Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [data-leakage]

Data-leakage is the uncontrolled, unauthorized transmission of classified information from a data centre or computer system to the outside. Such leakage can be accomplished by physical removal of data storage devices (diskettes, tapes, listings, printouts and photographs of screen copies or handwritten notes) or by more subtle means such as data hiding (steganography) or even plain old human memory.

5
votes
2answers
709 views

How does full disk encryption cater for overprovisoned disk space in flash devices and can this result in data leakage?

My understanding is that flash based devices such as SSDs are over-provisioned and do not advertise the additional blocks of storage available to the operating system. The over-provisioned blocks of ...
1
vote
0answers
27 views

Is it safe for a service to share memory addresses with remote clients?

Supposing a remote service has the following data structures (using C++ as an example): struct Item { std::string name; struct {} whatever_else; }; std::map <std::string, Item *> ...
2
votes
2answers
44 views

Security controls around data in motion?

I am an Information Security Analyst, trying to understand the difference between data in transit and data in motion. I found the listed below definitions: Data In Transit is defined as data moving ...
1
vote
0answers
40 views

What makes detection of optimized-away memory clearing non-trivial?

In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
0
votes
1answer
52 views

How can a git repository be sanitized efficiently and effectively?

A git repository will contain information on every previous commit and all the information in that commit. That means that if you have a git repository that contained any information such as secret ...
1
vote
1answer
84 views

Should hard drives be encrypted prior to an operating system installation?

When employing full disk encryption, should hard drives be encrypted prior or post the installation of an operating system? If the former, is this supported by operating systems such as Microsoft ...
5
votes
2answers
169 views

How important is it to delete disk partitions when wiping devices?

The command lsblk returns the following output that lists 4 partitions. sda 8:0 0 931.5G 0 disk ├─sda1 8:1 0 8M 0 part ├─sda2 8:2 0 40G 0 part / ├─sda3 8:3 0 883.8G ...
1
vote
1answer
99 views

Discovered someone else's huge data breach, what should I do?

I bought an old Apple Xserve on ebay. The seller was a used computer reseller, not the original owner of the server/data. The server's hard drives were wiped and had no OS on them, but they did have ...
0
votes
1answer
65 views

Shipment tracking displaying delivery information publicly - Is this dangerous?

Background: Many shipping companies (like DHL, UPS, national postal services, etc) will allow the recipient of a package to track their package online, and will often display the address that the ...
1
vote
3answers
102 views

Per-User Image DRM for Finding a Leaker? [duplicate]

I'm managing a client that distributes their users images and files through one source. My background is heavily in development as opposed to security, and I'm of course familiar with some tricks that ...
0
votes
0answers
44 views

How to avoid data leakage from usb interfaces?

In the context of business use of laptops with sensitive data, we need to prevent data leaks. We cannot disable usb interfaces because it is needed for external keyboard, mouse, webcam and ...
2
votes
1answer
61 views

Hiding the identitiy of an author

I would like to share some sensitive information in a PDF document that I created, but I'm afraid that my identity can be traced back. I installed a trial Microsoft Word on a Windows 7 (guest OS on ...
2
votes
3answers
147 views

How important is encrypting traffic that never leaves a data center?

How important is encrypting traffic that never leaves a data center? To me, it seems both important and (thanks to IPsec) easy to achieve. However, it seems to rarely be done; Google does not do it, ...
1
vote
1answer
55 views

RAID-1 and low level formatting (or file shredding), more chances of data recovery?

If I have two disks setup as RAID-1. I deleted some files and then made a low level format. made sure the files are not recoverable. However, if I am to separate them and connect them as separate ...
0
votes
0answers
51 views

How to find accounts in leaked databases based on the domain name in the email address?

I like to find accounts in leaked databases based on the domain name associated with the leaked mail addresses. Public databases such as https://haveibeenpwned.com/ have this ability partly. Searching ...
4
votes
3answers
124 views

Doesn't persisting previous passwords pose a vulnerability?

