Questions tagged [data-leakage]

Data-leakage is the uncontrolled, unauthorized transmission of classified information from a data centre or computer system to the outside. Such leakage can be accomplished by physical removal of data storage devices (diskettes, tapes, listings, printouts and photographs of screen copies or handwritten notes) or by more subtle means such as data hiding (steganography) or even plain old human memory.

Filter by
Sorted by
Tagged with
0
votes
0answers
5 views

private *** video was recorded from phone. soon it was deleted would it be leaked? please help?

.private *** video was recorded from phone. soon it was deleted.At that time, internet was not connected. would it be leaked by any app if internet was connected after the deletion??google drive or ...
-4
votes
0answers
31 views

private *** video was recorded from phone. soon it was deleted would it be leaked? [on hold]

.private *** video was recorded from phone. soon it was deleted.At that time, internet was not connected. would it be leaked by any app if internet was connected after the deletion??google drive or ...
0
votes
1answer
79 views

Biostar 2 data breach

According to this blog post (which I assume is an accurate description of the breach): https://www.vpnmentor.com/blog/report-biostar2-leak/ a large amount of very sensitive BioStar 2 biometric data ...
0
votes
1answer
66 views

How to prevent sharing of document templates in Google drive that I didn't authorize?

Not too long ago, I decided to switch to Google Drive and Docs to write my cover letter and resumes, I already use the e-mail address to send them anyways, so using Drive and Docs seemed like a good ...
106
votes
8answers
11k views

Ex-contractor published company source code and secrets online

Just found my current company code on the plain internet. We are talking hundreds of thousands of lines of scripts and configurations, including database schemas and a fair amount of internal ...
3
votes
3answers
219 views

Determine what a company is googling

Let's say that a fictional company, AwSemCo, discovers that a published vulnerability "CVE0day" affects their systems and they immediately start investigating it. They go to the web looking for a ...
1
vote
1answer
77 views

DLP vs end-to-end messengers

I am interested in how DLP systems work. I have noticed that developers of DLP say that the software can see messenger traffic including end-to-end solutions. I understand MITM, certificate change, ...
0
votes
1answer
179 views

is there any security advantage of hiding url parameters?

I am building a web app that needs to be secure. My question is: Is there any security advantage of hiding route parameters? And if so I am using angular(don't know if this is important but there is ...
0
votes
1answer
54 views

How could you safeguard your data traces when using USB Drive?

I have a very serious question with regard to data security with regard to usage of USB Drive when transmitting, storing or even clearing data with it. When one is going to use USB Drive for ...
0
votes
0answers
40 views

Foreign key constraint danger - information leakage?

Suppose we have an SQL database. Suppose we have a user D who has no read access to some table named EMP (employees). Suppose we allow him to create a table with a foreign key regarding EMP table. Is ...
0
votes
3answers
122 views

Google Drive and GDPR [closed]

I can't seem to find much information on this online, and forgive me if this is obvious to other folks in the info-sec community but would storing documents such as CVs of applicants, letters written ...
-1
votes
1answer
170 views

Zip files and metadata

I want to send a zip of some files. The files themselves don't contain anything sensitive but I'm wondering if zip files contain metadata that could identify me or something about me? It seems that ...
1
vote
1answer
114 views

Android leaking app analysis

In my thesis I'm trying to analyze leaking private data on Android apps. I noticed that the vast majority of data is encrypted. How can I analyze this data without decrypting it?
0
votes
0answers
45 views

What ISP know about my local network when I use their ONU?

I have FTTP (Fibre to the Premises) and a GPON ONU given to me by my ISP. I know they can see hostnames and MAC of devices connected in ONU. If I connect my personal router to this ONU and then ...
1
vote
1answer
60 views

Possible to control desktop data activity LED on Windows or Linux for data extraction? [closed]

I am trying to extract data from an air-gapped computer as a project. I already have a working prototype using high frequency sound and a key-logger. I would like to find another way to do it without ...
60
votes
16answers
14k views

Alternative to sending password over mail?

