Questions tagged [databases]
Security related aspects of databases and database access.
627
questions
1
vote
1answer
133 views
Security flaws of storing strings and some of its substrings using Microsoft SQL Server Transparent Data Encryption?
I am creating a database table with an encrypted value, say users:
Say John encrypted is U2FsdGVkX193AOGlBRE1RNScJRGN9vSB4erIljJwaKw=.
UserId | Name
------ | -----------------------------------------...
1
vote
2answers
65 views
Risk of getting MySQL database compromised with a client application
I want to make a client-side, Windows-based application that allows the user to register and it will store the registration details in an online MySQL server.
However when i googled ways to do this, ...
2
votes
1answer
87 views
Protecting private encrypted data on public computers
Consider an (Java) application that will be deployed on an off-the-shelf laptop in a public location. The laptop is not connected to any network or the internet. A USB barcode scanner is available as ...
3
votes
1answer
58 views
What are the security implications of allowing API consumer to decide primary key stored in database?
Story
We are developing an API that which allow consumer to create or modify (i.e. upsert) objects stored in database via an endpoint with HTTP PUT.
The primary key of the object stored in this way ...
0
votes
2answers
207 views
How do you perform SQL injection on a login form that checks for email address format?
A recent employment test prompted me to perform an SQL injection to gain access into their website.
Using manual and automated (Burp) methods, I was able to find out the form is definitely vulnerable ...
1
vote
1answer
80 views
Is the most recent version of ojdbc7 still vulnerable to CVE-2016-3506?
Looking at the Oracle security advisory page here: https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Oracle in 2016 disclosed vulnerabilites in their OJDBC7 versions 12.1.0....
0
votes
0answers
52 views
How to Stop Cookies from Being Set
We're not using Adminer for database management yet for some reason adminer_sid & adminer_key cookies are being set in the browser - any idea how to stop them from being set? Where would they be ...
2
votes
0answers
99 views
how to get shell from blind sql injection? [closed]
I'm trying to gain access to a web server after I found blind SQLi on the website. I used sqlmap to automate things.
I can read the databases and tables. tried to find a way to get a shell from SQL ...
0
votes
0answers
30 views
Security implications of client side authentication with a remote database
I'm developing a desktop app for use internal to my company. The app's installation file is located on our company server and therefore is only accessible to authenticated employees (under the ...
0
votes
0answers
29 views
Secure access to MS SQL from web applications
MS SQL provides two primary authentication methods, Windows Authentication or SQL Server Authentication.
Since local MS SQL accounts are problematic to maintain and monitor this option is not ...
1
vote
0answers
37 views
Does TDE not protect against disk theft?
I read the following on Microsoft's site. Can someone please clarify -
"With TDE, is the data stored in my data, log, and backup files protected from a disk theft?"
Yes, but only if the files ...
0
votes
1answer
237 views
Hack a website using database username and password [closed]
Is it possible that someone could hack a website if they have the database name, database username, and database password? If so, how do they do it?
The database connection is mysql.
0
votes
1answer
124 views
General security of offline databases (like SQLite)
I'm writing a small task management program in Java (not for mobile devices btw), and part of it was kind of a 'data service' to encapsulate and reuse database related code - such as connecting to ...
9
votes
1answer
1k views
Employer stores plain text personal data in a 'data warehouse' [closed]
I'm unsure if I have posted this in the correct community but the organisation I am currently working for currently uses an SQL 'data warehouse' which contains a bunch of tables from various sources, ...
0
votes
3answers
107 views
Is it safe to protect the write permission only with a publicly accessible hashed password?
A user stores a raw information (a comment on a website, a like on a post etc.) in a database. He pairs it with a hashed password and keep the original password safely for him/herself. This password ...
2
votes
2answers
57 views
Separate Auth DB for Increased Security
I'm a dev working on an app that has a monolith DB (PostgreSQL). We are using a third party provider for AUTH and MFA, but want to move MFA back into our control. The plan was to move the encrypted ...
