Security related aspects of databases and database access.

learn more… | top users | synonyms

6
votes
2answers
265 views

Can a web application administrator access the database of that application?

We have a web application linked to a database. The database is secured but contains unmasked confidential numbers. Can a normal administrator who can access the application, access those numbers in ...
13
votes
1answer
177 views

Is there a list of default, standard or third-party “users” for Oracle?

When installed, and depending on which options it is installed with, there are a bunch of standard users pre-created in Oracle. Additionally, third-party software often has its own set of ...
1
vote
2answers
309 views

Least insecure way to encrypt a field in the database so that it can still be included in queries

I have a table where all columns need to be encrypted (aside from the PK). This will be achieved using AES at the application level. However there is one particular field that needs to remain ...
1
vote
1answer
675 views

How to secure database table of users for an application?

I am working on a Windows application that utilizes a MySQL database for its user authentication and data storage. Within the application, the highest level of user (Administrator) can create and ...
3
votes
3answers
264 views

Best security practices for software development and release?

I am trying to figure out a way to limit access and also to establish processes to avoid any and all of my team members to compromise our entire production system. We have a team of 10 developers, 1 ...
3
votes
0answers
507 views

Where to store sensitive client details (MYSQL DB credentials) [duplicate]

I have a security related question about storing some client information - specifically their database login credentials. My app works based on the client and so the database details need to be set ...
24
votes
4answers
2k views

Is it okay to reveal database's table names?

I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
0
votes
3answers
656 views

Password and username used to connect to database in source code [duplicate]

In PHP scripts that communicate with the database I have the username and password to the database in plain text i.e. mysqli_connect('localhost:3306', 'root', 'PASSWORD!'). From OWASP Do not ...
5
votes
1answer
382 views

Database encryption or filesystem encryption?

Recently I've been working on some data which, although not directly governed by any infosec laws, is sensitive enough to warrant being encrypted. I'm interested in finding out about best practises ...
8
votes
3answers
575 views

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked?

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?) LivingSocial - 50 Million Users Exposed Zappos - 24 Million ...
4
votes
4answers
1k views

Database hardening techniques

So as I understand it database hardening is a process in which you remove the vulnerabilities that result from lax con-figuration options. This can sometimes compensate for exploitable vendor bugs. ...
4
votes
2answers
491 views

Secure yet reversible encryption for local data store

I'm working on a piece of software to store and manage records for a youth group. They've found that a lot of the time they spend on record-keeping and admin is taken up by scanning through looking ...
1
vote
1answer
118 views

Isolating database? Is it possible?

I have been assigned CTF project for IT Security for my final year project in school. We are planning to have a flag that are base on SQL injection but for the user to overcome the challenge, they ...
7
votes
2answers
186 views

Privacy violation even when queries with too few results are rejected

I was reading a Computing security book1 and saw a question regarding database security and privacy. I can't quite figure out the answer, so I thought I will ask here. One approach to ensure ...
5
votes
2answers
339 views

How dangerous are direct references to database keys?

An OWASP note suggests that direct object references are considered insecure in some contexts. They defined "direct object reference" as follows: “A direct object reference occurs when a developer ...
3
votes
1answer
884 views

Does Web Apps and Databases running on AWS EC2 need a IDS/IPS?

I have googled around for information about Web Apps or Databases running on AWS EC2 needing a IDS/IPS or not. I will present my findings so far here, but it will be good if you guys can confirm ...
9
votes
6answers
8k views

xp_cmdshell: should it ever be used?

Can 'xp_cmdshell' ever be used safely within a stored proc and are there any situations for which there really is no other option? In other words, should it's useage within a stored proc always be ...
2
votes
2answers
125 views

Database security: Remove superuser role

I've recently heard on some IT-SEC conference, that good idea to secure database (probably against privilege-escalation attack) is to remove superuser role, and leave only user roles. I imagine that ...
5
votes
4answers
231 views

What kind of attacks result in an attacker only being able to leak a site's database?

Of the public disclosures I've seen from recently compromised sites, it seems common for only the database to be leaked, rather than the application code, or rather than a complete takeover. Is this ...
2
votes
2answers
340 views

MySQL Access Control?

I have read somewhere that it is better to have two different MySQL logins in order to prevent hacking. What I mean is having one MySQL login for read access (SELECT permission) and another login for ...
5
votes
2answers
303 views

How did Evernote detect the security breach?

http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/ Evernote's official message says little about technical details of the attack and how it was detected. ...
2
votes
1answer
166 views

Can we reverse engineer binlog with row format to make MySQL AES_ENCRYPT visible?

Suppose if I am using the mysql database based encryption using AES_ENCRYPT function & insert records, is it possible to decode the row formatted binlogs generated by MySQL to obtain the actual ...
3
votes
2answers
350 views

Encrypting Fields in Database

I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
3
votes
7answers
384 views

How to provide security for passwords stored in Database? [duplicate]

Passwords of end Users are stored in Database which is encrypted (using one way hash like MD5). Apart from me, there are 'other' people belonging to other teams who have access to Database which means ...
5
votes
4answers
418 views

How to upgrade the hashing method of a live database without compromising security?

I'm working on an Intranet project that is accessible from the outside. The password are stored in a Sql Server database in the normal Hash and salt method. The problem lies in the hashing algorithm. ...
3
votes
4answers
165 views

Generate DB Password from license key - a good idea?

