Security related aspects of databases and database access.

learn more… | top users | synonyms (1)

1
vote
0answers
134 views

How does the Facebook App on iPhone access the SMS data from iMessages? What are the details?

(This is not a repeat question to "How is Facebook accessing my iPhone texts in order to recommend friends?", linked below. I wish to know the internal details of how downloading the Facebook app on a ...
15
votes
4answers
16k views

What type of attacks can be used vs MongoDB?

I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
-2
votes
2answers
76 views

When should a password be hashed? [duplicate]

I develop a Smartphone App and have a little question: When should I hash the user passwords, on the device or upload them in plain text and hash them on the server before stored in the database?
8
votes
2answers
5k views

Practices for storing username/password in Web applications

I have read the following question: Storing password in Java application but I don't find the answers useful for my case. So here is my question somehow related to that. I have a Java Web application ...
2
votes
1answer
78 views

Do password derived encryption keys need to be salted?

If I have a database where I store users' sensitive information, and encrypt that information, do I need to do something like PBKDF2(password,salt,10^5) for the encryption key as well as the hash?
4
votes
2answers
1k views

Secure database password stored in an env variable

I need to somewhere store my DB password on my production environment to access the DB. At the moment the prod system is deployed in the cloud, so is the DB. The password, the username and some other ...
2
votes
2answers
103 views

Securing microsoft access database

Let's say I have a website which is written in ASP and I keep my .mdb database in a random directory like /asd8asd/dkdgk32/asdmv/askdasd/kasldk.mdb Can an attacker find database's location without ...
-2
votes
2answers
282 views

Don't store passwords in database? [closed]

Where might someone keep them besides a database? By storing passwords elsewhere I mean a non-traditional database. Allow me to explain. A couple of my friends run high security websites. They ...
0
votes
2answers
191 views

Saving passwords in database

I have recently been studying a lot on writing secure code and choosing secure methods for saving passwords to a database. I'm wondering if it's secure to use ready made libraries or APIs to do this ...
2
votes
2answers
74 views

Trusted vulnerability database source [closed]

Would like to ask currently, is the National Vulnerability Database (NVD) still the place to go if you want to search for update vulnerabilities for different products? I find that some product ...
-6
votes
1answer
91 views

Is this an attack [closed]

Original site: ---topbargains-com-au A fake replica: --topbargain-org How dangerous is this? Have they copied the whole database? Edit: Removed the URLs to satisfy a spam allegation Edit: The fake ...
1
vote
3answers
107 views

Protecting Uploaded Confidential Files [closed]

We have a web application in Linux (App A) using PHP and Zend and another in Windows using Asp.net C# (App B). They both access the same database. App B is for internal use only while App A can be ...
4
votes
2answers
269 views

Is storing encrypted data in a database futile?

The way I see it: there are two ways to encrypt data for a web app. 1) Store a single encryption key on the server, and use it to encrypt / decrypt data at runtime. The obvious issue here is that if ...
2
votes
2answers
71 views

Are foreign keys linking to a table with PHI considered PHI under HIPAA?

Table 1 has PHI and it's encrypted. Table 2 doesn't have PHI, isn't encrypted and has a foreign key to Table 1. I'd like to recommend the strongest security. If there's a requirement in HIPAA, it's ...
11
votes
4answers
3k views

What's more secure? Hard coding credentials or storing them in a database? [duplicate]

I wonder which of these things is more secure. Imagine hard coded credentials, similar to this: if user.Equals("registereduser") && (password.Equals(encryptedpassword)) { Give access to ...
12
votes
3answers
3k views

What are the security benefits to a separate user database?

In the app I'm writing I separated the user and main databases a long time ago for "security reasons". However its getting harder and harder to justify the overhead and the difficulty of managing such ...
-1
votes
3answers
158 views

Authenticate User Salted Hash Without Username

I've got a page with a login system where you type your username and password, the salted hash gets pulled down from the database depending on the username ... SELECT hash FROM db WHERE username = ? ...
4
votes
1answer
199 views

How to detect a database leak

Website keep getting hacked every day and every now and then we hear website owners react and tell "affected users that their password might had been compromised". Most sites that disclose such leaks ...
1
vote
0answers
86 views

Is there a solution for On-the-fly-encryption with active directory rules & policies?

I am looking at having our servers' sql databases for a few program and documents to be always encrypted on the HDD, but available to AD users. So one or multiple users with the right AD privileges ...
5
votes
1answer
113 views

If I fill a hypothetical 1gb HDD with 1024 single 1mb files, will all sectors be overwritten?

When a file is deleted, its only marked as an unused sector of a hard drive. Im wondering if it's possible to fill a 1gb HDD with 1024 individual 1mb files to completely use every sector?
0
votes
0answers
66 views

What type of security does Gazzang zNcrypt provide?

We have just planned to implement the same in our organization, and I believe this will encrypt files and data on disk. I have two questions: Does it provide column level encryption in database (if ...
2
votes
2answers
1k views

What does Gazzang zNcrypt actually protect against?

In an effort to increase security of our website, I'm reading up on Gazzang zNcrypt, which claims to protect data in databases from breaches. Technically, it seems to do filesystem encryption. As far ...
1
vote
2answers
1k views

Table or row level security in ASP.NET MVC 5 and Entity Framework 6

I've already asked this question on Stack Overflow, but no one answered, so maybe it's a more appropriate place to discuss it. Please let me know if I'm wrong and having duplicated question on ...
1
vote
1answer
157 views

Is it ok to have GRANT ANY ROLE privilege granted to an Oracle account which is expired & locked?

