Tag Info

Hot answers tagged

62

Physical destruction of a drive is tricky business. There are many companies that deal specifically in the field of data destruction, so if you are doing any kind of mass you may want to at least look at their price list. If you contract, make sure the company is properly bonded/insured, and provides audit trails for each destroyed item. In the worst case ...


40

Summary: it was marginally better on older drives, but doesn't matter now. Multiple passes erase a tree with overkill but miss the rest of the forest. Use encryption. The origin lies in work by Peter Gutmann, who showed that there is some memory in a disk bit: a zero that's been overwritten with a zero can be distinguished from a one that's been overwritten ...


39

Very good question. Yes, by default, WinRAR leaves traces of temporarily extracted files. WinRAR does indeed create temporary files when opening them directly from the archive. It also performs a normal deletion once WinRAR is closed. However, deleted files do physically stay on the disk after you delete them. Normal delete operations only delete the file ...


30

Here is what I do... I assume my data is out there... I don't bother looking for it. Somebody will run across my SSN eventually and it will get scraped up into a database and sold around the world. As far as I'm concerned, searching for my data has little value and certainly won't put the horse back into the barn. In fact, even searching for my SSN or ...


26

Assuming that You're 100% sure that your database server only accepts local connections. You're 100% sure that the attacker doesn't have access to the local environment from which connections are allowed. You're 100% sure that the application that uses the database is otherwise secure. You're 100% sure that those credentials aren't used for anything else ...


19

Use SSL Make sure you implement session management correctly - for example the presence of correct session id checked on each page and destroyed with logout Add cache control: no-cache, pragma: no-cache and expire: -1 headers everywhere Make sure that forms and every sensitive variable are submitted only through POST requests and not GET (during code audits ...


18

The only NIST approved method to securely erase a hard drive is by utilizing the secure erase internal command - documented at the Center for Magnetic Recording Research (CMRR) - and that is what everyone should be doing. It is an ATA command, and covers (S)ATA interfaces. After that, you can optionally degauss the drive to erase the firmware itself. Lots ...


18

You do get some security from the way your fuse box is connected to the mains. In principle you should get a good signal across any part of the wiring in your house that is on the same phase, and you shouldn't get any on the other phases. In reality though, that isn't quite true - depending on your fuse box, you may get some bleed over onto the other ...


17

The underlying idea of the comic is that separation of user accounts has been designed for mainframes: big computers, shared by many users. In that model, the potential attackers are other users. Account separation is then about protecting users from other users; only the god-like admin account can access everything on the machine, and the administrator has ...


16

I think it's fair to say that the idea that any large organisation is entirely impervious to attack has been proven false over the last five years or so. Everyone from nation states through large corporations, security consultancies and other security minded companies have had breaches. One reason that a bank hasn't been thrown into "complete chaos" as you ...


14

If he can't access the database, the credentials are meaningless. It's like having a key to a door that's inside a guarded military bunker hidden in a remote location in the Gobi desert. The key is only useful if you can get to the door. That being said, it'd be very bad practice to let your credentials leak out like this. If you suspect that they're ...


13

I don't understand how these database tables are accessed. Surely it is not SQL Injection, as that should be a thing of the past with prepared statements, Ahhh assumptions.. Have you seen the OWASP Top Ten project? SQL injections have always been a constant source of security issues. I cannot see how changing any session state would effect the ...


12

I live in a detached family home in Texas. I have a pair of Trendnet TPL-303E powerline adapters and have experienced the signal bleed from my next door neighbor. I ran the Powerline utility that came with the adapters and could identify two other powerline adapters using the same network name. I got anywhere between 10 to 20Mbps of throughput between their ...


12

From a theoretical standpoint the idea of total drive destruction may be the only way of destroying data on a hard drive fully. From a practical standpoint, I've not seen any evidence that it's possible to recover meaningful data from a standard hard drive (ie, not taking SSDs or other devices that use wear levelling or similar technologies) after a once ...


