Hot answers tagged

387

There is no general fix for SQLi because there is no fix for human stupidity. There are established techniques which are easy to use and which fix the problems (especially parameter binding) but one still has to use these techniques. And many developers are simply not aware of security problems. Most care that the application works at all and don't care ...


328

"If lack of encryption allows FBI to catch terrorists, then lack of encryption allows criminals to loot your emails and plunder your bank account." The rational point here is that technology is morally neutral. Encryption does not work differently depending on whether the attacker is morally right and the defender morally wrong, or vice versa. It is all ...


242

Because it's not a problem. When was the last time a company with a SQL injection vulnerability got hauled up in court, and slapped with a big fine for being reckless with user data, and the directors' warned, fined or locked up for negligence? When was the last time a company lost a big contract because their company website login page didn't validate ...


186

As mentioned in the answers to a very similar question, scribbling over part of an image will destroy the original pixels, assuming that your editor doesn't store any layers or undo history. (Paint doesn't.) There are some things to watch out for, though: The width of the blanked region places an upper bound on the length of the secret data The height of ...


106

SQL injection is still around because the software world still doesn't understand that programmatic generation of tree-structured values (like queries or markup) should be done by constructing syntax trees as first-class objects, not by concatenating strings that represent fragments of a language. There has been a bit of progress in recent years with the ...


79

I would take their argument and replace "cryptography" with "locks and keys on our houses" and see if they still agree: If more terrorists and criminals would be caught by not having locks and keys on our houses, I would not blame warrantless searches by government and companies in our homes.


77

Summary: it was marginally better on older drives, but doesn't matter now. Multiple passes erase a tree with overkill but miss the rest of the forest. Use encryption. The origin lies in work by Peter Gutmann, who showed that there is some memory in a disk bit: a zero that's been overwritten with a zero can be distinguished from a one that's been overwritten ...


74

Physical destruction of a drive is tricky business. There are many companies that deal specifically in the field of data destruction, so if you are doing any kind of mass you may want to at least look at their price list. If you contract, make sure the company is properly bonded/insured, and provides audit trails for each destroyed item. In the worst case ...


68

Explain it with questions: Do you close the door when you poop? Why? Everybody poops, you aren't doing anything special in there, so what do you have to hide? If someone leaves a pile of poop downtown in the middle of the road does that mean we must all poop with door open? Simply because the pile of poop was gathered in a bathroom?


58

The thing I haven't yet seen anyone mention is: Ordinary criminals are far more common than terrorists. While crypto might help a terrorist evade the FBI (for a while, anyway) it also helps protect you from ordinary criminals who want to steal your money and hijack your computer for their own ends. The question is, will you concretely give up your safety ...


52

One of the main reasons behind the prohibition of writing data to USB drives (I had this explained to me once) is not to prevent employees from stealing sensitive information. If they wanted to do that, they would have no end of workarounds, up to printing QR codes on A4 sheets. Rather, it is to prevent employees from saving sensitive information on USB ...


51

Ditto Ben N, but let me add a couple of points that are too long to fit as comments. I'd emphasize the distinction between layered and un-layered data formats. Drawing a black box over a section of a GIF, JPG, or PNG image destroys the previous contents. Drawing a black box over a section of a Photoshop, Corel Draw, or Paint Shop Pro native image does not ...


47

Very good question. Yes, by default, WinRAR leaves traces of temporarily extracted files. WinRAR does indeed create temporary files when opening them directly from the archive. It also performs a normal deletion once WinRAR is closed. However, deleted files do physically stay on the disk after you delete them. Normal delete operations only delete the file ...


46

When testing, it is very easy to test for what you expect to happen. For example, when filling in a "name" field in a database you will probably choose something you are familiar with, like "John Doe". This works, and your application seems to work fine. Then, one day, someone names their child Robert'); DROP TABLE Students; -- (little Bobby Tables). Of ...


45

Imagine if, during the civil rights era, people had access to things like email and smartphones. People like the organizers of the Montgomery bus boycotts would have a little pocket computer that could tell the authorities where they’d been, who they talked to, and what they were talking about. The authorities, at the time, considered these people ...


