Data-leakage is the uncontrolled, unauthorized transmission of classified information from a data centre or computer system to the outside. Such leakage can be accomplished by physical removal of data storage devices (diskettes, tapes, listings, printouts and photographs of screen copies or ...

learn more… | top users | synonyms

227
votes
16answers
50k views

SQL injection is 17 years old. Why is it still around?

I'm no techie and would like your expertise in understanding this. I recently read a detailed article on SQLi for a research paper. It strikes me as odd. Why do so many data breaches still happen ...
181
votes
21answers
24k views

How can I explain to non-techie friends that “cryptography is good”?

After that case in which Brazilian government arrested a Facebook VP due to end-to-end encryption and no server storage of messages on WhatsApp to prove connection with a drug case, it's become pretty ...
144
votes
6answers
27k views

How secure is 'blacking out' sensitive information using Paint?

I'm wondering if it's safe to black out sensitive information from a picture just by using Microsoft Paint? Let's take in this scenario that EXIF data are stripped and there is no thumbnail picture, ...
65
votes
5answers
38k views

How do you destroy an old hard drive?

How do you destroy an old hard drive? To be clear, unlike questions Secure hard drive disposal: How to erase confidential information and How can I reliably erase all information on a hard drive? I do ...
64
votes
8answers
17k views

How can I reliably erase all information on a hard drive?

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also. Methods for flash drives ...
62
votes
4answers
37k views

Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once?

Lots of different programs, such as Darik's Boot and Nuke, let you write over a hard drive multiple times under the guise of it being more secure than just doing it once. Why?
49
votes
8answers
30k views

Are powerline ethernet adapters inherently secure?

I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or ...
42
votes
1answer
17k views

Does WinRAR leave traces of temporarily extracted files?

If I have an encrypted RAR file which will only open using a password, and I opened a file directly from within WinRAR by double clicking the file inside WinRAR, I assume that WinRAR will create a ...
31
votes
5answers
4k views

Is disallowing write to USB actually an efficient way to prevent data leakage?

In my organization, a group policy exists that prevents users from writing data to a USB stick. This always seemed like a bit of a pointless PITA to me, just "one of those things...". I forget about ...
31
votes
5answers
6k views

Could mint.com be more secure, and if so, how?

After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit. The site has a bunch of links explaining how they're so secure. I ...
29
votes
12answers
4k views

Is there a secure way to transfer data outside the Internet?

Since, recently, it has been proven that transferring data through the usb port is fundamentally flawed, I'm wondering if there are 100% secure ways to transfer data without using the Internet. ...
24
votes
12answers
6k views

Is it possible to prevent unauthorized copying or recording of data by photographing screens?

I am thinking on a way which would prevent unauthorized copying or recording of data by photographing screens. I also think, if the content of a screen is understable for an eye of a living human, it ...
20
votes
3answers
3k views

Can you recover original data from a screenshot that has been 'blacked out'?

Is there a threat from screenshots with blacked out info? That is can someone take out that after market addition so to speak? For instance I take a screen shot (using MS snipper) Then I 'blur/...
20
votes
5answers
11k views

Recover the prior contents of RAM from a turned-off PC?

I've heard that if your PC is turned off, then an attacker can recover the RAM from the last session. I find this hard to believe. How could it be done?
18
votes
5answers
2k views

At what point in their employment should security policies be explained to an employee?

There are the basic things that need to be explained to every employee about a security policy. For example: How sensitive information must be handled. How to properly maintain your ID, and password,...
18
votes
4answers
3k views

What can an attacker do if he knew my database credentials?

If an attacker knows my database username and password, what can he possibly do if he doesn't have access to my server? Let's say my database is using Microsoft SQL Server. Is there a way he can use ...
17
votes
7answers
2k views

Why don't banks get hacked?

From reading a lot of info on this website I came to the conclusion that if someone with enough skill really badly wants to gain access somewhere, then there is absolutely nothing stopping them from ...
17
votes
6answers
8k views

Preventing information disclosure from browser back button/history?

I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario: The primary user logs off the application, but does not close the ...
17
votes
6answers
2k views

How to securely, physically destroy a hard drive at home?

Hard drive in question has sensitive unencrypted data but has failed and no longer responds so can't be wiped. I'd like to physically destroy the said hard drive (3-1/2" desktop, spinning platter ...
17
votes
6answers
12k views

Is it a good practice to show 403 unauthorized access error to user?

Whenever we see a 403 forbidden access error page we think we have got to a place where some secret or private data is present. Now at this point bad guys know that this might be of interest and start ...
17
votes
8answers
892 views

Should the requirement of admin privileges be extended?

Seeing this comic from xkcd.com made me thinking: Is extending the requirement of admin privileges to things such as connecting to the internet, running the web browser, reading browser and other ...
17
votes
2answers
3k views

The Creation of Secure Software Development Environments

[Edit] I did complete an analysis and framework of concepts that were included into my thesis for extensions to existing frameworks. All of the information in this thread was useful. The direct link ...
17
votes
2answers
2k views

Secure wiping of EEPROM and flash memory

Older magnetic storage exhibited some data remanence, so a recommendation emerged to wipe data by overwriting it multiple times with varying patterns — the “Gutmann wipe”. More recent hard disk ...
16
votes
4answers
2k views

What is the easiest way to search massive, leaked databases for persons and personal information?

This may seem like a rather nefarious question, however, my motivations are quite the opposite-- I want to know how at risk I might be! A while ago a very MASSIVE database was leaked that contained ...
16
votes
3answers
4k views

How should one properly dispose of a printer or fax which is used for sensitive documents?

If you need to dispose of printers or fax machines that have handled sensitive documents, how should they be handled? Should you permit them to be donated or sold for reuse outside the organization? ...
15
votes
3answers
1k views

Is it safe to post dxdiag on the internet?

