Security related aspects of databases and database access.
40
votes
6answers
6k views
SQL injection — but why isn't escape quotes safe anymore?
I haven't seen this question asked, and feel it's a valuable bit of information to have, especially because this is a huge source of mystery and confusion.
Raw SQL
When you're writing SQL -- for ...
21
votes
3answers
5k views
How to secure a MongoDB instance?
Does anybody have experience with securing/hardening MongoDB server? Check lists or guides would be welcome.
20
votes
4answers
1k views
Is it okay to reveal database's table names?
I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
17
votes
8answers
3k views
Why Not Allow Special Characters In a Password?
The culprit in this case is a particular (and particularly large) bank. I know one that does not allow special characters (of any sort) in their passwords. Is their any valid reason for doing this? ...
17
votes
2answers
2k views
MySQL Server Hardening
Following the hardening theme....
What are some best practices, recommendations, required reading for securing MySQL.
12
votes
3answers
1k views
When using AES and CBC, can the IV be a hash of the plaintext?
[Originally on programmers.stackexchange.com with title: Can you encrypt with AES+CBC and search the encrypted data]
Basically, I'm going to go with Advanced Encryption Standard with either ...
11
votes
4answers
1k views
How to know which database is behind a web application?
I've read that different databases (mysql, sql server,...) have different vulnerabilities and that they are vulnerable to some specific sql injections.
When attacker try to perform a database attack ...
10
votes
4answers
1k views
Does stored procedure prevent SQL Injection in postgreSQL
Is it true that Stored procedure will prevent databases to be injected? I did a little research and I found out that SQL-Server, Oracle and MySQL are not safe against SQL injection if we only use ...
10
votes
2answers
568 views
What are the SQL-injections issues of parameterized queries?
I've written some code to generate an SQL query in ASP classic. I'm not sure if it's secure or not:
Set adoCon = Server.CreateObject("ADODB.Connection")
adoCon.Open "Provider=Microsoft.Jet.OLEDB.4.0; ...
10
votes
4answers
586 views
Encrypting IP addresses in a MySQL database
I'd like to encrypt IP addresses in my MySQL database, with the following constraints:
Does not need to be resistant to attackers that can execute queries.
Must be resistant to attackers that have ...
10
votes
3answers
181 views
Different MySQL Users Security Benefits
Anyone with a brain cell knows that using a user that isn't root/dbo/etc adds a lot to security and how effective SQL injection attacks can be. I'm wondering if taking that idea a step further is a ...
9
votes
5answers
2k views
What is the best practice for placing DataBase servers in secure network topologies
I have a classic DMZ architecture:
My webserver is placed in the DMZ.
The webserver needs to communicate with a database server. This database server is the most critical component of my network ...
9
votes
2answers
519 views
What are the security benefits to a separate user database?
In the app I'm writing I separated the user and main databases a long time ago for "security reasons". However its getting harder and harder to justify the overhead and the difficulty of managing such ...
9
votes
3answers
3k views
Encrypting with Mongo
How can I achieve the following goals?
All compute and storage to be located in the cloud.
Encryption in transit of all data between web nodes and db nodes running MongoDB.
How to set up tunnels? ...
8
votes
6answers
4k views
xp_cmdshell: should it ever be used?
Can 'xp_cmdshell' ever be used safely within a stored proc and are there any situations for which there really is no other option? In other words, should it's useage within a stored proc always be ...
8
votes
3answers
3k views
PostgreSQL Security Audit
Could anyone provide a good resource or check-list for a security review of PostgreSQL?
8
votes
3answers
561 views
Is it safe to store a single symmetric key encrypted with several different RSA public keys?
For the field-based encryption of a database containing sensitive information, I was thinking of the following design:
Every user has a smartcard used for client certificate login.
After login the ...
8
votes
3answers
141 views
Is it preferable to perform encryption using database functions or code?
Several databases I am familiar with provide functions or modules for encryption. Examples include dbms_crypto for oracle databases and built-in functions for MySQL.
Most of the commonly used ...
8
votes
1answer
95 views
Is there a list of default, standard or third-party “users” for Oracle
When installed, and depending on which options it is installed with, there are a bunch of standard users pre-created in Oracle.
Additionally, third-party software often has its own set of ...
7
votes
2answers
574 views
Is there a benefit in using Oracle's WRAP to obfuscate PL/SQL Code
Oracle stored program units (procedures, functions, packages and types) can be obfuscated using the WRAP functionality.
Apart from the generic arguments about 'security through obscurity' are there ...
7
votes
2answers
129 views
Privacy violation even when queries with too few results are rejected
I was reading a Computing security book1 and saw a question regarding database security and privacy. I can't quite figure out the answer, so I thought I will ask here.
One approach to ensure ...
7
votes
2answers
159 views
Sending data form registration forms
I understand that sending data from the user to the server, unencrypted, is a bad practice. That is logical.
So how do I encrypt 'userside' and send the data to the server in encrypted form?
Can ...
7
votes
1answer
492 views
How to make SQL injection in PostgreSQL's tsquery?
I think there is SQL injection vulnerability in an application I'm testing. This is seen when I enter malformed parameters into a search form. All exceptions are shown in format:
PHP raised unknown ...
7
votes
1answer
369 views
What evaluation criteria would you use for an Oracle scanning tool?
What evaluation criteria would you use to select the right Oracle scanning tool?
Context:
To deploy an automated scanning tool (nessus / SQuirreL etc) for use by both development teams and security ...
6
votes
3answers
375 views
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked?
