Data-leakage is the uncontrolled, unauthorized transmission of classified information from a data centre or computer system to the outside. Such leakage can be accomplished by physical removal of data storage devices (diskettes, tapes, listings, printouts and photographs of screen copies or ...

learn more… | top users | synonyms

1
vote
0answers
13 views

What are analytics APIs accessing when they run, and how do you block or spoof them?

What are analytics APIs accessing when they run, and how do you block or spoof them? Usually all apps from desktop or mobile app stores, MMO clients, Steam and many utilities, and many games and ...
0
votes
0answers
60 views

How to ensure all traffic goes through VPN?

I want to make sure all traffic goes through the VPN. The VPN manager has an option to enable a "kill-switch" which cuts off the internet if the VPN is not being used, however this feature buggy and ...
0
votes
1answer
31 views

Securing Diskless Clients from Data Leakage

I am experimenting with securing diskless clients booting both RHEL 6.5 and Windows 7 via PXE (and iPXE in the future) from iSCSI targets. These computers run only on an internal network and are ...
0
votes
2answers
39 views

What is the severity if someone read the ConnectionStrings_Prod.config?

I was doing an (authorized) pen test in a website and the programmer did a big mistake and I was able to read any file. So I read the web.config and see the password for database was in ...
1
vote
1answer
136 views

Flawed understanding of SQL Server Transparent Data Encryption (TDE)

We host a database for one of our applications on Microsoft SQL Azure. One of our clients was dissatisfied with the fact that TDE is not supported on SQL Azure (and the database is otherwise not ...
1
vote
2answers
112 views

How to implement password reset functionality without becoming susceptible to cross-domain referer leakage?

I have typically implemented password reset functionality by sending a link that included something like this: http://example.com/pwreset?id=userId&resetToken=superSecretResetToken On my pwreset ...
1
vote
2answers
65 views

Firewall Security vs Anti-Virus

Overview of my question I want to create a secure Window's system without the use of an Anti-Virus program. Whilst I know there are many on-demand and live-scanning anti-virus programs readily ...
6
votes
3answers
223 views

Can you recover original data from a screenshot that has been 'blacked out'?

Is there a threat from screenshots with blacked out info? That is can someone take out that after market addition so to speak? For instance I take a screen shot (using MS snipper) Then I ...
1
vote
3answers
67 views

Variable scope and security

This question is directed at the .Net framework, but would hopefully be answered to encompass many languages & frameworks. Let's assume I have a two methods, one which actually decypts data and ...
0
votes
2answers
316 views

Trying to get rid of hackers who have access to all my devices

What is the best way to go about getting rid of hackers that have gained access to all my personal computers, (both old and recently purchased) phones, and even random computers I use to simply get ...
2
votes
2answers
87 views

Does NTP leak local system time?

As I understand the paper An Improved Clock-skew Measurement Technique for Revealing Hidden Services (6/23 = pdf page 3), it implies that a NTP client leaks the system's local time because of TCP ...
1
vote
1answer
231 views

What's this type of leak detection method called?

Suppose I want to figure out which of a group of people is distributing my content without authorization. So I create several different versions of the same content, each with a unique watermark ...
5
votes
1answer
295 views

Wordpress Brute Force Attacker knows real admin Username -

I've noticed a brute force attempt on several different Wordpress installs that know the right admin user name for those respective sites... It seems very strange that the hacker would be able to ...
3
votes
3answers
223 views

Could “system volume information” and $RmMetadata pose information leakage on a nuked HDD?

I recently nuked my HDD(s) via a Windows program (Disk Wipe to be precise: http://www.diskwipe.org/), now everything is fine when I try to retrieve the information on that disk by any program I can ...
11
votes
2answers
205 views

What sensitive information can be leaked in a Vim's swap file?