Is there any information that might be useful to damage me on the dxdiag.txt file generated by windows 7? A technical support forum from a big company (I guess they know what they're doing) asks me ...
14
votes
2answers
5k views

Hiding user account names from unauthenticated RDP sessions

This is for a Windows 7 Ultimate system, which is not a member of a domain. When I log into the system locally, I am required to either manually enter my user ID or authenticate with biometrics. The ...
13
votes
5answers
2k views

Is clipboard secure?

Can a browser get the data on my clipboard? Data could be for example my temporary password? Any browser or operating system that allows this?
13
votes
5answers
684 views

What is the risk of giving USB drives as promotional items by a healthcare provider

There have been a couple of instances where malware infected USB drives have been given away unknowingly as promotional items at conferences, e.g., IBM in 2010. Besides this, if a healthcare company ...
13
votes
3answers
696 views

Can Microsoft access all private data if a user installs Windows 10?

According to this Forbes article by Gordon Kelly, a condition of using Microsoft's Windows 10 operating system is to agree to the following: [Microsoft] will access, disclose and preserve personal ...
13
votes
2answers
697 views

What sensitive information can be leaked in a Vim's swap file?

Often it occurs that when bulk uploading files somewhere, the author forgets that some of the files are being open by Vim and uploads their swap files as well. Can this leak some sensitive information,...
12
votes
6answers
2k views

Best method of retiring hard drives [duplicate]

What are some typical ways you guys retire hard drives? We have a hard drive that won't mount anymore (makes clicking sounds when it tries to mount). The data on it isn't necessarily sensitive (no ...
11
votes
4answers
3k views

Securely erase personal data from android phone before selling

I have just sold online my old Nexus 5 (Android Lolipop) and need to post it tomorrow morning. I would like to make sure the new owner can't access my files. What should I do?
11
votes
4answers
4k views

Is it feasible to encrypt customers personal data? (name, address etc…)

Seeing the Sony Personal data kerfuffle unfold has gotten me thinking about the encryption and securing of personal data - obviously credit cards can (and should) be encrypted, making data breaches of ...
11
votes
1answer
578 views

Social Engineering and Police Officers

The Story: Yesterday at 12pm a neighbor of mine was pulling into his driveway, and saw that his van's back-window was shattered. Well, this neighbor and I have had some trouble with each other in the ...
11
votes
1answer
2k views

Who is responsible for leaking my personal information to companies? [closed]

Lets say I have a couple of friends who I have in my address book and of course they saved me in theirs. There might be the obvious information about me like my phone number and my email address but ...
10
votes
4answers
1k views

Source code security

We have about 20 developers working in a heterogeneous environment, mostly using company laptops or desktops. We run Windows 7 on desktops/laptops and a mixture of Linux distros (Ubuntu/CentOS). ...
10
votes
5answers
4k views

Swap file may contain sensitive data

Is it possible that the swap file will contain chunks of data by a file you have accessed, and could this be detected during a forensics analysis? How could you prevent this situation ? Is using ...
10
votes
2answers
2k views

Is Data Remanence a Myth? [duplicate]

Possible Duplicate: Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once? Multiple overwrites have often been discussed as a secure way of ...
9
votes
3answers
1k views

What factors do you use to choose data loss prevention techniques to use, if any?

Had an excellent discussion this evening with ISACA Scotland around data loss prevention. There are technical tools out there from such luminaries as Checkpoint, MacAfee, Cisco, Symantec etc, but all ...
9
votes
5answers
686 views

How would you detect whether customer data has been leaked?

I'm a very security conscious (bordering paranoia) freelance web developer and I place a lot of emphasis on security with my clients, alas I've found this doesn't seem to be the case for the average ...
9
votes
3answers
2k views

Wordpress Brute Force Attacker knows real admin Username -

I've noticed a brute force attempt on several different Wordpress installs that know the right admin user name for those respective sites... It seems very strange that the hacker would be able to ...
9
votes
3answers
2k views

localStorage for apps over https. What expectations are there?

I run an online gradebook. To keep student data private, I transfer all data over https. Now, I'd like to use localStorage to avoid redundant calculations and server requests. However, according to ...
9
votes
1answer
588 views

I found emails and passwords on github, what should I do?

Content in question: I found a file in a public repository on Github that contains a few 100 emails, some of them with a password (as bcrypt). Verification: As I recognize several of the addresses, ...
9
votes
6answers
17k views

How do I securely erase USB flash drives?

I would like to know if there is a way to securely erase USB flash drives without a chance to recover data from it once it has been erased. I know, that programms like DBAN can be used to securely ...
9
votes
2answers
3k views

How bad is the leaking of Internal IP addresses through external DNS

If an external DNS server is leaking internal IP addresses are there any significant security threats associated with this information leakage? Apart from most the obvious - gaining an understanding ...
9
votes
2answers
261 views

Why are Android permissions granted in groups?

The Android documentation on Permission Groups states that If an app requests a dangerous permission listed in its manifest, and the app already has another dangerous permission in the same ...
8
votes
3answers
3k views

I found my user details on already old, leaked account information list

I came across an old (>3 years) accounts information list which has been leaked to the web. The list included thousands (>10.000) of account details from a service or services. Apparently the event ...
8
votes
3answers
775 views

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked?

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?) LivingSocial - 50 Million Users Exposed Zappos - 24 Million ...
8
votes
4answers
433 views

Major industry password leaks using salted HMAC but without eg PBKDF2, scrypt

I'm trying to convince higher-ups on a project to use an iterative strengthening function to secure password-storage for a new system. The current proposal would store something like an HMAC of a ...