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?)
LivingSocial - 50 Million Users Exposed
Zappos - 24 Million ...
6
votes
3answers
935 views
Risk of configuring MySQL for remote access with a dynamic IP address?
I'm looking to make a MySQL database on a VPS, accessible to my home PC through cPanel. cPanel wants the domain name or IP address of the remote machine. However, with standard DSL, I have a dynamic ...
6
votes
4answers
653 views
What is the right way of storing database connection strings from the security point of view?
What are recommendations, best practices and have-to-dos regarding handling connection strings in web applications? What things one should never, ever do?
6
votes
3answers
172 views
Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?
I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
6
votes
1answer
384 views
Store user passwords in NoSQL database?
I am currently coding the backend of a website and I have not come across an article where this is discussed. I want to store all my application data in MongoDB but I'd like to split out my sensitive ...
5
votes
4answers
222 views
Does any database let you disable non-parameterized queries and therefore disable SQL injection?
Is there a database that allows this already?
If not, here is how I think it could be done. I think it would require modifying the database software and the driver or code that is assembling the SQL ...
5
votes
4answers
248 views
How to upgrade the hashing method of a live database without compromising security?
I'm working on an Intranet project that is accessible from the outside. The password are stored in a Sql Server database in the normal Hash and salt method. The problem lies in the hashing algorithm.
...
5
votes
5answers
1k views
How can I avoid putting the database password in a perl script?
I have a cronned perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
5
votes
2answers
205 views
How did Evernote detect the security breach?
http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/
Evernote's official message says little about technical details of the attack and how it was detected.
...
5
votes
2answers
348 views
mysql security logging
Is there any logging available that logs mysql connection attempts to the port, login attempts, and times succeeded with username, IP address and date time?
Im trying to detect brute force attempts.
...
5
votes
2answers
155 views
Online SQL Server database for a Business app. Security considerations
A business application works with a SQL Server database. A SQL Server 2008 is installed on one of the computers of the local network. Technically this app works OK if the server computer with the SQL ...
5
votes
1answer
178 views
Secure access to a Microsoft Access Database
I have a server set up with medical files in a Access database.
I am taking over this job from an existing guy who has vanished, so I don't know all the details of the system. I can find out specific ...
5
votes
1answer
93 views
Database encryption or filesystem encryption?
Recently I've been working on some data which, although not directly governed by any infosec laws, is sensitive enough to warrant being encrypted. I'm interested in finding out about best practises ...
5
votes
1answer
322 views
Practices for storing username/password in Web applications
I have read the following question: Storing password in Java application but I don't find the answers useful for my case.
So here is my question somehow related to that. I have a Java Web application ...
5
votes
2answers
573 views
Keeping user data private in a cloud environment like Google App Engine
I am writing an open-source Java application for Google App Engine (GAE). The application will let users create content that is intended to be private. I want to provide reasonable assurances that ...
4
votes
4answers
932 views
Is it generally a bad idea to encrypt database fields?
I work on a tiny company, it's literally me (the programmer) and the owner. The owner has asked me to encrypt several fields in a database to protect the customers data. This is a web application that ...
4
votes
3answers
781 views
Does Hash/Salted password really help when DB is compromised?
I came across this article and got a basic understanding hash, salt and brute force attack.
My question is in the article, the author emphasises how hard it is to reverse the hash/salted password to ...
4
votes
5answers
397 views
What are the likely threats to a public-facing DB instance?
Quick intro: Small company, VERY limited resources. I pretty much do everything including take out the trash.
We've been running an instance of MySQL internally for years and it's worked OK, but I ...
4
votes
6answers
597 views
Filter user input before the database or upon display?
Given a web application where user data must be properly escaped to avoid XSS, is it better to try to remove the "bad stuff" before it enters the database, or is it best to allow it in the database ...
4
votes
5answers
4k views
Mysql - two-way encryption of sensitive data (email addresses) outside of Apache, PHP and MySQL
We store user email addresses in our database, like many other websites. While we do take pride in the security measures in place, sometimes "just enough" is just not enough.
We've begun looking into ...
4
votes
4answers
183 views
What kind of attacks result in an attacker only being able to leak a site's database?
Of the public disclosures I've seen from recently compromised sites, it seems common for only the database to be leaked, rather than the application code, or rather than a complete takeover. Is this ...
4
votes
2answers
162 views
What to do in response to a source code and/or database leak by a third party hosting provider?
My PHP sourcecode and database (PHPMyAdmin Dump) has been leaked publicly and I believe that the web host I have used for this service are responsible for the leak.
On first appearances, the web host ...
4
votes
3answers
1k views
When is it appropriate to SSL Encrypt Database connections?
Let's say I have a web server I setup, and then a database server.
However, they are communicating locally and are behind firewall. In my opinion, no SSL is needed here right?
The only time to use ...
4
votes
2answers
169 views
In the case of the Gawker data breach, would strong passwords be ok?
In the Gawker data breach, was just the database stolen and that gave free access to all user data? Or did the hackers still need to read the MD5's of the usernames and passwords to gain access to the ...
4
votes
2answers
945 views
How do I protect user data at rest?
I want to encrypt the username, email, and password fields in the database AND encrypt user files at rest. How can I do this? I am aware of software such as Gazzang and since there is not cost ...
4
votes
2answers
111 views
How dangerous are direct references to database keys?
An OWASP note suggests that direct object references are considered insecure in some contexts. They defined "direct object reference" as follows:
“A direct object reference occurs when a developer ...
