Data-leakage is the uncontrolled, unauthorized transmission of classified information from a data centre or computer system to the outside. Such leakage can be accomplished by physical removal of data storage devices (diskettes, tapes, listings, printouts and photographs of screen copies or ...

learn more… | top users | synonyms

3
votes
0answers
338 views

SQL security - ACID transactions and locking to prevent financial fraud (timing attack?) [closed]

I am trying to prevent something similar to this from happening: http://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/ Basically the financial exchange was using non-ACID ...
2
votes
5answers
738 views

How to restrict flash drives in Local Area Network

It is prohibited to use USB drives at our office, due to security reasons. But some people still use them to steal information. It is now a great risk factor at our office. Now we need to ensure any ...
2
votes
6answers
2k views

How do I prevent data from leaving my network?

I have a network of about 10 computers and I want to prevent sensitive data and source code leaks. To achieve that, I would like to block all file uploading / attaching. What are the options ...
2
votes
4answers
2k views

If a hacker were to compromise a GMail database

Assuming the systems that store the Gmail database is compromised what is preventing them from reading everyone's emails by looking at the data in the database? I assume nothing, and in order for ...
2
votes
2answers
647 views

Are there sensors/devices to be used for reading magnetic bits of hard disk

I would like to ask about the availability of any sensor or device that can be used to read magnetic bits inside hard disks? I tried to google that but I did not see any useful thing till now. I think ...
2
votes
2answers
556 views

How to implement password reset functionality without becoming susceptible to cross-domain referer leakage?

I have typically implemented password reset functionality by sending a link that included something like this: http://example.com/pwreset?id=userId&resetToken=superSecretResetToken On my pwreset ...
2
votes
1answer
324 views

Twitter.com in private browsing leaks data to normal browser. Other sites as well? Bug or feature?

This is the first time I encountered similar thing. When I log into the Twitter web site in Chrome (namely, the Iron version which is said to be security enhanced, but that does not matter here) in ...
2
votes
2answers
177 views

Does NTP leak local system time?

As I understand the paper An Improved Clock-skew Measurement Technique for Revealing Hidden Services (6/23 = pdf page 3), it implies that a NTP client leaks the system's local time because of TCP ...
2
votes
1answer
2k views

How to secure MySQL based web session data table?

I have the following MySQL session schema: CREATE TABLE `SessionData` ( `id` varchar(50) COLLATE utf8_unicode_ci NOT NULL, `data` text COLLATE utf8_unicode_ci, `date` datetime DEFAULT NULL, ...
2
votes
2answers
1k views

Keeping valuable algorithms secret

Given a securities trading algorithm that is very effective and thereby very valuable, how do you keep it secret and protect it from theft or copying? What techniques or architecture is the best? The ...
2
votes
2answers
219 views

What options are available for implementing DLP? [closed]

What options are available for implementing DLP within an organisation and what are the pros and cons of each?
2
votes
1answer
106 views

Possible to redact information in the clipboard, or to auto-redact when it hits a webpage?

Sometimes when I paste information to a website I realize after I post the information that I inadvertently included an IP address, username, email address, or other information I'd like to consider ...
2
votes
2answers
77 views

Information disclosure by identifiers

I'm doing a small research and I observed quite a lot of sites that reveal some private information in the ID-s that they assign. As an example I would like to point out e-commerce sites that issue ...
2
votes
3answers
469 views

Where do organizations store their sensitive documents? How do they protect them?

Where do organizations store their sensitive documents? How do they protect them? What are the pros and cons for each method? (If there are multiple common ones) EDIT: I am more referring to ...
2
votes
1answer
71 views

What's the mechanism used to extract my user name on a website? [closed]

I was browsing this forum http://openelec.tv/forum/64-installation/40869-putting-openelec-onto-sd-card-using-usb-reader-from-a-mac-for-raspberry-pi ,and realised that they show my hostname and my ...
2
votes
1answer
79 views

How to protect personal data requested by Certificate Authorities from data theft?