There's this web app which has a SQLServer database, and the connection string it uses to access the database is not stored in any configuration file. Rather, the designers decided it would be a good ...
5
votes
2answers
1k views

Keeping user data private in a cloud environment like Google App Engine

I am writing an open-source Java application for Google App Engine (GAE). The application will let users create content that is intended to be private. I want to provide reasonable assurances that ...
9
votes
3answers
391 views

Is it preferable to perform encryption using database functions or code?

Several databases I am familiar with provide functions or modules for encryption. Examples include dbms_crypto for oracle databases and built-in functions for MySQL. Most of the commonly used ...
3
votes
4answers
507 views

When hashing passwords, is it okay to store the algorithm used right there in the database?

Since hashing password has become a hot topic recently, it is only natural to expect things to change and assume that some time down the road you might want to replace/tweak the algorithm used in your ...
0
votes
1answer
259 views

What should be Database encryption strategy ?

In MS SQL Server 2005/2008 standard encryption all data in the database is encrypted using the SMK/DMK scheme. In this scheme a key is issued for each client connecting to the database. What would a ...
1
vote
3answers
263 views

For what do I hash user passwords with PDKDF2 when the user data is stored in the same database?

I'm hashing the passwors of my users with PDKDF2 right now. A user can gain access to his account with his password. When the user is logged in he can edit his personal information and do other stuff ...
3
votes
3answers
531 views

Security/Malware implications of storing data in a BLOB as opposed to the file system

From a programming perspective, there has long been a debate over whether to store files in a BLOB or Binary field in a database, or on the file system. The debate always seems to center around ...
5
votes
2answers
734 views

Security of NoSQL databases

Hopefully this isn't too broad. I've got little experience with NoSQL databases, but I know that they are rising in popularity. As a developer that is extremely concerned with security, I'm ...
5
votes
4answers
344 views

Does any database let you disable non-parameterized queries and therefore disable SQL injection?

Is there a database that allows this already? If not, here is how I think it could be done. I think it would require modifying the database software and the driver or code that is assembling the SQL ...
7
votes
2answers
728 views

Sending data form registration forms

I understand that sending data from the user to the server, unencrypted, is a bad practice. That is logical. So how do I encrypt 'userside' and send the data to the server in encrypted form? Can ...
11
votes
4answers
7k views

How to know which database is behind a web application?

I've read that different databases (mysql, sql server,...) have different vulnerabilities and that they are vulnerable to some specific sql injections. When attacker try to perform a database attack ...
2
votes
3answers
573 views

Why are triggers not often used to secure a database?

I did an intern for a company becoming PCI compliant and instead of using triggers to prevent SQL injection, I went through 1000s (if not more) lines of web-app code and called functions every time ...
2
votes
4answers
946 views

Code, Data and Passwd encrypted? sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID

Lots of our *NIX scripts use "sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID" I know that not good to have clear text password in scripts (there is no alternative at the moment). But question is the ...
1
vote
1answer
278 views

Protect database resources from fake data inputs via web forms

Scenario: I'm working on a project that needs to accept large amounts of data (customer data) from its users. So it can be normal to have a user trying to add 10,000 or 100,000 records at a time. In ...
3
votes
2answers
131 views

Local Network Data Sync and Access Log

We have some confidential data for our research. Currently, we use an encrypted hard drive for storing the data and any researcher using the data takes it off the drive. However, we do not have any ...
3
votes
2answers
570 views

User authentication + database encryption with same password

I'm working on a private project where I need to store a users financial data in a database. I'll encrypt this data using AES, and I'll be using scrypt to generate a AES ecnryption key from a more ...
5
votes
1answer
1k views

Practices for storing username/password in Web applications

I have read the following question: Storing password in Java application but I don't find the answers useful for my case. So here is my question somehow related to that. I have a Java Web application ...
3
votes
2answers
291 views

Are there special attack vectors for statistical databases?

Are statistical databases vulnerable to SQL injection attacks? If so, what specific kind? Can you think of an example?
9
votes
2answers
1k views

Is there a benefit in using Oracle's WRAP to obfuscate PL/SQL Code

Oracle stored program units (procedures, functions, packages and types) can be obfuscated using the WRAP functionality. Apart from the generic arguments about 'security through obscurity' are there ...
1
vote
0answers
110 views

What becomes of SIEM when a large database like teradata gets involved? [closed]

My topic sentence says it all. I want to know the effect on performance, storage and analysis capabilities when teradata database is added. I'm talking about 70TB of storage with internal ...
2
votes
2answers
1k views

how long does it take to brute force varying encryption standards?

Let's say I want to encrypt information in a database. What would be the best encryption algorithm to use and why. I was thinking AES, since it's widely used as a government standard, but if the ...
6
votes
5answers
4k views

How can I avoid putting the database password in a perl script?

I have a cronned perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
8
votes
3answers
1k views

Is it safe to store a single symmetric key encrypted with several different RSA public keys?

For the field-based encryption of a database containing sensitive information, I was thinking of the following design: Every user has a smartcard used for client certificate login. After login the ...
7
votes
1answer
1k views

Store user passwords in NoSQL database?

I am currently coding the backend of a website and I have not come across an article where this is discussed. I want to store all my application data in MongoDB but I'd like to split out my sensitive ...
4
votes
2answers
10k views

Where/How is an ODBC password stored when 'saved' in Access?

I have been working on a program that uses MS Access and ODBC to connect to an SQL server. One of the requirements is that the user need not know the password for the connection to the SQL server, so ...