Data-leakage is the uncontrolled, unauthorized transmission of classified information from a data centre or computer system to the outside. Such leakage can be accomplished by physical removal of data storage devices (diskettes, tapes, listings, printouts and photographs of screen copies or ...

learn more… | top users | synonyms

133
votes
14answers
23k views

SQL injection is 17 years old. Why is it still around?

I'm no techie and would like your expertise in understanding this. I recently read a detailed article on SQLi for a research paper. It strikes me as odd. Why do so many data breaches still happen ...
1
vote
1answer
36 views

Implications of replacing Java Applets with Client Side Websocket Server

I am no security expert, but do know some concepts. We have a enterprise web application which currently uses Java Applets to do some operations on files in Client's File system (Browse, create, ...
1
vote
0answers
21 views

File sharing solution with approval workflow [closed]

Is there any solution out anyone is aware of that does secure file sharing but with the facility of an approval workflow. A case being a person can upload a file to the secure file sharing solution ...
2
votes
3answers
99 views

Should public access to specific filenames and -types be denied preventively?

Is it a good idea to preventively disable (public) access to certain filetypes (by extension) and/or by filenames: in the server configuration (in case of a shared hosting server) or, as a rewrite ...
4
votes
4answers
114 views

What is the best way to explain (a non-technical person) the risk of leaking version information?

I'm wondering what the easiest way is to explain a non-technical person (read: management) why the leakage of a simple version number is considered unnecesarry/a potential risk and should be avoided. ...
3
votes
1answer
62 views

What percent of publicly posted databases implemented password security?

I am trying to get some statistics on databases that were a part of data breaches, namely, I would like to be able to find out what percentages of publicly posted databases (from a data breach) had ...
138
votes
6answers
26k views

How secure is 'blacking out' sensitive information using Paint?

I'm wondering if it's safe to black out sensitive information from a picture just by using Microsoft Paint? Let's take in this scenario that EXIF data are stripped and there is no thumbnail picture, ...
5
votes
3answers
54 views

What information can be gained from an Apple device's screenshot or its EXIF data?

I often take screen grabs from my Apple devices for professional purposes (iPhone, iMac, Powerbook...), sometimes sharing them on forums, imgur or S.E. sites for technical support. What informations ...
31
votes
5answers
4k views

Is disallowing write to USB actually an efficient way to prevent data leakage?

In my organization, a group policy exists that prevents users from writing data to a USB stick. This always seemed like a bit of a pointless PITA to me, just "one of those things...". I forget about ...
0
votes
0answers
62 views

How could I encrypt an SD card to store data on it?

I have some data I'd like to carry with me in an encrypted form onto an SD card, so I (and only I) can access it easily from any OS (or at least Windows, OSX and Ubuntu). My idea was like: Two ...
3
votes
2answers
68 views

Do I have a IP leak if I use Tor and Skype/UDP?

I configure my OS so that it sends all traffic over the Tor (assume that, I configure Tor like proxy). I use Tor (which does not support UDP) and Skype (which uses UDP). My questions are: Does ...
4
votes
1answer
21 views

Is flushing of all caches on any context switch between mutually-distrusting processes the only way to prevent cache timing attacks?

This article demonstrates a devastating Javascript-based cache timing attack that allows for cross-VM tracking of mouse movements and other activities by web pages. Is the only way to prevent cache-...
3
votes
0answers
35 views

How to mitigate risk of X11 buffer ghosting on window resize and X server shutdown

The Buffer "Ghosting" Phenomenon It is possible to observe contents of (old and currently used) graphics buffers on a monitor under certain circumstances, posing an information disclosure risk, when ...
2
votes
0answers
114 views

Security Questions I should be asking my developers [closed]

I am looking for a comprehensive list of security related questions I should be asking my developers. I have done some research on the net and have yet to find a great list of questions I should be ...
-1
votes
2answers
81 views

If a hacker were to obtain a shipping tracking number what could be compromised?

