Security related aspects of databases and database access.
-3
votes
0answers
31 views
auto backup database and folders on host from Mac [closed]
I am being constantly attacked and would like a solution that would support me while I fix the code (couple of days). I have a domain on justhost and would like to have an application on my mac that ...
20
votes
4answers
1k views
Is it okay to reveal database's table names?
I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
5
votes
1answer
91 views
Database encryption or filesystem encryption?
Recently I've been working on some data which, although not directly governed by any infosec laws, is sensitive enough to warrant being encrypted. I'm interested in finding out about best practises ...
-3
votes
3answers
95 views
How to effectively save database password inside desktop application?
Suppose we are in the field of desktop applications which need to store their data in a database. How do I store the password for this database avoiding the most obvious mistakes, which are:
1) hard ...
6
votes
3answers
345 views
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked?
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?)
LivingSocial - 50 Million Users Exposed
Zappos - 24 Million ...
17
votes
8answers
3k views
Why Not Allow Special Characters In a Password?
The culprit in this case is a particular (and particularly large) bank. I know one that does not allow special characters (of any sort) in their passwords. Is their any valid reason for doing this? ...
3
votes
4answers
288 views
Database hardening techniques
So as I understand it database hardening is a process in which you remove the vulnerabilities that result from lax con-figuration options. This can sometimes compensate for exploitable vendor bugs.
...
4
votes
2answers
128 views
Secure yet reversible encryption for local data store
I'm working on a piece of software to store and manage records for a youth group. They've found that a lot of the time they spend on record-keeping and admin is taken up by scanning through looking ...
1
vote
1answer
91 views
Isolating database? Is it possible?
I have been assigned CTF project for IT Security for my final year project in school.
We are planning to have a flag that are base on SQL injection but for the user to overcome the challenge, they ...
7
votes
2answers
128 views
Privacy violation even when queries with too few results are rejected
I was reading a Computing security book1 and saw a question regarding database security and privacy. I can't quite figure out the answer, so I thought I will ask here.
One approach to ensure ...
4
votes
2answers
110 views
How dangerous are direct references to database keys?
An OWASP note suggests that direct object references are considered insecure in some contexts. They defined "direct object reference" as follows:
“A direct object reference occurs when a developer ...
2
votes
1answer
128 views
Does Web Apps and Databases running on AWS EC2 need a IDS/IPS?
I have googled around for information about Web Apps or Databases running on AWS EC2 needing a IDS/IPS or not.
I will present my findings so far here, but it will be good if you guys can confirm ...
8
votes
6answers
4k views
xp_cmdshell: should it ever be used?
Can 'xp_cmdshell' ever be used safely within a stored proc and are there any situations for which there really is no other option? In other words, should it's useage within a stored proc always be ...
2
votes
2answers
92 views
Database security: Remove superuser role
I've recently heard on some IT-SEC conference, that good idea to secure database (probably against privilege-escalation attack) is to remove superuser role, and leave only user roles.
I imagine that ...
3
votes
4answers
125 views
Anonymized Votes
Background
Looking to create an anonymous voting system. The system must track whether or not a user voted on an item (public information), but only that user is ever allowed to know whether they ...
4
votes
4answers
182 views
What kind of attacks result in an attacker only being able to leak a site's database?
Of the public disclosures I've seen from recently compromised sites, it seems common for only the database to be leaked, rather than the application code, or rather than a complete takeover. Is this ...
2
votes
2answers
121 views
MySQL Access Control?
I have read somewhere that it is better to have two different MySQL logins in order to prevent hacking. What I mean is having one MySQL login for read access (SELECT permission) and another login for ...
5
votes
2answers
205 views
How did Evernote detect the security breach?
http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/
Evernote's official message says little about technical details of the attack and how it was detected.
...
2
votes
1answer
62 views
Can we reverse engineer binlog with row format to make MySQL AES_ENCRYPT visible?
Suppose if I am using the mysql database based encryption using AES_ENCRYPT function & insert records, is it possible to decode the row formatted binlogs generated by MySQL to obtain the actual ...
0
votes
2answers
122 views
Encrypting Fields in Database
I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
2
votes
7answers
232 views
How to provide security for passwords stored in Database? [duplicate]
Passwords of end Users are stored in Database which is encrypted (using one way hash like MD5). Apart from me, there are 'other' people belonging to other teams who have access to Database which means ...
5
votes
4answers
248 views
How to upgrade the hashing method of a live database without compromising security?
I'm working on an Intranet project that is accessible from the outside. The password are stored in a Sql Server database in the normal Hash and salt method. The problem lies in the hashing algorithm.
...
0
votes
1answer
137 views
How Twitter got hacked and preventing [closed]
I have been seeing in the news recently that Twitter (including Wall Street Journal and New York Times) got hacked by a sophisticated hacker (group), but I would have assumed they would have ...
3
votes
4answers
148 views
Generate DB Password from license key - a good idea?
There's this web app which has a SQLServer database, and the connection string it uses to access the database is not stored in any configuration file. Rather, the designers decided it would be a good ...
5
votes
2answers
571 views
Keeping user data private in a cloud environment like Google App Engine
I am writing an open-source Java application for Google App Engine (GAE). The application will let users create content that is intended to be private. I want to provide reasonable assurances that ...
8
votes
3answers
141 views
Is it preferable to perform encryption using database functions or code?
Several databases I am familiar with provide functions or modules for encryption. Examples include dbms_crypto for oracle databases and built-in functions for MySQL.
