Questions tagged [databases]
Security related aspects of databases and database access.
720
questions
0
votes
0
answers
9
views
How to Scan Firebase Database?
I have the APK of an application and analyzed it using MobSF static analysis. It says the application talks with Firebase Database and provides a URL.
Obviously, the URL is not accessible.
I am new to ...
- 5
0
votes
0
answers
27
views
Is there much practical security value in using passwords/usernames for postgres instances used on development machines?
So say you are developing multiple different projects for different clients and want your developers to use postgres on their development machine (i.e. localhost connection in the development ...
- 101
23
votes
12
answers
7k
views
Storing weakness level of passwords
I am implementing a system where I need to store passwords in a database (hashed and all). My issue is that the business side requires me to not enforce any constraint on them except length (8 ...
- 341
1
vote
0
answers
83
views
How to Securely Store Database Password in Java .properties File
I would like to store my DB password in Java .property file and encrypt it using Jasypt. But from what I see, it just moves the problem from hiding the DB Password to hiding the encryption password.
I ...
- 11
2
votes
3
answers
139
views
Manage passwords from my personal website
So I'm a complete novice in security practices, and an amateur web developer. I have a personal website connected to a personal DB. Currently there is nothing in this DB that would be useful to anyone ...
- 23
0
votes
1
answer
56
views
Does such kind of privacy proxy exist?
Imagine a typical web service. A client accesses it through a load balancer, which forwards the request to a backend server which will fetch data from a database, create the result and send it back to ...
- 61
4
votes
1
answer
140
views
Does "row-level security" actually serve a security purpose?
Row-level security is often an industry requirement in secure environments, such as those dealing with payment cards.
It's supported by most major relational databases, including PostgreSQL, Microsoft ...
- 5,298
0
votes
0
answers
59
views
Disk encryption and heroku Postgres database field-level encryption
I'd like some perspective on the need for Postgres level encryption via pgcrypto (database field encryption for sensitive information) when there's already disk encryption (ESB) deployed https://...
- 11
1
vote
0
answers
69
views
Your opinion on my encryption security concept for my mobile app using Firebase and an external backend server? [closed]
I'm brainstorming a good architecture that allows me to store user generated data from my mobile app securely on my backend server, without forcing the user to remember an encryption password.
The ...
- 11
0
votes
1
answer
71
views
Multiple user sessions at the same time in a backoffice
I am currently working on a project for a veterinary practice and one of its components is a web-based backoffice for general management.
The practice already has a backoffice-style software, but it's ...
- 1
0
votes
2
answers
73
views
Is it possible to compromise a device by connecting to a database?
I have a relatively secure device with very limited internet connections and/or activity. One of those connections is to a AWS RDS database (MySQL)
I'm wondering if it's possible that my secure device ...
- 535
0
votes
0
answers
73
views
How should SQL Server users be managed for a multi-tenant application?
I've looked extensively for a duplicate question, but I couldn't find anything that answers this question exactly.
I have a SQL Server that will be used to store data for a multi-tenant application. ...
0
votes
2
answers
104
views
How to be sure there are only encrypted data on my backend
I am coding an online password manager as part of my apprenticeship.
I have already coded the full backend to synchronize the encrypted data and a frontend that encrypts and decrypts data with AES. So ...
0
votes
0
answers
51
views
Guidance to NSRL 'Goodware' for reference data sets with no malware Hashes?
Im looking to test a set of YARA rules against a corpus of 'goodware'. Virustotal's own blog [2] suggests use of the National Software Reference Library [1] however the NRSL RDS(Data Sets) have ...
- 41
0
votes
1
answer
86
views
How to control authorized access to specific data for specific users
I am building a web application that involves a login system. Once a user has logged in and is authenticated they should have the ability to access data from a database. This is however where I get a ...
- 1
2
votes
0
answers
87
views
Database Security for Public Databases
I recently moved some of my projects over a to serverless platform. I immediately noticed a few issues though. The biggest being database security.
Prior to this I had been hosting my sites and ...
- 121
0
votes
1
answer
68
views
Getting Smaller Output From Public Key Cryptography In PHP
I have a website in a shared hosting environment, and I'm also planning to back up in multiple locations. All of that introduces vulnerability where the data could get intercepted, stolen, or misused ...