Often it occurs that when bulk uploading files somewhere, the author forgets that some of the files are being open by Vim and uploads their swap files as well. Can this leak some sensitive ...
1
vote
1answer
66 views

Linux file information leakage

What information is kept in a linux file about the user and/or system that created it? I want to make some files publicly available, posted on another server such as GitHub or FTP, but I'd rather the ...
0
votes
2answers
113 views

Blocking access to social media on Windows

I would like to block websites like Facebook, YouTube and other social sites as part of my job and would need your advice on how to manage that. There are about 120 PCs in the building. Is something ...
1
vote
2answers
84 views

Is there an example of a web server that does steganographic watermarking?

You could imagine a web app that serves subtly different versions of a page to each user. For example, it might encode the identity of the user in the images it serves. This would be a per-user ...
7
votes
1answer
338 views

Social Engineering and Police Officers

The Story: Yesterday at 12pm a neighbor of mine was pulling into his driveway, and saw that his van's back-window was shattered. Well, this neighbor and I have had some trouble with each other in the ...
2
votes
1answer
65 views

How to protect personal data requested by Certificate Authorities from data theft?

I recently uploaded images of my passport and driver's license to a Certificate Authority (CA) to apply for SSL certificates. The submission was rejected because I have added watermarks to prevent ...
1
vote
1answer
118 views

How to prevent users from copying their outlook pst file to an external disk or system

We allow 4 gb space per employee in outlook mail exchange, beyond that the user has to create a pst file . That is the policy. We have given admin rights to all employees since there is a lot of ...
1
vote
3answers
110 views

Is it possible to read files in a mobile phone for carriers through mobile network alone?

Say a smartphone does not have any (internet) data plans activated (no gprs, 3g data etc.). It just connects to the tower for calls. So is it technically possible for the carrier or law enforcement ...
4
votes
1answer
67 views

What is the security significance of Keyboard and Touchpad controller chips?

In this article from Privacy International, it indicates that when GCHQ undertook the task of destroying sensitive data on system belonging to the Guardian newspaper, in addition to the Storage media, ...
33
votes
1answer
4k views

Does WinRAR leave traces of temporarily extracted files?

If I have an encrypted RAR file which will only open using a password, and I opened a file directly from within WinRAR by double clicking the file inside WinRAR, I assume that WinRAR will create a ...
0
votes
1answer
88 views

Is a properly configured server secure against unauthorized data access?

Take for example a game. Typically, when you buy or download a game that can be played offline, all of the data required to run the game is shipped with the executable. In order to protect these ...
0
votes
1answer
139 views

HTTP Status Codes - security considerations [duplicate]

I am designing an authorization framework and now I am thinking about the error codes which I should return when someone is trying to access a resource and he doesn't have the required permissions. ...
5
votes
3answers
118 views

Fixing security issues without boss/client's authorisation

I have a fair number of security concerns with a client's operation and it made me think about all the security concerns I've observed and noticed throughout the years with different clients/jobs. ...
2
votes
1answer
74 views

Tools for Verifying Secure Deletion

It is recommended to verify the zeroing-out was done properly when you try to secure delete a HDD. From this post, some drives with firmware bugs prevent secure erase from working properly. What are ...
0
votes
1answer
109 views

Data Protection act, who is liable? [closed]

Recently, a large UK shopping chain had the staff payroll database leaked (including bank details, all unencrypted) We've been told that we cannot take legal action and have so far been denied ...
0
votes
1answer
256 views

Can I rely on encrypted cloud services like Mega? [closed]

The Mega site claims that all submitted files are encrypted upon upload and decrypted upon download, and at no moment have they any knowledge of the decrypted contents. (I assume others sites do it ...
4
votes
1answer
198 views

Security Consequences of compromised passport data

In light of the recent hack of the EC-Council site, where the hacker makes the point that he has access to passport data a general question arises. What, if any, are the security/privacy consequences ...
1
vote
2answers
2k views

Why is my browsing history visible outside my network?

Whatever I and my family members do at 'Home PC' is visible in the history in Google chrome in my 'Office PC'. The two networks are entirely different! I saw all websites visited on our home PC by my ...
1
vote
1answer
135 views

How to secure data in a stolen raid disk?

