Security related aspects of databases and database access.
-3
votes
0answers
35 views
auto backup database and folders on host from Mac [closed]
I am being constantly attacked and would like a solution that would support me while I fix the code (couple of days). I have a domain on justhost and would like to have an application on my mac that ...
20
votes
4answers
1k views
Is it okay to reveal database's table names?
I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
5
votes
1answer
93 views
Database encryption or filesystem encryption?
Recently I've been working on some data which, although not directly governed by any infosec laws, is sensitive enough to warrant being encrypted. I'm interested in finding out about best practises ...
-3
votes
3answers
100 views
How to effectively save database password inside desktop application?
Suppose we are in the field of desktop applications which need to store their data in a database. How do I store the password for this database avoiding the most obvious mistakes, which are:
1) hard ...
6
votes
3answers
383 views
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked?
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?)
LivingSocial - 50 Million Users Exposed
Zappos - 24 Million ...
4
votes
2answers
129 views
Secure yet reversible encryption for local data store
I'm working on a piece of software to store and manage records for a youth group. They've found that a lot of the time they spend on record-keeping and admin is taken up by scanning through looking ...
1
vote
1answer
92 views
Isolating database? Is it possible?
I have been assigned CTF project for IT Security for my final year project in school.
We are planning to have a flag that are base on SQL injection but for the user to overcome the challenge, they ...
7
votes
2answers
129 views
Privacy violation even when queries with too few results are rejected
I was reading a Computing security book1 and saw a question regarding database security and privacy. I can't quite figure out the answer, so I thought I will ask here.
One approach to ensure ...
4
votes
2answers
111 views
How dangerous are direct references to database keys?
An OWASP note suggests that direct object references are considered insecure in some contexts. They defined "direct object reference" as follows:
“A direct object reference occurs when a developer ...
2
votes
1answer
140 views
Does Web Apps and Databases running on AWS EC2 need a IDS/IPS?
I have googled around for information about Web Apps or Databases running on AWS EC2 needing a IDS/IPS or not.
I will present my findings so far here, but it will be good if you guys can confirm ...
2
votes
2answers
92 views
Database security: Remove superuser role
I've recently heard on some IT-SEC conference, that good idea to secure database (probably against privilege-escalation attack) is to remove superuser role, and leave only user roles.
I imagine that ...
3
votes
4answers
126 views
Anonymized Votes
Background
Looking to create an anonymous voting system. The system must track whether or not a user voted on an item (public information), but only that user is ever allowed to know whether they ...
4
votes
4answers
183 views
What kind of attacks result in an attacker only being able to leak a site's database?
Of the public disclosures I've seen from recently compromised sites, it seems common for only the database to be leaked, rather than the application code, or rather than a complete takeover. Is this ...
2
votes
2answers
123 views
MySQL Access Control?
I have read somewhere that it is better to have two different MySQL logins in order to prevent hacking. What I mean is having one MySQL login for read access (SELECT permission) and another login for ...
5
votes
2answers
205 views
How did Evernote detect the security breach?
http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/
Evernote's official message says little about technical details of the attack and how it was detected.
...
2
votes
1answer
64 views
Can we reverse engineer binlog with row format to make MySQL AES_ENCRYPT visible?
Suppose if I am using the mysql database based encryption using AES_ENCRYPT function & insert records, is it possible to decode the row formatted binlogs generated by MySQL to obtain the actual ...
0
votes
2answers
122 views
Encrypting Fields in Database
I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
2
votes
7answers
234 views
How to provide security for passwords stored in Database? [duplicate]
Passwords of end Users are stored in Database which is encrypted (using one way hash like MD5). Apart from me, there are 'other' people belonging to other teams who have access to Database which means ...
3
votes
4answers
295 views
Database hardening techniques
So as I understand it database hardening is a process in which you remove the vulnerabilities that result from lax con-figuration options. This can sometimes compensate for exploitable vendor bugs.
...
0
votes
1answer
137 views
How Twitter got hacked and preventing [closed]
I have been seeing in the news recently that Twitter (including Wall Street Journal and New York Times) got hacked by a sophisticated hacker (group), but I would have assumed they would have ...
3
votes
4answers
148 views
Generate DB Password from license key - a good idea?
There's this web app which has a SQLServer database, and the connection string it uses to access the database is not stored in any configuration file. Rather, the designers decided it would be a good ...
3
votes
4answers
187 views
When hashing passwords, is it okay to store the algorithm used right there in the database?
Since hashing password has become a hot topic recently, it is only natural to expect things to change and assume that some time down the road you might want to replace/tweak the algorithm used in your ...
3
votes
3answers
179 views
Security/Malware implications of storing data in a BLOB as opposed to the file system
From a programming perspective, there has long been a debate over whether to store files in a BLOB or Binary field in a database, or on the file system. The debate always seems to center around ...
3
votes
2answers
291 views
Security of NoSQL databases
Hopefully this isn't too broad.
I've got little experience with NoSQL databases, but I know that they are rising in popularity. As a developer that is extremely concerned with security, I'm ...
5
votes
4answers
223 views
Does any database let you disable non-parameterized queries and therefore disable SQL injection?
Is there a database that allows this already?
If not, here is how I think it could be done. I think it would require modifying the database software and the driver or code that is assembling the SQL ...
7
votes
2answers
160 views
Sending data form registration forms
I understand that sending data from the user to the server, unencrypted, is a bad practice. That is logical.
So how do I encrypt 'userside' and send the data to the server in encrypted form?
Can ...
