Questions tagged [databases]

Security related aspects of databases and database access.

Filter by
Sorted by
Tagged with
0 votes
0 answers
9 views

How to Scan Firebase Database?

I have the APK of an application and analyzed it using MobSF static analysis. It says the application talks with Firebase Database and provides a URL. Obviously, the URL is not accessible. I am new to ...
user avatar
0 votes
0 answers
27 views

Is there much practical security value in using passwords/usernames for postgres instances used on development machines?

So say you are developing multiple different projects for different clients and want your developers to use postgres on their development machine (i.e. localhost connection in the development ...
user avatar
23 votes
12 answers
7k views

Storing weakness level of passwords

I am implementing a system where I need to store passwords in a database (hashed and all). My issue is that the business side requires me to not enforce any constraint on them except length (8 ...
user avatar
1 vote
0 answers
83 views

How to Securely Store Database Password in Java .properties File

I would like to store my DB password in Java .property file and encrypt it using Jasypt. But from what I see, it just moves the problem from hiding the DB Password to hiding the encryption password. I ...
user avatar
2 votes
3 answers
139 views

Manage passwords from my personal website

So I'm a complete novice in security practices, and an amateur web developer. I have a personal website connected to a personal DB. Currently there is nothing in this DB that would be useful to anyone ...
user avatar
  • 23
0 votes
1 answer
56 views

Does such kind of privacy proxy exist?

Imagine a typical web service. A client accesses it through a load balancer, which forwards the request to a backend server which will fetch data from a database, create the result and send it back to ...
user avatar
  • 61
4 votes
1 answer
140 views

Does "row-level security" actually serve a security purpose?

Row-level security is often an industry requirement in secure environments, such as those dealing with payment cards. It's supported by most major relational databases, including PostgreSQL, Microsoft ...
user avatar
  • 5,298
0 votes
0 answers
59 views

Disk encryption and heroku Postgres database field-level encryption

I'd like some perspective on the need for Postgres level encryption via pgcrypto (database field encryption for sensitive information) when there's already disk encryption (ESB) deployed https://...
user avatar
  • 11
1 vote
0 answers
69 views

Your opinion on my encryption security concept for my mobile app using Firebase and an external backend server? [closed]

I'm brainstorming a good architecture that allows me to store user generated data from my mobile app securely on my backend server, without forcing the user to remember an encryption password. The ...
user avatar
0 votes
1 answer
71 views

Multiple user sessions at the same time in a backoffice

I am currently working on a project for a veterinary practice and one of its components is a web-based backoffice for general management. The practice already has a backoffice-style software, but it's ...
user avatar
  • 1
0 votes
2 answers
73 views

Is it possible to compromise a device by connecting to a database?

I have a relatively secure device with very limited internet connections and/or activity. One of those connections is to a AWS RDS database (MySQL) I'm wondering if it's possible that my secure device ...
user avatar
0 votes
0 answers
73 views

How should SQL Server users be managed for a multi-tenant application?

I've looked extensively for a duplicate question, but I couldn't find anything that answers this question exactly. I have a SQL Server that will be used to store data for a multi-tenant application. ...
user avatar
0 votes
2 answers
104 views

How to be sure there are only encrypted data on my backend

I am coding an online password manager as part of my apprenticeship. I have already coded the full backend to synchronize the encrypted data and a frontend that encrypts and decrypts data with AES. So ...
user avatar
0 votes
0 answers
51 views

Guidance to NSRL 'Goodware' for reference data sets with no malware Hashes?

Im looking to test a set of YARA rules against a corpus of 'goodware'. Virustotal's own blog [2] suggests use of the National Software Reference Library [1] however the NRSL RDS(Data Sets) have ...
user avatar
  • 41
0 votes
1 answer
86 views

How to control authorized access to specific data for specific users

I am building a web application that involves a login system. Once a user has logged in and is authenticated they should have the ability to access data from a database. This is however where I get a ...
user avatar
  • 1
2 votes
0 answers
87 views

Database Security for Public Databases

I recently moved some of my projects over a to serverless platform. I immediately noticed a few issues though. The biggest being database security. Prior to this I had been hosting my sites and ...
user avatar
  • 121
0 votes
1 answer
68 views

Getting Smaller Output From Public Key Cryptography In PHP

I have a website in a shared hosting environment, and I'm also planning to back up in multiple locations. All of that introduces vulnerability where the data could get intercepted, stolen, or misused ...
user avatar
  • 743
0 votes
1 answer
198 views

Encryption Algorithm With Separate One-Way (Hashing) And Two-Way (Decryption) Keys

In cryptography, generally we have two ways of handling sensitive information. We can use one-way encryption such as hashing. This is useful when we never need to retrieve it again. In this case, we ...
user avatar
  • 743
0 votes
1 answer
221 views

What's The Best PHP Encryption For Email Addresses?