Lets assume you just bought something and it is getting shipped via a major package shipping agency (such as FedEx or UPS etc.). You are given a tracking number which you can use to view where the ...
2
votes
2answers
103 views

Explaining information leak to Lead dev

Our lead dev tells me that this information leak from our website is "no vulnerability. Just an ugly error UI." It looks to me that the leaked information could be used to aid an attack. Does it ...
180
votes
21answers
23k views

How can I explain to non-techie friends that “cryptography is good”?

After that case in which Brazilian government arrested a Facebook VP due to end-to-end encryption and no server storage of messages on WhatsApp to prove connection with a drug case, it's become pretty ...
5
votes
2answers
114 views

What are the risks of sending sensitive documents that are on physical media and password protected via postal carrier using registered mail?

Background The company I work for is extremely risk averse when it comes to adopting the use of cloud services for improving business flows. We currently use a very famous search company's business ...
9
votes
1answer
581 views

I found emails and passwords on github, what should I do?

Content in question: I found a file in a public repository on Github that contains a few 100 emails, some of them with a password (as bcrypt). Verification: As I recognize several of the addresses, ...
0
votes
1answer
39 views

Unsecure FTP with Encrypted file and Wireshark leakage

Hi i was wandering if it is possible to have a password leaked to an encrypted file on an anon ftp server with r-x-w permissions. So for example i have a file encrypted using gpg and when opened on ...
1
vote
1answer
25 views

Why mobile applications share device characteristics with third parties?

It is known that mobile applications can share with third parties many different types of data from information about the device to search terms used in the application. I understand that search ...
0
votes
1answer
42 views

Does KDE System Tray Extra Items “Clipboard” have the same security threats as the system clipboard?

Does the clipboard under kUbuntu's KDE System Tray > Extra Items "Clipboard" have the same security threats as the system clipboard? The following articles point out the insecure nature of the ...
1
vote
0answers
39 views

What should I do when I find out some company user database I am listed in was leaked?

Today the antispam tool in the company I work for blocked several emails. It has been months since last time, so I took the time to analyze the quarantined messages. Since I almost never give my ...
2
votes
3answers
73 views

Is it safe to include memory addresses in a program’s output?

I’m writing a program. The input is a complex data structure in memory. The output is an HTML report that contains: (1) a representation of the structure; (2) textual annotations that refer to objects ...
0
votes
0answers
87 views

Should I blur the cached snapshot of my app?

I recently ran a security scan on one of my iOS apps that suggested I modify my apps display as it enters the background so that the screenshot stored in the cache does not expose any sensitive data. ...
5
votes
2answers
70 views

Is an application backend expected to potentially log sensitive customer data when in debug mode?

As I am working on a website that asks customers to enter data such as their name, address, phone number, obviously customer data that needs to be protected. I do my best to not log such data (...
0
votes
1answer
93 views

Does non-persistent data ever need to be encrypted?

Does non-persistent data ever need to be encrypted? If I had a project with confidential data stored in non-persistent class variables should I be doing anything to protect this data? I am developing ...
15
votes
3answers
1k views

Is it safe to post dxdiag on the internet?

Is there any information that might be useful to damage me on the dxdiag.txt file generated by windows 7? A technical support forum from a big company (I guess they know what they're doing) asks me ...
4
votes
0answers
38 views

Major UK company seems to be handling customer & card data recklessly [duplicate]

A company I used to work for is passing customer's personal details as well as card data (number, expiration date, name, CVV2 and the contents of the magstripe thanks to a reader) through Windows XP ...
-2
votes
1answer
121 views

How can startup companies protect their code from any intentional leakage? [duplicate]

So, how can new companies that have just started protect their source code from leaking by their employees? If it is a new company that means that the source code of the product is not so big and ...
4
votes
1answer
161 views

Someone called my cell phone offering services about something I have been looking for in the web

I recently started gathering information about poker and poker online. I had no idea about it and I have spent about a week surfing the web (mainly using Google) and consulting different web pages ...
0
votes
1answer
90 views

How can I ensure that only the message I sent, and nothing else reaches the receiver?