11
votes
4answers
1k views
How to know which database is behind a web application?
I've read that different databases (mysql, sql server,...) have different vulnerabilities and that they are vulnerable to some specific sql injections.
When attacker try to perform a database attack ...
8
votes
3answers
141 views
Is it preferable to perform encryption using database functions or code?
Several databases I am familiar with provide functions or modules for encryption. Examples include dbms_crypto for oracle databases and built-in functions for MySQL.
Most of the commonly used ...
2
votes
4answers
327 views
Code, Data and Passwd encrypted? sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID
Lots of our *NIX scripts use "sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID"
I know that not good to have clear text password in scripts (there is no alternative at the moment). But question
is the ...
0
votes
1answer
167 views
Protect database resources from fake data inputs via web forms
Scenario:
I'm working on a project that needs to accept large amounts of data (customer data) from its users. So it can be normal to have a user trying to add 10,000 or 100,000 records at a time. In ...
3
votes
2answers
187 views
User authentication + database encryption with same password
I'm working on a private project where I need to store a users financial data in a database. I'll encrypt this data using AES, and I'll be using scrypt to generate a AES ecnryption key from a more ...
2
votes
3answers
265 views
Why are triggers not often used to secure a database?
I did an intern for a company becoming PCI compliant and instead of using triggers to prevent SQL injection, I went through 1000s (if not more) lines of web-app code and called functions every time ...
5
votes
1answer
325 views
Practices for storing username/password in Web applications
I have read the following question: Storing password in Java application but I don't find the answers useful for my case.
So here is my question somehow related to that. I have a Java Web application ...
3
votes
2answers
94 views
Local Network Data Sync and Access Log
We have some confidential data for our research. Currently, we use an encrypted hard drive for storing the data and any researcher using the data takes it off the drive.
However, we do not have any ...
3
votes
2answers
154 views
Are there special attack vectors for statistical databases?
Are statistical databases vulnerable to SQL injection attacks?
If so, what specific kind? Can you think of an example?
1
vote
0answers
66 views
What becomes of SIEM when a large database like teradata gets involved? [closed]
My topic sentence says it all.
I want to know the effect on performance, storage and analysis capabilities when teradata database is added. I'm talking about 70TB of storage with internal ...
2
votes
3answers
234 views
What things should a penetration tester know about databases?
I want to start learning about databases from pentesters perspective and I would like to know what things will be useful on the long run . Also do you know any good book to kickstart my experience at ...
5
votes
5answers
1k views
How can I avoid putting the database password in a perl script?
I have a cronned perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
6
votes
1answer
385 views
Store user passwords in NoSQL database?
I am currently coding the backend of a website and I have not come across an article where this is discussed. I want to store all my application data in MongoDB but I'd like to split out my sensitive ...
3
votes
1answer
157 views
How to design SIEM RFP, keeping in view large database requirements?
I need some help regarding the design of SIEM requirments. In regard to large databases, what general requirements do I need to provide in order to provide coverage related to DB security?
Some of ...
0
votes
1answer
91 views
SIEM technology is it database friendly? [closed]
I have a few questions regarding the use of Databases in SIEM technology. I would appreciate if you guys can help me understand / answer these questions. The answers from you help me design the SIEM ...
2
votes
1answer
92 views
Is Creating a Restricted Database User in Microsoft SQL Server Decent Protocol
Forgive me for the heavy metaphor but it's a situation's complexity kind of goes over my head.
Assume I'm Leonard Shelby (My short term memory only lasts 5 minutes). I'm a freelancer that reads ...
7
votes
1answer
493 views
How to make SQL injection in PostgreSQL's tsquery?
I think there is SQL injection vulnerability in an application I'm testing. This is seen when I enter malformed parameters into a search form. All exceptions are shown in format:
PHP raised unknown ...
2
votes
2answers
226 views
Potential insecurity in not sanitizing variables before INSERT with prepared statement in PDO
I use PDO with prepared statement when connecting to my database, and I do this because it is considered a safe way to do so, but one thing I could not help but to wonder was, can submitted data from ...
1
vote
3answers
171 views
For what do I hash user passwords with PDKDF2 when the user data is stored in the same database?
I'm hashing the passwors of my users with PDKDF2 right now. A user can gain access to his account with his password. When the user is logged in he can edit his personal information and do other stuff ...
2
votes
2answers
105 views
Is this logic security / performance wise or not?
Each physical user will have about 20 tables in the database.
When a new user registers, another 20 tables will be created with access only for their new MySQL account.
Data does not have to be ...
2
votes
1answer
725 views
How to secure MySQL based web session data table?
I have the following MySQL session schema:
CREATE TABLE `SessionData` (
`id` varchar(50) COLLATE utf8_unicode_ci NOT NULL,
`data` text COLLATE utf8_unicode_ci,
`date` datetime DEFAULT NULL,
...
3
votes
3answers
156 views
How to know who I am protecting database information from?
I am trying to determine whether I need to use transparent database encryption (TDE) or encryption at web server to protect data in a database.
Here are a couple articles I've read on the subject, ...
5
votes
4answers
248 views
How to upgrade the hashing method of a live database without compromising security?
I'm working on an Intranet project that is accessible from the outside. The password are stored in a Sql Server database in the normal Hash and salt method. The problem lies in the hashing algorithm.
...
17
votes
8answers
3k views
Why Not Allow Special Characters In a Password?
The culprit in this case is a particular (and particularly large) bank. I know one that does not allow special characters (of any sort) in their passwords. Is their any valid reason for doing this? ...
