Data-leakage is the uncontrolled, unauthorized transmission of classified information from a data centre or computer system to the outside. Such leakage can be accomplished by physical removal of data storage devices (diskettes, tapes, listings, printouts and photographs of screen copies or ...

learn more… | top users | synonyms

6
votes
4answers
552 views

What do you do to protect data on a Macbook in the event of theft/loss of the device?

What setup do you recommend to protect data on a MacBook in the event of theft/loss of the device? I'm specifically interested in Macs here, rather than laptops generally, and in concrete ...
6
votes
2answers
335 views

Can a web application administrator access the database of that application?

We have a web application linked to a database. The database is secured but contains unmasked confidential numbers. Can a normal administrator who can access the application, access those numbers in ...
6
votes
2answers
469 views

With Google's new Privacy Policies going into effect soon, how can I better protect myself using their services?

From what I can tell, the gist of the new Privacy Policy from Google is that they're making a blanket policy to allow using your data between all their services, however they see fit. So now one ...
6
votes
4answers
418 views

Major industry password leaks using salted HMAC but without eg PBKDF2, scrypt

I'm trying to convince higher-ups on a project to use an iterative strengthening function to secure password-storage for a new system. The current proposal would store something like an HMAC of a ...
6
votes
2answers
900 views

Android side channels: what can one app observe about other apps?

What information can a malicious Android app observe about the behavior of other apps running on the same phone? In more detail, suppose app M is malicious and is running in the background. Suppose ...
6
votes
3answers
809 views

Does reboot clear RAM?

How can I ensure that the whole RAM was zeroed-out? Does a reboot (Power On Self Test) clear whole memory before system is booted? Or does a Linux kernel zero memory before proceeding? I am familiar ...
6
votes
2answers
169 views

Invalid passwords leaked to logfiles

My company recently discovered that we're logging invalid login attempts, alongside with usernames and passwords. Those logfiles are stored on several machines and accessible to all team members. This ...
6
votes
1answer
161 views

How far a VPN service is legal? Does it makes my data vunerable for hackers?

Today, in Brazil, the government suspended by judicial requirement the WhatsApp application for 48 hours. It is a messaging app that works only via Internet connection (3G, 4G, WiFi...) and not by ...
6
votes
2answers
343 views

How to Man-in-the-middle a whole network?

When performing a MiTM attack, you generally need to specify the router's IP address and the "victim" IP address. I'm trying to demonstrate to a business owner why he needs to secure his network, but ...
6
votes
2answers
796 views

What SSD maker has implemented Secure Erase to spec?

I have a Kingston hyperx drive circa 2012. I kicked off a secure erase on it. I then remounted the drive and was horrified (well, not really more like bemused) to see my whole parts of my old file ...
5
votes
3answers
221 views

Is there a common name for a software defect that leads to unexpected transfer of secret over the wire?

Suppose in a C++ program I use a memory region for temporarily storing an encryption key and don't overwrite that region afterwards. Then my program wants to send a data packet over the network. Due ...
5
votes
2answers
360 views

What to do in response to a source code and/or database leak by a third party hosting provider?

My PHP sourcecode and database (PHPMyAdmin Dump) has been leaked publicly and I believe that the web host I have used for this service are responsible for the leak. On first appearances, the web host ...
5
votes
2answers
222 views

In the case of the Gawker data breach, would strong passwords be ok?

In the Gawker data breach, was just the database stolen and that gave free access to all user data? Or did the hackers still need to read the MD5's of the usernames and passwords to gain access to the ...
5
votes
2answers
902 views

HTTPS Sensitive Information and Caching

I have a website where I need to share a sensitive key with the user. Of course, I'm using HTTPS on the page. The key is put into the HTML server-side in ASP.NET. My concern is, if the user's computer ...
5
votes
3answers
141 views

Fixing security issues without boss/client's authorisation

I have a fair number of security concerns with a client's operation and it made me think about all the security concerns I've observed and noticed throughout the years with different clients/jobs. ...
5
votes
2answers
311 views

How to destroy VOIP phone in a proper way?

