Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [data-leakage]

Data-leakage is the uncontrolled, unauthorized transmission of classified information from a data centre or computer system to the outside. Such leakage can be accomplished by physical removal of data storage devices (diskettes, tapes, listings, printouts and photographs of screen copies or handwritten notes) or by more subtle means such as data hiding (steganography) or even plain old human memory.

1
vote
1answer
54 views

Information leakage through json response

I am testing a product survey website. As a response to getSurveyResults() call, the following details of all survey participants shall be displayed to all website users. Nick name Location Rating ...
0
votes
1answer
35 views

Does it exist any gadget that catches and copies all the digital information?

When I was watching Prison Break there was a device that was catching all the digital data and copying it. Do similar info-gathering devices really exist? The device must be within several feet of ...
0
votes
1answer
36 views

Encrypting data as a middleman

I'm working on a financial app that uses Plaid to provide financial data and updates as users spend money. As of right now, I'm using Hashicopr's Vault to encrypt the transaction/bank account data, ...
3
votes
2answers
69 views

How do ERP systems track classified business activity?

One of the selling points of Enterprise Resource Planning systems like SAP or Oracle E-Business Suite is their claim to give management visibility across the business, by aggregating (or at least ...
2
votes
1answer
53 views

Receiving Junk Email that is related to Skype conversations

My Microsoft email address and account are linked to Skype, OneDrive and Windows 10 (products I use by Microsoft). This account is not linked to my phone (Android). I don't use this account for Email (...
3
votes
1answer
147 views

Could a cracked password run as a command on the attacker's system?

I recently was made aware of 6 passwords that I use becoming compromised in data leaks, and they are now exposed in plain text. I don't know how attackers go about cracking passwords or how they ...
80
votes
2answers
19k views

Does Windows 10's telemetry include sending *.doc files if Word crashed?

I'm reading through the extensive description on which data is acquired by Microsoft's telemetry 1 including the following paragraph: User generated files -- files that are indicated as a potential ...
2
votes
3answers
129 views

Are there examples of implementing security as a side effect?

I have long since felt that one of the best ways to effectively implement new security constructs is to implement it in the background, where it is not the primary feature of some new construct. This ...
1
vote
3answers
198 views

I found a website that lists all the email addresses of Facebook users in UK. What do I do? [closed]

I came across this very peculiar website that supposedly lists the email addresses of Facebook users in the UK. I will not be posting the URL for obvious reasons. I entered a couple of emails to see ...
3
votes
1answer
97 views

Why must Meltdown use probe array?

This is code snippet of Meltdown assembly language code: 1. ; rcx = kernel address, rbx = probe array 2. xor rax, rax 3. retry: 4. mov al, byte [rcx] 5. shl rax, 0xc 6. jz retry 7. mov rbx, ...
2
votes
2answers
86 views

Prey vs SSH for remote wipe of stolen laptop under Ubuntu

I have to be able to wipe a stolen laptop remotely (contractual obligation), and the only product I found that supports that on Ubuntu is Prey Project. (Also appears in some other stack exchange ...
0
votes
1answer
80 views

Why do I see bridged devices when monitoring Wi-Fi activity?

I'm trying to figure out what information about my infrastructure can leak through Wi-Fi. I ran Kismet and was surprised to see that a few minutes later, Kismet displayed not only the MAC addresses ...
1
vote
1answer
48 views

Best Practices for exporting sensitive database data and transforming it whilist keeping it encrypted?

Say one has to export database data to use in another tool, such as an Excel Spreadsheet or for use as a csv file with some other program. There's a problem with this, and that's that it ends up in ...
1
vote
2answers
153 views

How to obfuscate a relation between two tables in a database?

I have a kind of weird use case here, and I'm not sure how to deal with it. I'm working on a project that stores medical data. The following requirement has been addressed by another team, but hasn't ...
0
votes
0answers
43 views

Does WinRar leave cache of opened Zip Archives (Nothing extracted)

Downloaded a .zip, via a secure app that deleted the only place it was downloaded (supposedly, who knows if defragmentation left other traces, the download happened by accident, on main OS WIN10, no ...
1
vote
0answers
72 views

Collection #1: Do we know the source of the leaks? [closed]

With Collection #1 yet another large data set of email addresses and passwords was found out there. I happens that one of my frequently used email addresses shows up as 'pwned' when checked against ...
1
vote
2answers
118 views

Allow user to export data, what about security?