11

For Javascript, Internet Explorer allows you to block that specific functionality, without disabling Javascript altogether. In Tools -> Internet Options -> Security -> -> Custom Level, you can find the following setting: Sadly, I wasn't able to find an equivalent setting in neither FF nor in GChrome. Additionally, however, as it has been mentioned, ...


11

When you say "Welcome" screen with all users listed. Is that so, or is it one named user and then "Other user"? If it is one named user and "Other user" then the named user is actually coming from the RDP client and is not being exposed. Depending on which client you are connecting with, but at least the Win XP client will save last connected user on the ...


11

As described by this talk at Confidence'09, There are some arguments against the deployment of certain DLP solutions (I realise that this is a contentious issue but these concerns should at least be evaluated). In essence many of these solutions are in fact nothing more than legitimate rootkits. The research behind the linked talk found that one of the DLP ...


10

Seeing that you're using Mac, manipulating logs is as simple as elevating yourself to a root (admin) user, by using a command such as 'sudo -i' in your terminal, and then editing them as you like. As far as I'm concerned, logs are a security professional's best friend. The more logs you have the more information you have to pull from (at the same time, ...


9

The non-interference model is all about preventing covert channels through shared resources or inference attacks. An example can be the following: Suppose that two users of different security levels are working on the same system (remotely, using shells for example). The lower level user should not be know anything about the work done by the higher level ...


9

I was asked about your problem several times in several occasions. What makes it really difficult to answer is, that this in fact isn’t really a tech-problem. It's much more a social/human problem. There are many great firewall-systems like SonicWall/FortiGate/etc. (also VM-Based solutions) which will cost you maybe only 500$. They are all able to block ...


9

When I worked for the .gov, the answer was to take it apart looking for storage media (which you remove and take care of). If it's still serviceable afterwards, then off to salvage (for sale or recycling) it goes! I'm sure that they did something different (aka, tossed it in a shredder) for machines that held the scary stuff, I don't know.


9

What you must ask before you continue: Is risking the release of the sensitive data worth the amount of money made from the sale of the device? If not, destruction is your safest bet. If so, remove harddrive, EPROMS/memory, and the image drum, and sell for parts. In my current environment, the only accepted answer by my employer is 100% destruction, but ...


9

From what I can see this appears to be an aggregator for financial services. For it to have any useful function, that implies it must, at least temporarily, store your account details and authentication credentials - in which case it is far from "read-only". That the providers then state the exact opposite in the security statement makes me think these are ...


9

There's no way to be certain that someone with physical access to your server can't get at your data. But you can take certain precautions: First of all, if the attacker gets access to your server while it's in its "running" state, so either through the console, through remote desktop, SSH, etc., then there's not a lot you can do. You're relying on your OS ...


8

Note that other client side technologies such as Java applet, Adobe Flash, Silverlight may also have access to your data in the clipboard.


8

what defines a advanced kind of attack? Advanced for who and how? Ultimately, an attack is an attack. It doesn't matter if they used social engineering techniques to get an unsuspecting user to divulge their credentials, brute-force methods, obtained a copy of the software and performed reverse engineering or used the system in methods other than ...


8

Basic: using off the shelf tools, scripts, exploits, etc. to compromise systems. No deeper knowledge of what you are exploiting or how. Limited to public-facing internet attacks. Commonly referred to as script kiddies. Advanced: creating your own tools to exploit holes you have discovered and/or bought. Understanding exactly how you are overflowing those ...


8

The risk to the recipient is that there could be anything on there. The biggest risk to you is probably reputational damage, as you are just providing empty USB sticks, not delivering them with sensitive information on. I would be surprised if they could hold you liable for loss of their data - I don't know of any cases thus far where this has happened ...


8

The "privacy policy" of Google, and hackers, are mostly orthogonal issues. The new privacy policy is about making clear to you, in a legal way, that Google may aggregate all your data, regardless of the "service" under which you made such data available to Google. The "hacker risk" that you allude to is more about how a malicious individual, obtaining an ...



Only top voted, non community-wiki answers of a minimum length are eligible