Recently I attempted to log in to Facebook, but I'd forgotten that I'd changed my password. Facebook bounced me back to the login screen and advised me that I'd attempted to enter an old password. ...
2
votes
1answer
42 views

Vulnerabilities of IT system due to hardware?

Is there any relation between specific hardware (like specific kind of CPU etc) or laptop manufacturing brands and the hacked environments run on? Can this be measured in any way like stolen data or ...
0
votes
0answers
53 views

A way of doing secure data exchange in Android?

To my knowledge, all current Android apps with internet permission enabled are prone to apps stealing data. For example, if you have a messaging app, all your messages are readable by the company ...
1
vote
2answers
58 views

Storing customer data securely (compliance)

I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do. ...
1
vote
2answers
62 views

Is it possible to restrict clipboard access to specific processes?

I'm not sure if somebody has implemented this before, but I think it'd be helpful if we can make certain clipboard messages only available to specific processes if they are not meant to be public. Is ...
0
votes
4answers
228 views

Track who leaks your software

I'm releasing some software in python which is impossible to fully encrypt. I was thinking of changing the variable names slightly for every copy that I release. Is this a good way to figure out who ...
4
votes
1answer
142 views

Which protocol could have been likely candidates for leaking a laptop serial number

Having read this article, one line in particular caught my attention: The AFP raided the boy's family home last year and found two Apple laptops with serial numbers that matched those of the ...
1
vote
2answers
78 views

principle of splitting sensitive data across multiple machines running different operating systems

Suppose you're trying to store data as securely as possible, including splitting it across multiple machines (encrypted in a manner so that it's unreadable unless all pieces of the data are recovered)....
0
votes
1answer
46 views

idea to detect data breaches by letting users create single-click single-use email aliases

My idea is for a popular email provider (e.g. Gmail) to let users create auto-generated disposable email addresses that are aliases for their main account, in order to detect data breaches at ...
0
votes
2answers
112 views

Restricting source code exposure

Say you do not trust the data center technicians (or management) but have no other option than hosting your web application with them. Also, say you want to keep certain files inaccessible to people ...
0
votes
0answers
79 views

Qubes OS extended security

If you remove the drive Tails OS is running on, it will instantaneously shutdown and wipe the RAM. I know that scripts exist that wipe RAM in Qubes OS but it's not fully... functional as a security ...
5
votes
1answer
108 views

Does returning a 401 error from an API leak information?

I'm developing an API for an application I'm working on and I've come across an interesting question: Imagine an API endpoint like this: GET /customers/123456 which returns a single customer object....
3
votes
2answers
230 views

How does my ISP see information about my PC?

Recently I called my ISP and talked to them about a problem I experienced with a PC. They asked me "Are you talking about the PC that is connected in port 2 with X hostname?" It got me wondering how ...
0
votes
3answers
108 views

Can an ISP see hostname of VirtualBox

I know ISP see the hostnames of devices connected to them Does ISP see the hostname of VirtualBox Machines ? Also do they see MAC address of Virtual Machines ?
0
votes
1answer
76 views

Is an HMAC hash of plaintext data secure enough to use as a lookup index for encrypted data

I'm working on an app that will download files from external servers over https and store them on disk in a relatively secure way. Specifically, using a cryptographically unique IV, an AES256 cipher ...
6
votes
2answers
150 views

What is the best way to recycle an old hard drive that might still have sensitive data? [duplicate]

Six years ago, I got a Seagate Agent Flexgo hard drive, but recently it started showing signs of failure. I was unable to get it formatted. I thought of opening up the inside to find some way of ...
1
vote
1answer
175 views

Javascript: remove sensitive data from memory

As stated in this article JavaScript values are allocated when things (objects, strings, etc.) are created and "automatically" freed when they are not used anymore. I recently took a heap ...
1
vote
0answers
111 views

Historical locations of hacked data dumps

BMO and Simplii might have data dumps by now as cibc reported; "These ... profile will be leaked on fraud forum and fraud community as well as the 90,000 left if we don't get the payment before ...
0
votes
2answers
265 views

Backup is corrective control or a preventive control?