We developers of course try to create the most secure (web) application out there that will not be hacked. While we already know it's impossible to know for certain that your application is secure, we ...
1
vote
2answers
88 views

When pasting sensitive links or text on Google Chrome bar - does Google store it?

When I paste some links or sensitive information by mistake on the Google Chrome URL Bar, that might trigger a search on Google. Does Google store all of them, including that sensitive information?
5
votes
2answers
774 views

How does full disk encryption cater for overprovisoned disk space in flash devices and can this result in data leakage?

My understanding is that flash based devices such as SSDs are over-provisioned and do not advertise the additional blocks of storage available to the operating system. The over-provisioned blocks of ...
1
vote
0answers
27 views

Is it safe for a service to share memory addresses with remote clients?

Supposing a remote service has the following data structures (using C++ as an example): struct Item { std::string name; struct {} whatever_else; }; std::map <std::string, Item *> ...
2
votes
2answers
64 views

Security controls around data in motion?

I am an Information Security Analyst, trying to understand the difference between data in transit and data in motion. I found the listed below definitions: Data In Transit is defined as data moving ...
1
vote
0answers
42 views

What makes detection of optimized-away memory clearing non-trivial?

In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
0
votes
1answer
63 views

How can a git repository be sanitized efficiently and effectively?

A git repository will contain information on every previous commit and all the information in that commit. That means that if you have a git repository that contained any information such as secret ...
1
vote
1answer
96 views

Should hard drives be encrypted prior to an operating system installation?

When employing full disk encryption, should hard drives be encrypted prior or post the installation of an operating system? If the former, is this supported by operating systems such as Microsoft ...
5
votes
2answers
189 views

How important is it to delete disk partitions when wiping devices?

The command lsblk returns the following output that lists 4 partitions. sda 8:0 0 931.5G 0 disk ├─sda1 8:1 0 8M 0 part ├─sda2 8:2 0 40G 0 part / ├─sda3 8:3 0 883.8G ...
1
vote
1answer
105 views

Discovered someone else's huge data breach, what should I do?

I bought an old Apple Xserve on ebay. The seller was a used computer reseller, not the original owner of the server/data. The server's hard drives were wiped and had no OS on them, but they did have ...
0
votes
1answer
68 views

Shipment tracking displaying delivery information publicly - Is this dangerous?

Background: Many shipping companies (like DHL, UPS, national postal services, etc) will allow the recipient of a package to track their package online, and will often display the address that the ...
1
vote
3answers
109 views

Per-User Image DRM for Finding a Leaker? [duplicate]

I'm managing a client that distributes their users images and files through one source. My background is heavily in development as opposed to security, and I'm of course familiar with some tricks that ...
0
votes
0answers
52 views

How to avoid data leakage from usb interfaces?

In the context of business use of laptops with sensitive data, we need to prevent data leaks. We cannot disable usb interfaces because it is needed for external keyboard, mouse, webcam and ...
2
votes
1answer
64 views

Hiding the identitiy of an author

I would like to share some sensitive information in a PDF document that I created, but I'm afraid that my identity can be traced back. I installed a trial Microsoft Word on a Windows 7 (guest OS on ...
2
votes
3answers
181 views

How important is encrypting traffic that never leaves a data center?

How important is encrypting traffic that never leaves a data center? To me, it seems both important and (thanks to IPsec) easy to achieve. However, it seems to rarely be done; Google does not do it, ...
1
vote
1answer
72 views

RAID-1 and low level formatting (or file shredding), more chances of data recovery?

If I have two disks setup as RAID-1. I deleted some files and then made a low level format. made sure the files are not recoverable. However, if I am to separate them and connect them as separate ...
0
votes
0answers
87 views

How to find accounts in leaked databases based on the domain name in the email address?

