the zeroing-out was done properly when you try to secure delete a HDD. From this post, some drives with firmware bugs prevent secure erase from working properly. What are ...
0
votes
1answer
116 views

Data Protection act, who is liable? [closed]

Recently, a large UK shopping chain had the staff payroll database leaked (including bank details, all unencrypted) We've been told that we cannot take legal action and have so far been denied ...
0
votes
1answer
312 views

Can I rely on encrypted cloud services like Mega? [closed]

The Mega site claims that all submitted files are encrypted upon upload and decrypted upon download, and at no moment have they any knowledge of the decrypted contents. (I assume others sites do it ...
4
votes
1answer
236 views

Security Consequences of compromised passport data

In light of the recent hack of the EC-Council site, where the hacker makes the point that he has access to passport data a general question arises. What, if any, are the security/privacy consequences ...
1
vote
2answers
3k views

Why is my browsing history visible outside my network?

Whatever I and my family members do at 'Home PC' is visible in the history in Google chrome in my 'Office PC'. The two networks are entirely different! I saw all websites visited on our home PC by my ...
1
vote
1answer
154 views

How to secure data in a stolen raid disk?

I quote from this article Forget about hacking – your servers might get stolen: Are data centers as secure as they want you to think? Though security is often a selling-point for many data ...
18
votes
4answers
3k views

What can an attacker do if he knew my database credentials?

If an attacker knows my database username and password, what can he possibly do if he doesn't have access to my server? Let's say my database is using Microsoft SQL Server. Is there a way he can use ...
1
vote
3answers
235 views

Malware stole an executable file on my computer? Seems unlikely

If you don't want to read all of the details, skip to the bottom; I'll make a summary. I created a computer program as a proof of concept (I threw it together in 12 hours, so I wrote it in Visual ...
1
vote
2answers
2k views

How to prevent user from recovering my iPhone data?

If I'm about to sell my iPhone 5, is there a way to make sure that the buyer won't be able to recover anything from my data? Both data that has been recently deleted and data that has been deleted ...
2
votes
2answers
174 views

What options are available for implementing DLP? [closed]

What options are available for implementing DLP within an organisation and what are the pros and cons of each?
2
votes
1answer
820 views

How does Ram Scraper work?

I heard that during Christmas a lot of customer data was stolen using malware attack called Ram Scrapers. What exactly is a Ram Scraper?How would one infect a machine with it?What information can you ...
16
votes
6answers
4k views

Is it a good practice to show 403 unauthorized access error to user?

Whenever we see a 403 forbidden access error page we think we have got to a place where some secret or private data is present. Now at this point bad guys know that this might be of interest and start ...
5
votes
2answers
251 views

How to destroy VOIP phone in a proper way?

Are there any standards which consider safe destroying of VOIP phones? I would like to prevent eventual data leakage after devices which have left the company.
5
votes
2answers
579 views

What SSD maker has implemented Secure Erase to spec?

I have a Kingston hyperx drive circa 2012. I kicked off a secure erase on it. I then remounted the drive and was horrified (well, not really more like bemused) to see my whole parts of my old file ...