- 743
0
votes
1
answer
198
views
Encryption Algorithm With Separate One-Way (Hashing) And Two-Way (Decryption) Keys
In cryptography, generally we have two ways of handling sensitive information.
We can use one-way encryption such as hashing. This is useful when we never need to retrieve it again. In this case, we ...
- 743
0
votes
1
answer
221
views
What's The Best PHP Encryption For Email Addresses?
I'm storing a list of email addresses and other not personally identifiable information for a mailing list in a database. Since it's for a project related to cryptocurrency, I believe that the ...
- 743
0
votes
1
answer
151
views
How to secure data on production environment
Question
Suppose you design a data lake with sensitive data. Due to immaturity of tools, dynamic data masking is unavailable. You have MFA, encryption at rest, audit logging, ETL processing data and ...
- 215
0
votes
2
answers
101
views
Are there security concerns that might prevent database systems from providing password data types?
Software development environments seem to benefit when problems can be solved "higher up the chain".
For example, many web platform features that are now natively supported in both ...
- 422
0
votes
0
answers
127
views
Do I need to encrypt user data in database
I have a user table with 20 columns. I am using argon2id to hash passwords but I was asked by the information security department to encrypt user data before saving it to the database.
I have ...
2
votes
1
answer
1k
views
Root detection can be bypassed using Magisk hide: how to mitigate?
I have recently been assigned a new security fix for my Android App.
The Vulnerability Assessment and Penetration Testing (VAPT) team used Magisk and Magisk hide to bypass the Android root detection ...
- 121
1
vote
0
answers
127
views
Is it safe to store database connection in database?
I'm developing a SaaS platform using hybrid multi-tenancy model.
My SaaS platform has 2 main databases: 1 contains metadata and the other (called default) is a shared database that contains the info ...
- 143
1
vote
1
answer
185
views
Weird entry in SQL Server database, is this a result of SQL Injection?
I stumbled upon a case where several database entries were updated. And the update is rather unusual.
For example if I have an entry named:
Watermelon
The updated version is:
Watermelon<IMG SRC=&...
- 23
0
votes
0
answers
93
views
What are my vulnerabilities with this multi-user ACL database approach?
I would like some expert insight. I want to know what my vulnerabilities for this model are.
This is a demo project that I will be following in my production app if all works out securely. My ...
- 117
0
votes
1
answer
133
views
Am I writing a good login system? [closed]
I am designing a login system for my React app.
All user data must be protected in case of a db leak. I only store encrypted data, with the exception of the email.
To encrypt I need a key and I don't ...
0
votes
4
answers
187
views
How to protect email addresses in a customer database when you and other third parties must be able to send emails?
I am wondering what methods are used by big companies to protect customer email addresses in their databases. They usually have salespeople all over the world and multiple third-parties (Salesforce, ...
- 1
0
votes
0
answers
13
views
Sql injection how does getting data outside from susposed rows works? [duplicate]
Let's say there is some vulnerable page and it gets SQL injected. PHP on the backend only returns specific rows and does not return passwords in any way. How do people get the passwords using that?
- 27
1
vote
0
answers
88
views
How to protect PII data from being sold or exposed by employees
For PII, we capture mostly emails, mobile and name of users who signup on our website. Along with this purchases made by users are also a sensitive data. Protecting this data for users privacy is as ...
- 149
0
votes
3
answers
91
views
Is it secure to put a mysqldumped file online?
I made a database table of emoji country codes. I exported the data via mysqldump into a file called countries.sql.
I want to share it because it was a hassle finding anything like this, so I want to ...
0
votes
2
answers
179
views
Is it possible to hack a database inside of local network by external attacker?
Can an attacker from global network hack a database located on office machine inside of local office network? For example after hacking a router, a gateway or the very machine? Or maybe there is ...
- 117
0
votes
1
answer
73
views
Why would you use random algorithm for CSFLE if you can't query the inserted data?
I think I really misunderstand something about data encryption. This guide (https://docs.mongodb.com/manual/core/security-client-side-encryption/#randomized-encryption) says the following:
"...