Recently I've started working as a contractor for a company, which requires me to often log in to different b2b services. The way I receive the login data is usually over email in plain text. My gut ...
2
votes
1answer
96 views

Information leakage through json response

I am testing a product survey website. As a response to getSurveyResults() call, the following details of all survey participants shall be displayed to all website users. Nick name Location Rating ...
0
votes
1answer
49 views

Does it exist any gadget that catches and copies all the digital information?

When I was watching Prison Break there was a device that was catching all the digital data and copying it. Do similar info-gathering devices really exist? The device must be within several feet of ...
1
vote
1answer
61 views

Encrypting data as a middleman

I'm working on a financial app that uses Plaid to provide financial data and updates as users spend money. As of right now, I'm using Hashicopr's Vault to encrypt the transaction/bank account data, ...
3
votes
2answers
104 views

How do ERP systems track classified business activity?

One of the selling points of Enterprise Resource Planning systems like SAP or Oracle E-Business Suite is their claim to give management visibility across the business, by aggregating (or at least ...
2
votes
1answer
96 views

Receiving Junk Email that is related to Skype conversations

My Microsoft email address and account are linked to Skype, OneDrive and Windows 10 (products I use by Microsoft). This account is not linked to my phone (Android). I don't use this account for Email (...
3
votes
1answer
164 views

Could a cracked password run as a command on the attacker's system?

I recently was made aware of 6 passwords that I use becoming compromised in data leaks, and they are now exposed in plain text. I don't know how attackers go about cracking passwords or how they ...
80
votes
2answers
20k views

Does Windows 10's telemetry include sending *.doc files if Word crashed?

I'm reading through the extensive description on which data is acquired by Microsoft's telemetry 1 including the following paragraph: User generated files -- files that are indicated as a potential ...
2
votes
3answers
157 views

Are there examples of implementing security as a side effect?

I have long since felt that one of the best ways to effectively implement new security constructs is to implement it in the background, where it is not the primary feature of some new construct. This ...
0
votes
3answers
229 views

I found a website that lists all the email addresses of Facebook users in UK. What do I do? [closed]

I came across this very peculiar website that supposedly lists the email addresses of Facebook users in the UK. I will not be posting the URL for obvious reasons. I entered a couple of emails to see ...
3
votes
1answer
138 views

Why must Meltdown use probe array?

This is code snippet of Meltdown assembly language code: 1. ; rcx = kernel address, rbx = probe array 2. xor rax, rax 3. retry: 4. mov al, byte [rcx] 5. shl rax, 0xc 6. jz retry 7. mov rbx, ...
2
votes
2answers
111 views

Prey vs SSH for remote wipe of stolen laptop under Ubuntu

I have to be able to wipe a stolen laptop remotely (contractual obligation), and the only product I found that supports that on Ubuntu is Prey Project. (Also appears in some other stack exchange ...
0
votes
1answer
153 views

Why do I see bridged devices when monitoring Wi-Fi activity?

I'm trying to figure out what information about my infrastructure can leak through Wi-Fi. I ran Kismet and was surprised to see that a few minutes later, Kismet displayed not only the MAC addresses ...
1
vote
1answer
52 views

Best Practices for exporting sensitive database data and transforming it whilist keeping it encrypted?

Say one has to export database data to use in another tool, such as an Excel Spreadsheet or for use as a csv file with some other program. There's a problem with this, and that's that it ends up in ...
1
vote
2answers
166 views

How to obfuscate a relation between two tables in a database?

I have a kind of weird use case here, and I'm not sure how to deal with it. I'm working on a project that stores medical data. The following requirement has been addressed by another team, but hasn't ...
0
votes
0answers
47 views

Does WinRar leave cache of opened Zip Archives (Nothing extracted)

Downloaded a .zip, via a secure app that deleted the only place it was downloaded (supposedly, who knows if defragmentation left other traces, the download happened by accident, on main OS WIN10, no ...
1
vote
0answers
74 views

Collection #1: Do we know the source of the leaks? [closed]

With Collection #1 yet another large data set of email addresses and passwords was found out there. I happens that one of my frequently used email addresses shows up as 'pwned' when checked against ...
1
vote
2answers
123 views

Allow user to export data, what about security?