I'm storing a list of email addresses and other not personally identifiable information for a mailing list in a database. Since it's for a project related to cryptocurrency, I believe that the ...
user avatar
  • 743
0 votes
1 answer
151 views

How to secure data on production environment

Question Suppose you design a data lake with sensitive data. Due to immaturity of tools, dynamic data masking is unavailable. You have MFA, encryption at rest, audit logging, ETL processing data and ...
user avatar
  • 215
0 votes
2 answers
101 views

Are there security concerns that might prevent database systems from providing password data types?

Software development environments seem to benefit when problems can be solved "higher up the chain". For example, many web platform features that are now natively supported in both ...
user avatar
0 votes
0 answers
127 views

Do I need to encrypt user data in database

I have a user table with 20 columns. I am using argon2id to hash passwords but I was asked by the information security department to encrypt user data before saving it to the database. I have ...
user avatar
2 votes
1 answer
1k views

Root detection can be bypassed using Magisk hide: how to mitigate?

I have recently been assigned a new security fix for my Android App. The Vulnerability Assessment and Penetration Testing (VAPT) team used Magisk and Magisk hide to bypass the Android root detection ...
user avatar
1 vote
0 answers
127 views

Is it safe to store database connection in database?

I'm developing a SaaS platform using hybrid multi-tenancy model. My SaaS platform has 2 main databases: 1 contains metadata and the other (called default) is a shared database that contains the info ...
user avatar
  • 143
1 vote
1 answer
185 views

Weird entry in SQL Server database, is this a result of SQL Injection?

I stumbled upon a case where several database entries were updated. And the update is rather unusual. For example if I have an entry named: Watermelon The updated version is: Watermelon<IMG SRC=&...
user avatar
0 votes
0 answers
93 views

What are my vulnerabilities with this multi-user ACL database approach?

I would like some expert insight. I want to know what my vulnerabilities for this model are. This is a demo project that I will be following in my production app if all works out securely. My ...
user avatar
  • 117
0 votes
1 answer
133 views

Am I writing a good login system? [closed]

I am designing a login system for my React app. All user data must be protected in case of a db leak. I only store encrypted data, with the exception of the email. To encrypt I need a key and I don't ...
user avatar
0 votes
4 answers
187 views

How to protect email addresses in a customer database when you and other third parties must be able to send emails?

I am wondering what methods are used by big companies to protect customer email addresses in their databases. They usually have salespeople all over the world and multiple third-parties (Salesforce, ...
user avatar
0 votes
0 answers
13 views

Sql injection how does getting data outside from susposed rows works? [duplicate]

Let's say there is some vulnerable page and it gets SQL injected. PHP on the backend only returns specific rows and does not return passwords in any way. How do people get the passwords using that?
user avatar
1 vote
0 answers
88 views

How to protect PII data from being sold or exposed by employees

For PII, we capture mostly emails, mobile and name of users who signup on our website. Along with this purchases made by users are also a sensitive data. Protecting this data for users privacy is as ...
user avatar
  • 149
0 votes
3 answers
91 views

Is it secure to put a mysqldumped file online?

I made a database table of emoji country codes. I exported the data via mysqldump into a file called countries.sql. I want to share it because it was a hassle finding anything like this, so I want to ...
user avatar
0 votes
2 answers
179 views

Is it possible to hack a database inside of local network by external attacker?

Can an attacker from global network hack a database located on office machine inside of local office network? For example after hacking a router, a gateway or the very machine? Or maybe there is ...
user avatar
  • 117
0 votes
1 answer
73 views

Why would you use random algorithm for CSFLE if you can't query the inserted data?