I know it's not considered secure to grant GRANT ANY ROLE privilege to other users apart from admins. But what if the user is expired & locked? In particular, I see these 2 users having this ...
1
vote
1answer
539 views

Is this a sensible way to encrypt user data?

I want to make a site for storing sensitive user data, that retains per-user data encryption in the event that the database is compromised. This is the model I was thinking of, to give the best ...
1
vote
3answers
282 views

Most secure location of database

Let's say I have a straight forward completely database driven web site application and I store my database on my web server in the DMZ. I won't be broadcasting the IP address of my database because I ...
1
vote
0answers
243 views

How to identify column types during sql injection with “union all select” construct?

Situation is following: I have identified sql injection attack vector, and have following information about target table: It has six columns. (Identified using "order by"). I can see output of 3 of ...
0
votes
1answer
2k views

How sqlmap works to get all database info

I am curious how sqlmap able to get all the info from the database? I am using burp as proxy to view all the request and response. From the response I couldn't see any information related to the ...
1
vote
1answer
114 views

Difference between Oracle Label Security and Oracle Virtual Private Database?

I am working on a class project, and our lecturer ask a question with this title, I searched in net but I could not find a clear answer. if there is difference what are they? thanks
2
votes
0answers
228 views

Proper credit card encryption for use in a blacklist

I have a general encryption question. I have read through many of the encryption related questions here and I can't find any specifically addressing my concern. This is the hypothetical scenario: I ...
0
votes
1answer
43 views

Diceware & Database hosting [duplicate]

I'm currently setting up a new SQL database with DotEasy as my Hosting/Database provider. I've heard a lot about Diceware being one of the best methods of creating a really strong password, so I ...
0
votes
3answers
356 views

Sending database name in request headers

I am doing a project with an architecture of single server and multiple database. Every client request will contain a header containing database name that this request should connect. Is this a good ...
4
votes
1answer
514 views

Showing bank routing/account numbers, and storing them safely

EDIT: This is for the UK/Europe region. I've been scratching my head reading other posts similar to this one about safely storing bank routing and account numbers. I know that routing numbers can be ...
3
votes
1answer
249 views

Deleting credit card information after every transaction

There have been many reports of hackers compromising credit card information in the databases of online shopping websites. Will deleting my credit card information from my account after every ...
1
vote
1answer
120 views

Is storing a client's folder structure a security risk?

At work, we generate sensitive report files for our clients. Currently, these files are stored in cloud storage. Some partners want the files on their local machine, instead, so we will need the ...
2
votes
2answers
197 views

Store which parts of an IP address, for user to remain anonymous?

I'm thinking about building a very anonymous forum, where people can comment and upvote each other's comments anonymously. People are supposed to remain anonymous even if the forum's database contents ...
-2
votes
1answer
359 views

What are common problems that reveal PHP code? [closed]

What is the best method for securing PHP scripts that contain database passwords? From what I've read, PHP can be revealed when an error occurs and is not caught. Is there any way to reveal PHP by ...
0
votes
2answers
137 views

Would Insecure Direct References and SQL Injection be solved by using Row-Level Security and Per-User Connection Strings?

Regarding the following OWASP Vulnerabilities: Insecure Direct Object References By that I mean letting someone see /account/123/not-theirs (this could be the wrong reference I'm using above). SQL ...
1
vote
1answer
329 views

Security risks if a server in not supported anymore

I have an SQL 2000 database server which is not supported by Microsoft anymore. We have our information security policy applied and even PCI requirements. What are the security risks that we might ...
0
votes
2answers
452 views

SQL Injection in a Web Service URL as a Parameter Value [closed]

Obviously SQL Injection via the payload of a message is a very common practice and therefore it is always key to cover this (I already have in my code). However I'm just wondering about how possible ...
54
votes
9answers
21k views

Why Disallow Special Characters In a Password?

The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
1
vote
1answer
325 views

What's the value of data partition encryption for database files on a postgres database server?

We're in the process of rolling out a postgres based web app, and I'm trying to understand the value of encrypting the entire database. In postgres's case, the only way to do this is store the ...
2
votes
2answers
120 views

How to appropriately secure a database using different db users

I was thinking recently of the steps to secure a database server. Most of us are aware how to handle the security on the application side, although a malicious user might find his way to bypass the ...
1
vote
0answers
170 views

Amazon Web Services - Relational Database Service - Security Scan

My company is utilizing AWS for it's infrastructure including Mysql RDS instances for our databases. Everything we have is in a VPC and requires access through our VPN. Our databases are all not ...
0
votes
2answers
271 views

Place database in the DMZ and in the internal network

Is it sufficient to have single database inside the DMZ which the webservers in the DMZ receives their data from. Or if setup with two databases is a better solution, that would be to have a ...
9
votes
4answers
853 views

Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?

I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
2
votes
2answers
368 views

Storing lots of passwords that different levels of employees need access to

I am wondering what other people do for storing passwords. Our current model at my employer is fundamentally flawed in my opinion, so I am trying to see what other people do so I can select the best ...
1
vote
2answers
134 views

Is bruteforcing the last character of a salt a good idea?

Would it be a good idea security-wise to store salts with their last character removed, and then bruteforce the last character to further the amount of time it would take to create rainbow tables and ...
60
votes
7answers
27k views

SQL injection — why isn't escape quotes safe anymore?

Raw SQL When you're writing SQL -- for anything that takes human input really, a lot of things have been done to avoid the injection. Everyone that's heard of SQL injection knows that (I'm going to ...
2
votes
1answer
209 views

Hiding remote database credentials in application

If I'm building an application that connects to a remote database, where should I hide the credentials? I've seen many suggest that you go through a web-application and use POST and GET requests to ...