This is a theoritical question. There are preventive controls and corrective controls. So, is Backup a corrective control or a preventive control? There are mixed answers and mixed explainations. (...
-2
votes
2answers
46 views

Does data copied as text on a draft email in outlook travels over a network and can it be detected?

Is data saved as a draft email (not an attachment of a file) be detected over the network and what tools are used to prevent data leakage.
0
votes
2answers
138 views

Investigate email address leak source

I receive SPAM to my private Gmail email address which have never been publicly available and is not googlable at all. How could I receive SPAM on it? I saw this question, but in my case BCC is not ...
0
votes
1answer
80 views

Does the BitTorrent protocol expose my home IP address, even over VPN/Tor?

I am filesharing from home using a BitTorrent client in one of three scenarios: I am using my regular ISP connection I am using a tunnel (VPN) connection I am using a Tor connection (a) Obviously I ...
0
votes
1answer
65 views

The data(username,passwords) stored in app bundle is safe in a jailbroken ios device

I was testing an iphone application in a jail broken device. I happend to see an intresting thing that the username and passwords are stored in a plist file and Cache.db file in preferences directory ...
4
votes
1answer
196 views

Does a signed hash reveal any information about the original message?

As part of the end to end encryption for my app, I am following the standard procedure of using RSA to exchange the temporary AES256 key. Currently when A decides the key to send to B, he encrypts it ...
1
vote
0answers
59 views

What are the security implications of publishing my web server & PHP config files?

I have a web server with many virtual hosts, config files, etc. I'd like to track all of my web server & PHP config files using Git and have them hosted on a public GitHub repository, as this ...
0
votes
1answer
52 views

Difference between legitimate file transfer vs data exfiltration of confidential files using FTP

I have FTP logs and some other logs assuming that corporate environment is actively monitored. How would I know that user is using ftp to transfer regular file and not using the same to transfer ...
9
votes
4answers
236 views

Who will notice a data breach more likely, me or an online password manager?

Assuming somebody has managed to get your encrypted password database. If the encryption and the password are strong I assume it will be almost impossible to crack the encryption in a lifetime, but ...
2
votes
1answer
147 views

If and why should any personal information be destroyed before putting scrap paper into the recycle container?

Well this question may not be about computers, but it most definitely is about information security, so I'll give it a try... I've been repeatedly told in my life that I should always carefully check ...
2
votes
2answers
436 views

Information leak from chat group. How do we find out which user is sharing information?

My friend is part of a business of about 10 people that provide stock and share advice to paying members in a Telegram group. It's a quite expensive pay monthly group of loyal enough customers who ...
4
votes
2answers
295 views

Spectre/Meltdown - Does memory deallocation erase the actual RAM contents?

The other day I've been thinking about Spectre and Meltdown and the ability of one process to access the memory of another. On my Linux system currently I have all JavaScript disabled to eliminate ...
1
vote
1answer
47 views

Should smartphones with AI assistants be restricted for use in office?

New Galaxy S8 & S8+ provide Samsung's new AI assistant called Bixby. This thing was claimed to upload photos and voice records to somewhere. Is it a risk for company confidential information ...
7
votes
2answers
185 views

Are old API keys in git history a security vulnerability?

I recently made the mistake of leaking my Mailgun API key in an open-source GitHub project. I immediately invalidated it, but Mailgun support has asked me to take the additional step of deleting my ...
6
votes
2answers
888 views

Does Yandex browser have known records of snooping for user data & passwords?

I've installed Yandex Browser (Based on Chromium) on Windows 10. I use LastPass for logins so I asked Yandex to not remember passwords. While I was trying to login to another website, it gave me a ...
45
votes
3answers
7k views

Should we keep logs forever to investigate past data breaches?

Listening to the Secure code lessons from Have I Been Pwned made me really think about logging. It appears that in the real world a lot of data breaches are discovered long after they happened which ...
4
votes
1answer
236 views

Is using online SQL prettifiers considered safe?

From time to time when debugging SQL queries, we use online SQL prettifiers (e.g. this one) that reindent and properly format the queries to increase readability. Can this potentially be a source of ...