We developers of course try to create the most secure (web) application out there that will not be hacked. While we already know it's impossible to know for certain that your application is secure, we ...
1
vote
2answers
91 views

When pasting sensitive links or text on Google Chrome bar - does Google store it?

When I paste some links or sensitive information by mistake on the Google Chrome URL Bar, that might trigger a search on Google. Does Google store all of them, including that sensitive information?
5
votes
2answers
845 views

How does full disk encryption cater for overprovisoned disk space in flash devices and can this result in data leakage?

My understanding is that flash based devices such as SSDs are over-provisioned and do not advertise the additional blocks of storage available to the operating system. The over-provisioned blocks of ...
1
vote
0answers
27 views

Is it safe for a service to share memory addresses with remote clients?

Supposing a remote service has the following data structures (using C++ as an example): struct Item { std::string name; struct {} whatever_else; }; std::map <std::string, Item *> ...
2
votes
2answers
82 views

Security controls around data in motion?

I am an Information Security Analyst, trying to understand the difference between data in transit and data in motion. I found the listed below definitions: Data In Transit is defined as data moving ...
1
vote
0answers
44 views

What makes detection of optimized-away memory clearing non-trivial?

In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
1
vote
1answer
103 views

How can a git repository be sanitized efficiently and effectively?

A git repository will contain information on every previous commit and all the information in that commit. That means that if you have a git repository that contained any information such as secret ...
1
vote
1answer
109 views

Should hard drives be encrypted prior to an operating system installation?

When employing full disk encryption, should hard drives be encrypted prior or post the installation of an operating system? If the former, is this supported by operating systems such as Microsoft ...
5
votes
2answers
194 views

How important is it to delete disk partitions when wiping devices?

The command lsblk returns the following output that lists 4 partitions. sda 8:0 0 931.5G 0 disk ├─sda1 8:1 0 8M 0 part ├─sda2 8:2 0 40G 0 part / ├─sda3 8:3 0 883.8G ...
3
votes
1answer
185 views

When credit card tokens are leaked / stolen, what can the attacker do with them? [closed]

I'm implementing an online payment system relying on an external payment processor handling all credit card entry. My payment processor supports recurring payments via "credit card tokens". We only ...
1
vote
1answer
115 views

Discovered someone else's huge data breach, what should I do?

I bought an old Apple Xserve on ebay. The seller was a used computer reseller, not the original owner of the server/data. The server's hard drives were wiped and had no OS on them, but they did have ...
1
vote
2answers
122 views

Shipment tracking displaying delivery information publicly - Is this dangerous?

Background: Many shipping companies (like DHL, UPS, national postal services, etc) will allow the recipient of a package to track their package online, and will often display the address that the ...
1
vote
3answers
119 views

Per-User Image DRM for Finding a Leaker? [duplicate]

I'm managing a client that distributes their users images and files through one source. My background is heavily in development as opposed to security, and I'm of course familiar with some tricks that ...
0
votes
0answers
86 views

How to avoid data leakage from usb interfaces?

In the context of business use of laptops with sensitive data, we need to prevent data leaks. We cannot disable usb interfaces because it is needed for external keyboard, mouse, webcam and ...
2
votes
1answer
70 views

Hiding the identitiy of an author

I would like to share some sensitive information in a PDF document that I created, but I'm afraid that my identity can be traced back. I installed a trial Microsoft Word on a Windows 7 (guest OS on ...
2
votes
3answers
267 views

How important is encrypting traffic that never leaves a data center?

How important is encrypting traffic that never leaves a data center? To me, it seems both important and (thanks to IPsec) easy to achieve. However, it seems to rarely be done; Google does not do it, ...
1
vote
1answer
131 views

RAID-1 and low level formatting (or file shredding), more chances of data recovery?

If I have two disks setup as RAID-1. I deleted some files and then made a low level format. made sure the files are not recoverable. However, if I am to separate them and connect them as separate ...
0
votes
0answers
126 views

How to find accounts in leaked databases based on the domain name?

I like to find accounts in leaked databases based on the domain name associated with the leaked mail addresses. Public databases such as https://haveibeenpwned.com/ have this ability partly. Searching ...