New answers tagged

3

On the web servers I run, I deny access to any type of server log files and sensitive files that contain web app configuration details such as WordPress's wp-config.php file However, if you're running a website, denying access to PHP, HTML, CSS, in addition to some other file types would render your website unusable since browsers need to access those files ...


1

As a start, try this paper, which assesses 34 password database breaches. It states the following on page 2: While absolutely no information on how the passwords were stored could be found in 26.5% of the cases, we found 11.8% reported passwords were “Hashed and Salted”, 5.9% used salted MD5, 14.7% used unsalted MD5, 11.8% used salted SHA1, while ...


1

To find and exploit a product/version specific vulnerability an attacker has to determine the product/version. This takes time and might lack accuracy. Perhaps the attackers time is very limited and he doesn't want to invest it into enumeration. He might then run a wide variety of exploits. Most of them won't work because they are able to exploit other ...


4

Imagine a car robber specialized in stealing Toyota Prius models from 2010 to 2015. It will be pretty easy for him to identify this type of car, just by looking around and analyzing the model characteristics. Now let's assume the car robber is blind and can only identify the car models by touching them. This would make it much harder for him, to spot the ...


0

Service version info is an advertisement. And sites like Shodan are the Penny Saver that collects all the ads from every domain across the Internet, where hackers can browse its pages for ads that interest them, ones they have an exploit or tool for. One stop shopping & it's all free.


2

What he might like more is that it's less transmission and thus less costs over the long run for internet overhead and data throughput(cheaper in the long run if you pay for traffic by total size like on most cloud services or Web Server setups). Metaphors: A Locked Safe Safes operate off of pistons and solenoid. Let's say you have a solenoid based safe. ...


3

Some comments on previous answers (all good - SO is like watching really good crossword puzzle players.) An interesting topic which occasionally might be life-and-death important. (My overactive imagination at work, but battered women at a shelter whose location is critical to keep secret are an example that come to mind). Points that I hadn't considered ...


3

Electric drill If you have any kind of electric drill or cordless screwdriver the easiest and quickest way is to just drill a dozen holes through them. The disk housing is generally made from aluminium, which is fairly soft. Any kind of metal drill bit (probably even the ones used for brick walls) will do the trick easily. Make sure to drill the holes in ...


10

As a raster image program that does not use layers nor contain an undo history after saving, overwriting sensitive pixels in Paint irrevocably changes them in the saved image. More reasoning: Microsoft Paint is a proven simple piece of software with a long history and great popularity that works natively in simple raster image file formats. Serious flaws ...


-1

First, encrypt the hard drive with something like truecrypt. Then wipe it with Dban several times with default settings. Then install windows on the operating system. Then fill the free space with data. Then encrypt the hard drive again. Then wipe the hard drive several times again. Next, take the platter(s) out of the hard drive, along with the small ...


11

Already a few good answers here, saying Paint is safe. (I have no reason to believe otherwise.) Just want to add that while blacking out a rectangle that fully covers the area and any surrounding areas (lists that information is part of etc) using a basic well studied image editing program should be fairly safe, just using any image editor might not be ...


18

When blacking out sensitive information in Paint the original pixels are destroyed. But using Inkscape to black out part of a vector image does not destroy the pixels, but instead covers them. If someone removes the black cover they can see the pixels. The same applies to things like Foxit Reader (I almost sent a document with sensitive information which had ...


49

Ditto Ben N, but let me add a couple of points that are too long to fit as comments. I'd emphasize the distinction between layered and un-layered data formats. Drawing a black box over a section of a GIF, JPG, or PNG image destroys the previous contents. Drawing a black box over a section of a Photoshop, Corel Draw, or Paint Shop Pro native image does not ...


180

As mentioned in the answers to a very similar question, scribbling over part of an image will destroy the original pixels, assuming that your editor doesn't store any layers or undo history. (Paint doesn't.) There are some things to watch out for, though: The width of the blanked region places an upper bound on the length of the secret data The height of ...


1

Trey already dove deeper than I would have, so I will offer a link that shares a bit more information than Troy posted. And now on to answering the most critical bit of information that an image will store. GPS coordinates. Here is data from an example photo, with a stripped summary with 'pseudo' personal information visible to exiftool File Name ...


0

It is quite easy to search the App Store for 'exif viewer' and find a half dozen free apps that will show you all the EXIF data for each shot in your iPhone's photo library. These tools will show you if there is GPS data regarding the photo (where it was taken), the serial number of the camera (or iPhone), the name of the photographer, the time the photo ...


2

Including sample data of an OSX screen capture from a OSX desktop parsed by three different tools below. It does not seem to contain the IP address but it does contain the make and model of your computer and in some cases some directory information (I also noticed that if you use an external display it will contain different information than if the ...


0

Let us not discount the impact of threat vectors that rely on USB for introduction to a network - ("StuxNet" anyone?) That said, is it "efficient" ? - IMHO , Yes, it requires little effort to stymie the masses who might sneaker secrets out the door. But, is it effective ? only for the unsophisticated masses. Clever local admins will still walk the ...


0

Many large organisations have restrictions like this. I've been able to bypass every one that I've tested. The intention is that users cannot extract data in bulk. It is understood that people can exflitrate small amounts of data by photgraphing their screen, or even just memorising it. But there's a difference between exflitrating a few details and ...


1

In many cases, such a policy is paired with the use of some form of censorware to block access to a known list of cloud storage providers and webmail sites, along with blocking the ports for ftp (and file transfer over IM). Of course it's simple enough to roll your own workaround: I had an ftp server running on port 80 at home for a few days once; my ...


4

In addition to what Iserni has said, memory sticks these days can hold huge amounts of data. Shifting 64GB of sensitive data to a cloud provider could take a long time, and may well trigger firewall rules set to look for excessive uploads. In any case, the uploads will be logged. Downloading 64GB to a USB3 memory stick will be a lot quicker, and won't go ...


51

One of the main reasons behind the prohibition of writing data to USB drives (I had this explained to me once) is not to prevent employees from stealing sensitive information. If they wanted to do that, they would have no end of workarounds, up to printing QR codes on A4 sheets. Rather, it is to prevent employees from saving sensitive information on USB ...


2

This is a great question! I'm also a developer on a c++ product that handles high sensitivity data, and we face this dilemma almost every day. When a production system starts throwing alarms (especially performance or configuration-related ones, thought misbehaving software / bug ones also apply) we often need stack-trace level debugging turned on ...


1

I've been working as a penetration tester since the late 90's and have seen a lot of applications. It is not uncommon that once in a while an application logs user-identifying data. Most developers declare people having access to the logs as trusted and therefore don't limit the logging. If this might be an issue depends on the business case and the desired ...


0

Skype itself must be installed in a dedicated VM with nothing else on it to prevent attacks and data leakage. Tor router must drop all the UDP packets, so Skype will fall back to TCP. And in this case the only problem is that Skype calls can be wiretapped by Skype itself. No other data leaks will be possible


3

I'm not sure it's documented anywhere exactly what info is collected and sent back to MS via Skype, but to quote Tor's wiki page on IM software: Skype usage is highly discouraged. It can be used for leak testing purposes as it's very good with firewall tunneling. Skype is closed source and users have no control over the encryption keys used. Skype ...



Top 50 recent answers are included