I think I really misunderstand something about data encryption. This guide (https://docs.mongodb.com/manual/core/security-client-side-encryption/#randomized-encryption) says the following: "...
user avatar
  • 3
0 votes
1 answer
136 views

Database password encryption compromised

A company has a database with user's passwords encrypted. An attacker compromised the password encryption now it needs to be changed. In this situation does the company needs to change the encryption ...
user avatar
2 votes
2 answers
201 views

Ransomware encryption on opened files

I am wondering if ransomware can encrypt currently opened/locked files by an application? Example: Some application opens files and lock them for manipulation e.g. Database. So I assume that when the ...
user avatar
  • 23
1 vote
0 answers
67 views

Is there record of a pubilc RDS instance with strong password having been hacked?

I am auditing an AWS account and I found a public RDS instance, that is with public DNS, no Security Group IP connection filtering and in a public Subnet However, the instance has a relatively strong ...
user avatar
1 vote
1 answer
132 views

Preventing DDOS attacks without collecting personal data? [closed]

Could anyone suggest a system to prevent DDOS attacks without collecting personal data like i.p. addresses ( or using anonymized data ) and be not deny access to an innocent user ?
user avatar
0 votes
1 answer
211 views

public MySQL via XAMPP - security - whitelisting IP's versus VPN

I'm working on app that uses MySQL database on XAMPP Control Panel on Windows. I am concerned about security part. I received advice about connecting to MySQL through VPN so it won't be accessible so ...
user avatar
13 votes
2 answers
4k views

How does Google save our passwords on their server?

My friend recently told me that: Google doesn't have our passwords saved on their database. Instead they put our password when typed on browser, through an algorithm and it'll produce a unique ...
user avatar
0 votes
1 answer
91 views

Is possible to deliver a dos attack increasing a database table?

If a user through a request can add a record to a table (for each request) is theoretically possible that he could cause a dos attack just increasing the size of a table?
user avatar
  • 477
0 votes
0 answers
115 views

What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically

Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues. You want to review your database ...
user avatar
  • 1
0 votes
0 answers
50 views

EU GDPR: Can someone store the data inside EU but process them in US [duplicate]

I'm a bit lost in here and need some direction. According to the EU GDPR, the PII data should never leave the EU. But, Can they be taken out and processed outside? such as in a server that is situated ...
user avatar
0 votes
0 answers
31 views

How easy to crack simple, custom algorithm? [duplicate]

Out of curiosity. I am a green as grass programmer coming from other career disciplines and am learning multiple languages right now so play nice and keep it simple please. Interested in simple ...
user avatar
  • 117
1 vote
2 answers
544 views

SQL injection using brute force?

I am studying about cyber defense lately for fun and found about a proposed method that as I understand it performs automated SQL injection using brute force by training a model. At some point it says ...
user avatar
0 votes
1 answer
191 views

SQL TLS termination on Load Balancer

From what I understood TLS is protocol independent of HTTPS and can be used with other protocols as well. For example in order to connect to MS SQL server via encrypted connection I'll have to enable ...
user avatar
1 vote
0 answers
87 views

When using parameterized SQL queries, is there still any *security* issue with simply blindly accepting user input variables?

Suppose I have this: parameterized_database_call('SELECT * FROM widgets WHERE id = $1', $_GET['widget_id']); The SQL query is parameterized, as I've done for many years now. (I'm trying to repress ...
user avatar
  • 11
-1 votes
1 answer
1k views

Do websites ever delete data about me and my activities? [closed]

I wanted to know for how long Porn websites retain data about visitors' IP addresses and the specific pages they visit. I wanted to check it for Pornhub, xnxx, and xvideos. However, my country ...
user avatar
2 votes
1 answer
202 views

Encrypting links between registered users and their sensitive data

I want to make it impractical to link the users to their sensitive data without their passwords – even with a full access to the database. Furthermore, if a user has multiple pieces of sensitive data, ...
user avatar
  • 121
0 votes
1 answer
115 views

Should I obscure database primary keys for the frontend even if these ids are uuidv4 Ids?

After reading through the answers of the related question (the same question but about integer primary keys), I was wondering if there is any reason to hash uuidv4 primary keys and sending the hash to ...
user avatar
0 votes
1 answer
117 views

What (aside from the law) prevents cloud-hosting owners from eavesdropping on servers/code?

Given a server hosted on a cloud platform, what would stop the cloud platform owner from stealing the server's data and/or code? As far as I can tell, a motivated cloud owner could retrieve the data ...
user avatar
  • 101

1
2 3 4 5
15