- 3
0
votes
1
answer
136
views
Database password encryption compromised
A company has a database with user's passwords encrypted. An attacker compromised the password encryption now it needs to be changed.
In this situation does the company needs to change the encryption ...
2
votes
2
answers
201
views
Ransomware encryption on opened files
I am wondering if ransomware can encrypt currently opened/locked files by an application?
Example: Some application opens files and lock them for manipulation e.g. Database. So I assume that when the ...
- 23
1
vote
0
answers
67
views
Is there record of a pubilc RDS instance with strong password having been hacked?
I am auditing an AWS account and I found a public RDS instance, that is with public DNS, no Security Group IP connection filtering and in a public Subnet
However, the instance has a relatively strong ...
- 133
1
vote
1
answer
132
views
Preventing DDOS attacks without collecting personal data? [closed]
Could anyone suggest a system to prevent DDOS attacks without collecting personal data like i.p. addresses ( or using anonymized data ) and be not deny access to an innocent user ?
0
votes
1
answer
211
views
public MySQL via XAMPP - security - whitelisting IP's versus VPN
I'm working on app that uses MySQL database on XAMPP Control Panel on Windows.
I am concerned about security part.
I received advice about connecting to MySQL through VPN so it won't be accessible so ...
13
votes
2
answers
4k
views
How does Google save our passwords on their server?
My friend recently told me that:
Google doesn't have our passwords saved on their database. Instead they put our password when typed on browser, through an algorithm and it'll produce a unique ...
- 133
0
votes
1
answer
91
views
Is possible to deliver a dos attack increasing a database table?
If a user through a request can add a record to a table (for each request) is theoretically possible that he could cause a dos attack just increasing the size of a table?
- 477
0
votes
0
answers
115
views
What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically
Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues.
You want to review your database ...
- 1
0
votes
0
answers
50
views
EU GDPR: Can someone store the data inside EU but process them in US [duplicate]
I'm a bit lost in here and need some direction.
According to the EU GDPR, the PII data should never leave the EU.
But, Can they be taken out and processed outside? such as in a server that is situated ...
0
votes
0
answers
31
views
How easy to crack simple, custom algorithm? [duplicate]
Out of curiosity. I am a green as grass programmer coming from other career disciplines and am learning multiple languages right now so play nice and keep it simple please. Interested in simple ...
- 117
1
vote
2
answers
544
views
SQL injection using brute force?
I am studying about cyber defense lately for fun and found about a proposed method that as I understand it performs automated SQL injection using brute force by training a model. At some point it says ...
- 13
0
votes
1
answer
191
views
SQL TLS termination on Load Balancer
From what I understood TLS is protocol independent of HTTPS and can be used with other protocols as well. For example in order to connect to MS SQL server via encrypted connection I'll have to enable ...
1
vote
0
answers
87
views
When using parameterized SQL queries, is there still any *security* issue with simply blindly accepting user input variables?
Suppose I have this:
parameterized_database_call('SELECT * FROM widgets WHERE id = $1', $_GET['widget_id']);
The SQL query is parameterized, as I've done for many years now. (I'm trying to repress ...
- 11
-1
votes
1
answer
1k
views
Do websites ever delete data about me and my activities? [closed]
I wanted to know for how long Porn websites retain data about visitors' IP addresses and the specific pages they visit. I wanted to check it for Pornhub, xnxx, and xvideos. However, my country ...
2
votes
1
answer
202
views
Encrypting links between registered users and their sensitive data
I want to make it impractical to link the users to their sensitive data without their passwords – even with a full access to the database.
Furthermore, if a user has multiple pieces of sensitive data, ...
- 121
0
votes
1
answer
115
views
Should I obscure database primary keys for the frontend even if these ids are uuidv4 Ids?
After reading through the answers of the related question (the same question but about integer primary keys), I was wondering if there is any reason to hash uuidv4 primary keys and sending the hash to ...
0
votes
1
answer
117
views
What (aside from the law) prevents cloud-hosting owners from eavesdropping on servers/code?
Given a server hosted on a cloud platform, what would stop the cloud platform owner from stealing the server's data and/or code?
As far as I can tell, a motivated cloud owner could retrieve the data ...
- 101