36

The question could also be asked: "how long should an employee have access to data before they are trained in how to use and protect that data?" For most organizations, the answer is "0 minutes". You wouldn't place an employee in front of machinery without training them, and you shouldn't place employees in front of a computer without training either. Each ...


31

The only NIST approved method to securely erase a hard drive is by utilizing the secure erase internal command - documented at the Center for Magnetic Recording Research (CMRR) - and that is what everyone should be doing. It is an ATA command, and covers (S)ATA interfaces. After that, you can optionally degauss the drive to erase the firmware itself. Lots ...


31

There is mainly two kind of people to consider in this question: The person working on the computer. This person is your employee, they went through your HR screening and abides by your policies. They have been trusted to access and work with some data. Due to this, since they need to see, no technical measure can prevent them from taking photographs (...


31

My response here is likely many in a sea of answers, but here's the breakdown of why encryption is good, why it's vital, and why breaking it is pointless. - Congress investigation found not a single terrorist plot was stopped by the NSA. So it's all taxpayer's cost for no profit See here. FBI Coleen Rowley at the London's whistleblowers conference ...


30

Here is what I do... I assume my data is out there... I don't bother looking for it. Somebody will run across my SSN eventually and it will get scraped up into a database and sold around the world. As far as I'm concerned, searching for my data has little value and certainly won't put the horse back into the barn. In fact, even searching for my SSN or ...


30

Usually the PNG format does not support multiple layers. So when you draw over something, whatever was there before is lost. However, the PNG format supports storage of an unlimited amount of metadata which is usually not displayed by image viewers. This feature is often used by image editors to add additional metadata to the image. One possible use-case is ...


29

You do get some security from the way your fuse box is connected to the mains. In principle you should get a good signal across any part of the wiring in your house that is on the same phase, and you shouldn't get any on the other phases. In reality though, that isn't quite true - depending on your fuse box, you may get some bleed over onto the other ...


27

Assuming that You're 100% sure that your database server only accepts local connections. You're 100% sure that the attacker doesn't have access to the local environment from which connections are allowed. You're 100% sure that the application that uses the database is otherwise secure. You're 100% sure that those credentials aren't used for anything else ...


27

Steffen makes good points in his answer, but I'd like to add to it. The why, I think, can be broken in to the following topics: Lack of knowledge or education of developers Churn in an enterprise development environment Pressure to deliver ahead of schedule Not enough emphasis from the top on security So let's break those down. Developer training There'...


26

To explain "cryptography" in your scenario requires an understanding of the value of "private communications". It's not about the technology, but about the benefit to society of being able to communicate privately, even from the eyes of your neighbours (i.e. those charged with governing the society). This is more of a philosophical debate than a technical ...


25

It really depends upon the specific threats you may be facing, the direction of your data transfers, etc. USB specific dangers You mention the dangers of USB. The main one is indeed related to its firmware opening the possibility of a BadUSB type attack. When you need to transfer data in both directions, you may therefore prefer to use SD-Cards which are ...


24

First of all, you should make sure that you don't use that password, or a derivative, anywhere that you care about. This is most important if you use the same username or email address, but still something that you should do for completely unrelated accounts. If a password is crackable, it may have been incorporated into wordlists already. And even if not, ...


23

I live in a detached family home in Texas. I have a pair of Trendnet TPL-303E powerline adapters and have experienced the signal bleed from my next door neighbor. I ran the Powerline utility that came with the adapters and could identify two other powerline adapters using the same network name. I got anywhere between 10 to 20Mbps of throughput between their ...


23

There is an element of truth to this one - an attack was discovered which took advantage of data remanence in RAM, allowing an attacker to grab data from the RAM in a machine. There was a very short timeframe (a matter of seconds or minutes) in which to do this, but it wasn't a hack of the PC as such. Simple Wikipedia link to Cold Boot Attack here And the ...


20

Use SSL Make sure you implement session management correctly - for example the presence of correct session id checked on each page and destroyed with logout Add cache control: no-cache, pragma: no-cache and expire: -1 headers everywhere Make sure that forms and every sensitive variable are submitted only through POST requests and not GET (during code audits ...



Only top voted, non community-wiki answers of a minimum length are eligible