Most of the commonly used ...
2
votes
3answers
234 views
What things should a penetration tester know about databases?
I want to start learning about databases from pentesters perspective and I would like to know what things will be useful on the long run . Also do you know any good book to kickstart my experience at ...
3
votes
4answers
186 views
When hashing passwords, is it okay to store the algorithm used right there in the database?
Since hashing password has become a hot topic recently, it is only natural to expect things to change and assume that some time down the road you might want to replace/tweak the algorithm used in your ...
0
votes
1answer
201 views
What should be Database encryption strategy ?
In MS SQL Server 2005/2008 standard encryption all data in the database is encrypted using the SMK/DMK scheme. In this scheme a key is issued for each client connecting to the database. What would a ...
1
vote
3answers
171 views
For what do I hash user passwords with PDKDF2 when the user data is stored in the same database?
I'm hashing the passwors of my users with PDKDF2 right now. A user can gain access to his account with his password. When the user is logged in he can edit his personal information and do other stuff ...
9
votes
5answers
2k views
What is the best practice for placing DataBase servers in secure network topologies
I have a classic DMZ architecture:
My webserver is placed in the DMZ.
The webserver needs to communicate with a database server. This database server is the most critical component of my network ...
3
votes
3answers
170 views
Security/Malware implications of storing data in a BLOB as opposed to the file system
From a programming perspective, there has long been a debate over whether to store files in a BLOB or Binary field in a database, or on the file system. The debate always seems to center around ...
3
votes
2answers
282 views
Security of NoSQL databases
Hopefully this isn't too broad.
I've got little experience with NoSQL databases, but I know that they are rising in popularity. As a developer that is extremely concerned with security, I'm ...
5
votes
4answers
221 views
Does any database let you disable non-parameterized queries and therefore disable SQL injection?
Is there a database that allows this already?
If not, here is how I think it could be done. I think it would require modifying the database software and the driver or code that is assembling the SQL ...
7
votes
2answers
159 views
Sending data form registration forms
I understand that sending data from the user to the server, unencrypted, is a bad practice. That is logical.
So how do I encrypt 'userside' and send the data to the server in encrypted form?
Can ...
11
votes
4answers
1k views
How to know which database is behind a web application?
I've read that different databases (mysql, sql server,...) have different vulnerabilities and that they are vulnerable to some specific sql injections.
When attacker try to perform a database attack ...
2
votes
3answers
261 views
Why are triggers not often used to secure a database?
I did an intern for a company becoming PCI compliant and instead of using triggers to prevent SQL injection, I went through 1000s (if not more) lines of web-app code and called functions every time ...
2
votes
4answers
313 views
Code, Data and Passwd encrypted? sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID
Lots of our *NIX scripts use "sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID"
I know that not good to have clear text password in scripts (there is no alternative at the moment). But question
is the ...
0
votes
1answer
165 views
Protect database resources from fake data inputs via web forms
Scenario:
I'm working on a project that needs to accept large amounts of data (customer data) from its users. So it can be normal to have a user trying to add 10,000 or 100,000 records at a time. In ...
3
votes
2answers
93 views
Local Network Data Sync and Access Log
We have some confidential data for our research. Currently, we use an encrypted hard drive for storing the data and any researcher using the data takes it off the drive.
However, we do not have any ...
3
votes
2answers
184 views
User authentication + database encryption with same password
I'm working on a private project where I need to store a users financial data in a database. I'll encrypt this data using AES, and I'll be using scrypt to generate a AES ecnryption key from a more ...
5
votes
1answer
314 views
Practices for storing username/password in Web applications
I have read the following question: Storing password in Java application but I don't find the answers useful for my case.
So here is my question somehow related to that. I have a Java Web application ...
3
votes
2answers
152 views
Are there special attack vectors for statistical databases?
Are statistical databases vulnerable to SQL injection attacks?
If so, what specific kind? Can you think of an example?
7
votes
2answers
572 views
Is there a benefit in using Oracle's WRAP to obfuscate PL/SQL Code
Oracle stored program units (procedures, functions, packages and types) can be obfuscated using the WRAP functionality.
Apart from the generic arguments about 'security through obscurity' are there ...
1
vote
0answers
66 views
What becomes of SIEM when a large database like teradata gets involved? [closed]
My topic sentence says it all.
I want to know the effect on performance, storage and analysis capabilities when teradata database is added. I'm talking about 70TB of storage with internal ...
1
vote
2answers
630 views
how long does it take to brute force varying encryption standards?
Let's say I want to encrypt information in a database. What would be the best encryption algorithm to use and why. I was thinking AES, since it's widely used as a government standard, but if the ...
5
votes
5answers
1k views
How can I avoid putting the database password in a perl script?
I have a cronned perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
8
votes
3answers
554 views
Is it safe to store a single symmetric key encrypted with several different RSA public keys?
For the field-based encryption of a database containing sensitive information, I was thinking of the following design:
Every user has a smartcard used for client certificate login.
After login the ...
6
votes
1answer
379 views
Store user passwords in NoSQL database?
I am currently coding the backend of a website and I have not come across an article where this is discussed. I want to store all my application data in MongoDB but I'd like to split out my sensitive ...
3
votes
1answer
154 views
How to design SIEM RFP, keeping in view large database requirements?
I need some help regarding the design of SIEM requirments. In regard to large databases, what general requirements do I need to provide in order to provide coverage related to DB security?
Some of ...