I like to find accounts in leaked databases based on the domain name associated with the leaked mail addresses. Public databases such as https://haveibeenpwned.com/ have this ability partly. Searching ...
4
votes
3answers
129 views

Doesn't persisting previous passwords pose a vulnerability?

Recently I attempted to log in to Facebook, but I'd forgotten that I'd changed my password. Facebook bounced me back to the login screen and advised me that I'd attempted to enter an old password. ...
2
votes
1answer
45 views

Vulnerabilities of IT system due to hardware?

Is there any relation between specific hardware (like specific kind of CPU etc) or laptop manufacturing brands and the hacked environments run on? Can this be measured in any way like stolen data or ...
1
vote
2answers
62 views

Storing customer data securely (compliance)

I came a cross this data breach where developers of an organization stored some customer PII data on their github account. Common sense tells me that this is obviously stupid and careless thing to do. ...
1
vote
2answers
63 views

Is it possible to restrict clipboard access to specific processes?

I'm not sure if somebody has implemented this before, but I think it'd be helpful if we can make certain clipboard messages only available to specific processes if they are not meant to be public. Is ...
0
votes
4answers
238 views

Track who leaks your software

I'm releasing some software in python which is impossible to fully encrypt. I was thinking of changing the variable names slightly for every copy that I release. Is this a good way to figure out who ...
4
votes
1answer
147 views

Which protocol could have been likely candidates for leaking a laptop serial number

Having read this article, one line in particular caught my attention: The AFP raided the boy's family home last year and found two Apple laptops with serial numbers that matched those of the ...
1
vote
2answers
83 views

principle of splitting sensitive data across multiple machines running different operating systems

Suppose you're trying to store data as securely as possible, including splitting it across multiple machines (encrypted in a manner so that it's unreadable unless all pieces of the data are recovered)....
0
votes
1answer
79 views

idea to detect data breaches by letting users create single-click single-use email aliases

My idea is for a popular email provider (e.g. Gmail) to let users create auto-generated disposable email addresses that are aliases for their main account, in order to detect data breaches at ...
0
votes
2answers
117 views

Restricting source code exposure

Say you do not trust the data center technicians (or management) but have no other option than hosting your web application with them. Also, say you want to keep certain files inaccessible to people ...
5
votes
1answer
114 views

Does returning a 401 error from an API leak information?

I'm developing an API for an application I'm working on and I've come across an interesting question: Imagine an API endpoint like this: GET /customers/123456 which returns a single customer object....
3
votes
2answers
242 views

How does my ISP see information about my PC?

Recently I called my ISP and talked to them about a problem I experienced with a PC. They asked me "Are you talking about the PC that is connected in port 2 with X hostname?" It got me wondering how ...
0
votes
3answers
118 views

Can an ISP see hostname of VirtualBox

I know ISP see the hostnames of devices connected to them Does ISP see the hostname of VirtualBox Machines ? Also do they see MAC address of Virtual Machines ?
1
vote
1answer
88 views

Is an HMAC hash of plaintext data secure enough to use as a lookup index for encrypted data

I'm working on an app that will download files from external servers over https and store them on disk in a relatively secure way. Specifically, using a cryptographically unique IV, an AES256 cipher ...
6
votes
2answers
152 views

What is the best way to recycle an old hard drive that might still have sensitive data? [duplicate]

Six years ago, I got a Seagate Agent Flexgo hard drive, but recently it started showing signs of failure. I was unable to get it formatted. I thought of opening up the inside to find some way of ...
1
vote
1answer
242 views

Javascript: remove sensitive data from memory

As stated in this article JavaScript values are allocated when things (objects, strings, etc.) are created and "automatically" freed when they are not used anymore. I recently took a heap ...
1
vote
0answers
124 views

Historical locations of hacked data dumps

BMO and Simplii might have data dumps by now as cibc reported; "These ... profile will be leaked on fraud forum and fraud community as well as the 90,000 left if we don't get the payment before ...
0
votes
2answers
352 views

Backup is corrective control or a preventive control?

This is a theoritical question. There are preventive controls and corrective controls. So, is Backup a corrective control or a preventive control? There are mixed answers and mixed explainations. (...