1
vote
1answer
75 views
What's the advantage in encrypting data for data masking?
I'm in the process of selecting a product for data masking sensitive information in our DB so that developers won't see restricted information while testing production data.
I came across some ...
16
votes
2answers
3k views
Data Encryption by Application vs Data Encryption in Database
For a GDPR (EU General Data Protection Regulation) implementation, I need to encrypt some personal information. There are two ways we can encrypt the data:
Let the web application have the sole ...
2
votes
1answer
47 views
How can I log access and usage of a MySQL database?
I am currently looking for an existing implementation method to generate logging of accesses and of usage of a series of MySQL databases by developers (not services) for further auditing. My current ...
0
votes
1answer
195 views
Malicious IP addresses [closed]
I am looking for updated lists of IP addresses that belong to malware's C&C, botnets, malicious scanners, or other sort of malicious activities.
Is there any public database of malicious IP ...
1
vote
0answers
78 views
Is AWS Cognito vulnerable to MITM when using iOS with Lambda and RDS
I'm a bit new to coding backend services. And I'm not sure how to solve this problem.
So users in an iOS app can be authenticated with Cognito and afterwards gain the rights to invoke lambda ...
1
vote
1answer
86 views
What kinds of attacks are possible with credentials to a read-only Postgres user?
Assuming I implement the literal SQL-injection on an HTTP endpoint with a read-only user that limits execution time to e.g. some amount of seconds. What's the worst that could happen? I know simple ...
2
votes
1answer
86 views
How is end-to-end encrypted data stored in a database?
A traditional database holds the data in each column and then has a relational ID to tie that row to a parent (e.g. a user's ID) so it can be found in a query.
Taking the same scenario but this time ...
3
votes
1answer
84 views
Security concerns in disseminating database design?
I work for a government agency, and we've been requested via a freedom of information request for the layout of the tables of one of our systems, a data dictionary and schema design request.
What are ...
1
vote
0answers
32 views
How to anonymise a numeric data attribute, whilst preserving indexability?
I would like to (1-way) anonymise some bounded, numeric data attributes (e.g. age, optimistically bounded by 0 and 200), whilst still retaining the ability to use the resulting data in an index for ...
1
vote
2answers
119 views
Is VirusTotal useful for finding malware in a WordPress database SQL export?
Does VirusTotal detect malware in an SQL export? I have an infected WordPress site. I removed the malware with various tools, however I know from experience, that sometimes it hides itself somewhere ...
0
votes
0answers
33 views
Development and Production on the same RDS instance, but under different databases?
I was told to create a single RDS instance (amazon web services RDS) onto which I should create two users, development and production, and two databases, development and production. The idea is that ...
0
votes
0answers
41 views
Foreign key constraint danger - information leakage?
Suppose we have an SQL database.
Suppose we have a user D who has no read access to some table named EMP (employees).
Suppose we allow him to create a table with a foreign key regarding EMP table. Is ...
1
vote
3answers
210 views
Which function to hash 128 bit API key with?
I'm generating 128 bit API keys. AFAIK 128 is totally secure for generated key. In the DB I want to store hashes, not the plain text (to be protected against DB leak), but what hashing algorithm ...
1
vote
1answer
220 views
Do I need to use salt with api key hashing?
I will generate api keys. I plan to store their hashes instead of plain text. do i also need salt, similar to storing password?
AFAIK salt prevents rainbow table attack and those are more ...
12
votes
3answers
3k views
Would encrypting a database protect against a compromised admin account?
I was discussing with someone ways to prevent data disclosure from a compromised admin account on a database server. The other person proposed encrypting the data at rest within the database. It ...
0
votes
2answers
80 views
Does choice of DBMS matter for protection against XSS and other injection attacks?
I am choosing between the three most used databases, MySQL, Microsoft SQL Server and MongoDB. I have to choose the most secure database from these three.
Does my choice of DBMS has a role in ...