Are there any standards which consider safe destroying of VOIP phones? I would like to prevent eventual data leakage after devices which have left the company.
5
votes
1answer
252 views

What particular devices and processes are available to destroy hard drives, per DoD 5220.22-M?

DoD 5220.22-M specifies the following methods for destruction of hard drives with classified data: Disintegrate Incinerate Pulverize Shred Melt I've seen shredders of the type that might be used ...
5
votes
1answer
658 views

Data loss protection in software artifacts

Data loss protection is a major concern to every industry. The software engineering process involves multiple points for potential data loss, as a number of parties are involved other than the client ...
5
votes
2answers
136 views

Should Android apps for communication encryption and security require permissions like identity, device ID, contacts, etc.?

There is a Android application Threema for communication encryption and that says it does not collect user data, but it requires the following permissions: identity, contacts and device ID. Can ...
4
votes
5answers
429 views

What would you define as an “advanced” hacker attempt?

This subject might just barely be a programming topic. Though, in my point of view, it is of great concern to programmers because of our responsibility to develop secure code. Recently, there has ...
4
votes
5answers
3k views

Is it ok to cut some digits from the front-face of a credit/debit card?

I'm a European expat living in Asia. I usually hide my credit card at my apartment. However, I'm a bit scared about losing it when I carry it (wallet robbed or lost). That's why I already scrubbed ...
4
votes
2answers
585 views

Preparing for a stolen physical server

What would be the best ways to protect sensitive data stored on a server/drive that gets stolen? The confidentiality of the data is what is important, not retrieving it. Obviously, physical means are ...
4
votes
2answers
454 views

Preventing information from leaving corporate network

How do you prevent confidential information from leaving the network.? Nowadays online storage facilities are in abundance. e.g. Google Drive, One Drive ...etc. Any employee can just upload sensitive ...
4
votes
1answer
383 views

Data remanence on mobile devices

The methods in which data should be deleted is strictly enforced by the DoD as well as others security sensitive organizations. However, there are complications with deleting data on an SSD. Given ...
4
votes
2answers
566 views

Google Account Compromised - Possible Investigation?

This morning, I've not been able to login to my Google Account. Google says, my account has been compromised and I had to walk through account credentials recovery and verify (SMS to verify phone ...
4
votes
1answer
54 views

How do IP addresses leak information about whether they are a home client or not?

Websites such as hackforums.net, amongst others, are able to detect if you're using a proxy or VPN just by looking at your IP address and block you if you are doing so. I have never experienced any ...
4
votes
1answer
158 views

How to detect a database leak

Website keep getting hacked every day and every now and then we hear website owners react and tell "affected users that their password might had been compromised". Most sites that disclose such leaks ...
4
votes
1answer
6k views

Can your Windows or Linux username be exposed to websites?

For example: Accessing a website with javascript enabled can expose information such as browser, fonts and local time. Can it, theoretically, expose your Windows or Linux username? Will saving a ...
4
votes
1answer
360 views

Security Consequences of compromised passport data

In light of the recent hack of the EC-Council site, where the hacker makes the point that he has access to passport data a general question arises. What, if any, are the security/privacy consequences ...
4
votes
1answer
174 views

Smartphone motherboard - Does it hold any data?

I recently went for a smartphone repair and got its motherboard replaced. However, it didn't occur to me to ask for the damaged motherboard back. I had confidential credentials and data stored. No ...
4
votes
3answers
301 views

Website knows that I'm connected via OpenVPN

When I'm connected to a OpenVPN server and visit http://ip-api.com/ I get this: OpenVPN UDP bs128 SHA256 Can somebody explain to me how this is possible and how can I stop this information leak?
4
votes
2answers
183 views

Difference/Relationship between data leakage analysis and vulnerability analysis?

What is the difference/relationship between data leakage analysis and vulnerability analysis? How much and what kind of vulnerability testing is required for data leakage analysis? I have to give ...
4
votes
1answer
45 views

Metadata leakage from security camera upload times

Picture the following: A server controlling security cameras has a script that takes stored footage, encrypts the files with GPG, and moves it into a cloud storage folder (Dropbox in this case). If ...
4
votes
1answer
104 views

Is Chrome for Android leaking my phone number?