I quote from this article Forget about hacking – your servers might get stolen: Are data centers as secure as they want you to think? Though security is often a selling-point for many data ...
18
votes
4answers
3k views

What can an attacker do if he knew my database credentials?

If an attacker knows my database username and password, what can he possibly do if he doesn't have access to my server? Let's say my database is using Microsoft SQL Server. Is there a way he can use ...
1
vote
3answers
222 views

Malware stole an executable file on my computer? Seems unlikely

If you don't want to read all of the details, skip to the bottom; I'll make a summary. I created a computer program as a proof of concept (I threw it together in 12 hours, so I wrote it in Visual ...
1
vote
2answers
1k views

How to prevent user from recovering my iPhone data?

If I'm about to sell my iPhone 5, is there a way to make sure that the buyer won't be able to recover anything from my data? Both data that has been recently deleted and data that has been deleted ...
2
votes
2answers
146 views

What options are available for implementing DLP? [closed]

What options are available for implementing DLP within an organisation and what are the pros and cons of each?
2
votes
1answer
786 views

How does Ram Scraper work?

I heard that during Christmas a lot of customer data was stolen using malware attack called Ram Scrapers. What exactly is a Ram Scraper?How would one infect a machine with it?What information can you ...
16
votes
6answers
3k views

Is it a good practice to show 403 unauthorized access error to user?

Whenever we see a 403 forbidden access error page we think we have got to a place where some secret or private data is present. Now at this point bad guys know that this might be of interest and start ...
5
votes
2answers
237 views

How to destroy VOIP phone in a proper way?

Are there any standards which consider safe destroying of VOIP phones? I would like to prevent eventual data leakage after devices which have left the company.
5
votes
2answers
485 views

What SSD maker has implemented Secure Erase to spec?

I have a Kingston hyperx drive circa 2012. I kicked off a secure erase on it. I then remounted the drive and was horrified (well, not really more like bemused) to see my whole parts of my old file ...
0
votes
1answer
101 views

Data categorization: tools?

For the purpose of setting in place the appropriate means of securing data, and to secure this process, I'm asking me the questions: What are the tools to associate to a document a categorization ...
15
votes
7answers
2k views

Why don't banks get hacked?

From reading a lot of info on this website I came to the conclusion that if someone with enough skill really badly wants to gain access somewhere, then there is absolutely nothing stopping them from ...
2
votes
1answer
86 views

MITM vs. data leakage

We are designing a web API - accessible via https only - but two schools of thought seem to have arisen among our team: Group 1 wants to adopt an approach that is more concerned about data leakage ...
3
votes
1answer
289 views

Theory about split data in several isolated (different physical server) DBMS to gain in security?

Suppose the following scenario: 1- A web app (on WEBSERVER1) and its database (on DBMS1) having very sensible information deployed in the same physical server (lets said that for simplification). ...
3
votes
1answer
397 views

Strange packets coming over wireless, looking for clues

While running airodump-ng in town, I have noticed an unusual type of AP or pseudo-AP. There is a steady stream of wireless beacon frames coming in on channel 6. The frames are valid, but have several ...
5
votes
2answers
505 views

Android side channels: what can one app observe about other apps?

What information can a malicious Android app observe about the behavior of other apps running on the same phone? In more detail, suppose app M is malicious and is running in the background. Suppose ...
2
votes
1answer
248 views

Twitter.com in private browsing leaks data to normal browser. Other sites as well? Bug or feature?

This is the first time I encountered similar thing. When I log into the Twitter web site in Chrome (namely, the Iron version which is said to be security enhanced, but that does not matter here) in ...
4
votes
2answers
434 views

Preparing for a stolen physical server

What would be the best ways to protect sensitive data stored on a server/drive that gets stolen? The confidentiality of the data is what is important, not retrieving it. Obviously, physical means are ...
6
votes
2answers
278 views

Can a web application administrator access the database of that application?

We have a web application linked to a database. The database is secured but contains unmasked confidential numbers. Can a normal administrator who can access the application, access those numbers in ...