1
vote
0answers
584 views
How to crack encrypted Android SQLite DB? [closed]
I am testing an android app which has DB encrypted (AES-256), I extracted it from system files /data/data//databases, I have following doubts,
How do we ensure that DB is encrypted properly and it is ...
134
votes
3answers
14k views
Is HostGator storing my password in plaintext?
I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.
I asked a customer care representative to help me add an SSL certificate to a site I host with them. ...
2
votes
1answer
116 views
How safe is it to open source access to MySQL database on github, only permitting SELECT query?
The Setup: Im building an app to model visually world data. A significant part of this project will be the database since that data is what is interesting. I should only need to allow SELECT queries,...
2
votes
3answers
160 views
Are there examples of implementing security as a side effect?
I have long since felt that one of the best ways to effectively implement new security constructs is to implement it in the background, where it is not the primary feature of some new construct. This ...
0
votes
1answer
52 views
Which is more secure: saving reference link to file in file system in the database, or save the entire file into the database?
We have forms where we get clients to upload images of very sensitive information (passport, signature, etc.). We will store their written information into a database. However, there is the issue of ...
1
vote
2answers
93 views
Is it legal to store users searches [closed]
Im developing a webshop and i got a task asking for storing users searches. Is it legal?
It will be stored in a db with the fields Date, Search text, userId
1
vote
1answer
54 views
Best Practices for exporting sensitive database data and transforming it whilist keeping it encrypted?
Say one has to export database data to use in another tool, such as an Excel Spreadsheet or for use as a csv file with some other program.
There's a problem with this, and that's that it ends up in ...
1
vote
2answers
175 views
How to obfuscate a relation between two tables in a database?
I have a kind of weird use case here, and I'm not sure how to deal with it.
I'm working on a project that stores medical data. The following requirement has been addressed by another team, but hasn't ...
-1
votes
1answer
51 views
Storing files in database through encryption and Viewing them only on providing key for the file
I have this use case:
User1 uploads his file into the database which should be encrypted.
Any other users who request that file, user1 will be notified for approval, on approving other users should ...
0
votes
1answer
42 views
What would be the best way to evaulate the database management systems? [closed]
I am an Information security analyst, looking for creative, non traditional, and unapproved ways to query/evaluate DBMS applications that includes SQL Server and PostgreSQL. Goal here is to protect ...
0
votes
0answers
518 views
Two-factor authentication on Galaxy Watch - should secrets be encrypted, and is this SQLite example secure?
I recently got a Galaxy Watch and to get acquainted with developing apps for it I'm writing a simple two factor authenticator to generate TOTP codes from entered secrets using the Google Authenticator ...
2
votes
2answers
749 views
Is it worth storing email addresses as hashes?
If your running a web services with lots of users and you get hacked, you may be giving away users's plain text information like email and hashes like password hashes.
Is it worth storing email ...
0
votes
0answers
74 views
Introduce a SQLi in a testing application
So I was building an application to demonstrate SQL injection via cookies and wrote some code to run SQL statements if the statement are passed within a redir cookie header but when using sqlmap to ...
4
votes
1answer
453 views
Is forbiding the ; char enough to prevent SQL injection?
Disclaimer: Parameterized queries are the way to go, no need to discuss about that :)
I've seen the following code at a friends place:
var query = "SELECT * FROM students WHERE name = " + name;
...
0
votes
1answer
75 views
How can I detect an infection in a database?
Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with diff) and that's it. However, ...
0
votes
1answer
52 views
Prevent Database from accessing with knowing system admin user [closed]
My question might be broad. Suppose that we trying to store our client's information data with a database on a server. The server may get a vulnerability and give access to a hacker to get access to ...
3
votes
2answers
113 views
Store database access password in PHP class const?
I have PHP project and I need to store MySQL access information.
I have a config.php file outside public directory and in the file I have:
class Config
{
const host = "dbserver";
const name =...
1
vote
0answers
44 views
Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?
LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider.
Any input would be swell!
-
A case ...