I accidently clicked on an advertisement, and opened it with chrome. It was one of those things where you can subscribe to an App Store for £4.50 a week for apps which are usually free anyway. ...
4
votes
2answers
417 views

Possible to detect an/or shut off CryptoLocker by limiting total network bytes transferred?

Since a virus infected PC has to download (encrypt) reupload the entire file (to a file server), and repeat the process for every network drive, is is possible to detect this unusually high bandwidth ...
4
votes
4answers
13k views

How do I securely erase USB flash drives?

I would like to know if there is a way to securely erase USB flash drives without a chance to recover data from it once it has been erased. I know, that programms like DBAN can be used to securely ...
4
votes
1answer
75 views

What is the security significance of Keyboard and Touchpad controller chips?

In this article from Privacy International, it indicates that when GCHQ undertook the task of destroying sensitive data on system belonging to the Guardian newspaper, in addition to the Storage media, ...
4
votes
2answers
5k views

How to secure usb data storage of Android phones?

I just found out that if I connect my phone to a laptop with a cable, the password becomes completely USELESS. So how can I protect the data in my phone from a usb cable? It's actually very easy to ...
4
votes
1answer
368 views

What constitutes a Virtual Private Database?

I recently came across this term "Virtual Private Database" and I'm wondering what criteria need to be satisfied to allow use of the term. I first saw the term in an HP/Fortify doc: A virtual ...
3
votes
2answers
184 views

Tor exit node can know my IP address?

I have read some articles about how Tor works. I know about layer by layer decryption, but there is something that I cannot understand: If the exit node is the one that does the last decryption and ...
3
votes
4answers
88 views

Is reading from prod to dev a security concern? [closed]

We have two environments, both of which have access to the same data sources. However, prod is locked down (reasonably so) while dev can be written/read by developers. Data flows from the source ...
3
votes
3answers
728 views

Could “system volume information” and $RmMetadata pose information leakage on a nuked HDD?

I recently nuked my HDD(s) via a Windows program (Disk Wipe to be precise: http://www.diskwipe.org/), now everything is fine when I try to retrieve the information on that disk by any program I can ...
3
votes
2answers
1k views

Anthem Leak - How do I find out if I'm affected?

Recently, Anthem (A health insurance company somehow associated with Blue Cross Blue Shield and potentially other insurance providers that I am unaware of) was the victim of a large data breach. I've ...
3
votes
5answers
4k views

Is running an erase tool after an OS install sufficient to ensure no data from the old install is recoverable?

How secure do you consider this process? A drive has data from a previous OS installation. A new OS installation is made on the drive, and Heidi Eraser is run on free space. What are the chances ...
3
votes
2answers
272 views

Concerns of data being on the cloud

Would you prefer a private cloud for your data or a public one? Who takes care of financial liability in case of any breach? Do companies still keep the most critical within their data centers, ...
3
votes
1answer
243 views

What information could be gained from an Amazon shipping label?

My family has a bad habit of recycling Amazon shipping boxes without taking out the labels. We have been doing this for the past year or so and have noticed a slight and steady increase in the amount ...
3
votes
1answer
94 views

Secure text document's fingerprint

The purpose is the same as with hashing: given set of confidential documents, I want to process them and store something secure like salted hashes/bcrypt. Later, when new document is given, I want to ...
3
votes
1answer
70 views

How long is the information on Facebook stored? [closed]

I was wondering how long Facebook stores our photos and posts? I hear two theories, one saying it is around half a year, after which all the data centers are going to erase our data. The other one ...
3
votes
1answer
390 views

Theory about split data in several isolated (different physical server) DBMS to gain in security?

Suppose the following scenario: 1- A web app (on WEBSERVER1) and its database (on DBMS1) having very sensible information deployed in the same physical server (lets said that for simplification). ...
3
votes
1answer
912 views

Strange packets coming over wireless, looking for clues

While running airodump-ng in town, I have noticed an unusual type of AP or pseudo-AP. There is a steady stream of wireless beacon frames coming in on channel 6. The frames are valid, but have several ...