I recently uploaded images of my passport and driver's license to a Certificate Authority (CA) to apply for SSL certificates. The submission was rejected because I have added watermarks to prevent ...
2
votes
1answer
925 views

How does Ram Scraper work?

I heard that during Christmas a lot of customer data was stolen using malware attack called Ram Scrapers. What exactly is a Ram Scraper?How would one infect a machine with it?What information can you ...
2
votes
1answer
90 views

MITM vs. data leakage

We are designing a web API - accessible via https only - but two schools of thought seem to have arisen among our team: Group 1 wants to adopt an approach that is more concerned about data leakage ...
2
votes
4answers
1k views

Code, Data and Passwd encrypted? sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID

Lots of our *NIX scripts use "sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID" I know that not good to have clear text password in scripts (there is no alternative at the moment). But question is the ...
2
votes
1answer
57 views

Properly solving IP leaking from WebRTC and other apps with STUN when using a VPN

This is really a follow-up question from this: Stun scripts/webRTC IP leaks I'm connecting to a VPN using a virtual adapter, which has a default routing rule so all traffic goes through it. I still ...
2
votes
2answers
49 views

Can a web-filter track my internet access over application API calls?

I'm at college where each student has a login ID and password for internet access through the CyberRoam web filter for blocking certain websites. My question is, when I'm browsing Facebook, YouTube, ...
2
votes
1answer
193 views

Tools for Verifying Secure Deletion [closed]

It is recommended to verify the zeroing-out was done properly when you try to secure delete a HDD. From this post, some drives with firmware bugs prevent secure erase from working properly. What are ...
2
votes
1answer
8k views

How to block all access to Akami deploy servers and Apple push servers?

I no longer blindly trust the numerous connections that occur at night and during the day that always go to "content" and "push" servers like: a23-33-37-54.deploy.akamaitechnologies.com ...
2
votes
1answer
206 views

Firewall Considerations with PGP Universal

The PGP Universal server is a fairly complex piece of work that provides several different services. When constructing firewall rules I am trying to determine what implications there are for opening ...
2
votes
0answers
57 views

How often are codebases compromised? [closed]

I'm currently trying to research which get compromised more often; databases or codebases? My guess would be that databases are the obvious answer and most of the time easier to compromise, because of ...
1
vote
2answers
231 views

Is there any risk in posting “local info” to the Internet?

Previously when I posted a screenshot online, someone told me to erase out my usernames, computer names, domain names, etc: Is there actually a need to do so? A quick Google search shows that many ...
1
vote
2answers
89 views

VCS to manipulate returned trees to prevent leaks? [closed]

I am wondering if there is any system that would change source code trees in subtle from version control systems in ways that are hard to discover (i.e. whitespaces at the ends of lines, perhaps even ...
1
vote
2answers
7k views

Why is my browsing history visible outside my network?

Whatever I and my family members do at 'Home PC' is visible in the history in Google chrome in my 'Office PC'. The two networks are entirely different! I saw all websites visited on our home PC by my ...
1
vote
3answers
628 views

Monitoring and filtering of arbitrary outgoing data

I would like to be able to not just centrally monitor but also filter any organizational data moving out our edge routers, regardless of the sender application and regardless of the protocol/port used ...
1
vote
1answer
258 views

What's this type of leak detection method called?

Suppose I want to figure out which of a group of people is distributing my content without authorization. So I create several different versions of the same content, each with a unique watermark ...
1
vote
2answers
185 views

Is there an example of a web server that does steganographic watermarking?

You could imagine a web app that serves subtly different versions of a page to each user. For example, it might encode the identity of the user in the images it serves. This would be a per-user ...
1
vote
3answers
134 views

Is it possible to read files in a mobile phone for carriers through mobile network alone?