How do I make sure that the open channel I use to send a message to a specific receiver, is not used by a third party to send unwanted files and compromise the receivers system? Is there a method by ...
2
votes
2answers
154 views

Block mobile tethering on android phones from Windows (DLP)

In our small organisation I have tried my best at implementing DLP by: Making sure users access all files from the server Local disks are denied access (forced to work only on network drives) ...
-1
votes
1answer
34 views

rpm package info leak?

On Linux, rpm -qi <package-name> command would display the package info, which would contain information of build machine - Build Host :<host-name> Does this pose any security risk? Is ...
8
votes
3answers
146 views

How can you prevent email addresses from being harvested from a registration form?

When you go to a website's login form and enter the wrong credentials, the website can give you one of three error messages: Your email is wrong Your password is wrong Your email or password is ...
2
votes
0answers
63 views

How often are codebases compromised? [closed]

I'm currently trying to research which get compromised more often; databases or codebases? My guess would be that databases are the obvious answer and most of the time easier to compromise, because of ...
1
vote
0answers
28 views

Are exposed database names on shared server a security hole?

I was working for a client this week, and they use PostgreSQL database for web applications. They have their database on a shared server. When I connected to the database host with pgAdmin, I was ...
3
votes
2answers
691 views

Tor exit node can know my IP address?

I have read some articles about how Tor works. I know about layer by layer decryption, but there is something that I cannot understand: If the exit node is the one that does the last decryption and ...
3
votes
4answers
97 views

Is reading from prod to dev a security concern? [closed]

We have two environments, both of which have access to the same data sources. However, prod is locked down (reasonably so) while dev can be written/read by developers. Data flows from the source ...
1
vote
2answers
89 views

Understanding the behaviour of existing eavesdropping techniques

I am studying the behaviour of existing eavesdropping techniques (part of my research). I have a question through the following scenario: Suppose Bob lives in New York and wants to listen (i.e. ...
0
votes
1answer
215 views

Is there a risk that file shredders and free space wipers steal our confidential data?

I was wondering how secure are the file shredding software and free space wipers? Lets say we are using PC Windows, and software CCleaner (from piriform) or File Shredder (found here) to securely ...
1
vote
1answer
126 views

Copy-and-pasting plaintext data from encrypted container

Suppose we have sensitive information stored in plaintext within a dm-crypt/VeraCrypt encrypted file and this information is copy-and-pasted by a user into a web browser after decrypting (this could ...
3
votes
0answers
365 views

SQL security - ACID transactions and locking to prevent financial fraud (timing attack?) [closed]

I am trying to prevent something similar to this from happening: http://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/ Basically the financial exchange was using non-ACID ...
29
votes
12answers
4k views

Is there a secure way to transfer data outside the Internet?

Since, recently, it has been proven that transferring data through the usb port is fundamentally flawed, I'm wondering if there are 100% secure ways to transfer data without using the Internet. ...
9
votes
2answers
233 views

Why are Android permissions granted in groups?

The Android documentation on Permission Groups states that If an app requests a dangerous permission listed in its manifest, and the app already has another dangerous permission in the same ...
6
votes
1answer
178 views

How far a VPN service is legal? Does it makes my data vunerable for hackers?

Today, in Brazil, the government suspended by judicial requirement the WhatsApp application for 48 hours. It is a messaging app that works only via Internet connection (3G, 4G, WiFi...) and not by ...
4
votes
1answer
69 views

How do IP addresses leak information about whether they are a home client or not?

Websites such as hackforums.net, amongst others, are able to detect if you're using a proxy or VPN just by looking at your IP address and block you if you are doing so. I have never experienced any ...
0
votes
1answer
65 views

Does creation of dump data would be considered as vulnerablity?

Problem behind the question : We were a small firm developing a small web application which was similar to fb,gmail,etc [in terms of functionality]. We have a signup form and I was assigned to test ...
0
votes
3answers
265 views

Most secure way to isolate computer on network

I handle personal client information. Stuff that shouldn't get lost. Because of this, I have had to be careful not to download or install anything that is in any way uncertain. One data stealing virus ...
3
votes
1answer
133 views

How long is the information on Facebook stored? [closed]

I was wondering how long Facebook stores our photos and posts? I hear two theories, one saying it is around half a year, after which all the data centers are going to erase our data. The other one ...