Say a smartphone does not have any (internet) data plans activated (no gprs, 3g data etc.). It just connects to the tower for calls. So is it technically possible for the carrier or law enforcement ...
1
vote
2answers
359 views

How do private photos get stolen

I'm not referring to any of the below: Spiteful partner sharing private photos of other after editing oneself out. Someone stealing photos from a professional photographer/artist without permission. ...
1
vote
2answers
735 views

How to prevent private data being disclosed outside of Organization

I'm not looking to secure my internal network Our company keeps sensitive customer information. How can I prevent this information spreading outside of the company ? How do big companies prevent to ...
1
vote
1answer
453 views

How to prevent users from copying their outlook pst file to an external disk or system

We allow 4 gb space per employee in outlook mail exchange, beyond that the user has to create a pst file . That is the policy. We have given admin rights to all employees since there is a lot of ...
1
vote
2answers
3k views

How to prevent user from recovering my iPhone data?

If I'm about to sell my iPhone 5, is there a way to make sure that the buyer won't be able to recover anything from my data? Both data that has been recently deleted and data that has been deleted ...
1
vote
1answer
92 views

Linux file information leakage

What information is kept in a linux file about the user and/or system that created it? I want to make some files publicly available, posted on another server such as GitHub or FTP, but I'd rather the ...
1
vote
1answer
137 views

Data Protection act, who is liable? [closed]

Recently, a large UK shopping chain had the staff payroll database leaked (including bank details, all unencrypted) We've been told that we cannot take legal action and have so far been denied ...
1
vote
1answer
240 views

How to secure data in a stolen raid disk?

I quote from this article Forget about hacking – your servers might get stolen: Are data centers as secure as they want you to think? Though security is often a selling-point for many data ...
1
vote
3answers
271 views

Malware stole an executable file on my computer? Seems unlikely

If you don't want to read all of the details, skip to the bottom; I'll make a summary. I created a computer program as a proof of concept (I threw it together in 12 hours, so I wrote it in Visual ...
1
vote
1answer
789 views

What encryption is possible for ReadyBoost?

ReadyBoost is a technology to assist getting Windows Vista or 7 to load faster on memory-constrained PC's. Since a USB stick can be easily removed, what security options are available for this ...
1
vote
1answer
38 views

Possible threats on the memory buffer

If an adversary could identify a buffer's capacity, what would be the possible consequences?
1
vote
1answer
1k views

Flawed understanding of SQL Server Transparent Data Encryption (TDE)

We host a database for one of our applications on Microsoft SQL Azure. One of our clients was dissatisfied with the fact that TDE is not supported on SQL Azure (and the database is otherwise not ...
1
vote
2answers
116 views

Firewall Security vs Anti-Virus

Overview of my question I want to create a secure Window's system without the use of an Anti-Virus program. Whilst I know there are many on-demand and live-scanning anti-virus programs readily ...
1
vote
1answer
539 views

Data Retention Laws for ISPs in North America

I was reading an article on TorrentFreak where Private Internet Access claims the United States "is one of the only countries without a mandatory data retention law." According to the linked article ...
1
vote
2answers
71 views

Understanding the behaviour of existing eavesdropping techniques

I am studying the behaviour of existing eavesdropping techniques (part of my research). I have a question through the following scenario: Suppose Bob lives in New York and wants to listen (i.e. ...
1
vote
1answer
70 views

Copy-and-pasting plaintext data from encrypted container

Suppose we have sensitive information stored in plaintext within a dm-crypt/VeraCrypt encrypted file and this information is copy-and-pasted by a user into a web browser after decrypting (this could ...
1
vote
1answer
230 views

Data classification and data leak prevention

We have several levels of data classification such as secret, confidential, etc for documents. To prevent leakage of such sensitive information to the outside, I am considering using a DLP solution. ...
1
vote
1answer
108 views

Ways to make it more difficult for data to be lifted from a website?

Assume for a moment that I run a public-facing website that hosts pictures and names of people in a "billboard" fashion (i.e. you do not have to register to view the information) and that my site ...
1
vote
0answers
25 views

Are exposed database names on shared server a security hole?

I was working for a client this week, and they use PostgreSQL database for web applications. They have their database on a shared server. When I connected to the database host with pgAdmin, I was ...