Questions tagged [databases]
Security related aspects of databases and database access.
620
questions
0
votes
0answers
27 views
Secure access to MS SQL from web applications
MS SQL provides two primary authentication methods, Windows Authentication or SQL Server Authentication.
Since local MS SQL accounts are problematic to maintain and monitor this option is not ...
0
votes
0answers
22 views
How to speed up the database encryption / decryption process in Oracle 11 Standard Edition? [migrated]
I have an 11-year old huge database designed in Oracle 11g Standard Edition. It requires to be encrypted for maximum security.
We have used dbms_crypto library to perform the encryption & ...
1
vote
0answers
36 views
Does TDE not protect against disk theft?
I read the following on Microsoft's site. Can someone please clarify -
"With TDE, is the data stored in my data, log, and backup files protected from a disk theft?"
Yes, but only if the files ...
0
votes
1answer
110 views
Hack a website using database username and password [closed]
Is it possible that someone could hack a website if they have the database name, database username, and database password? If so, how do they do it?
The database connection is mysql.
0
votes
1answer
84 views
General security of offline databases (like SQLite)
I'm writing a small task management program in Java (not for mobile devices btw), and part of it was kind of a 'data service' to encapsulate and reuse database related code - such as connecting to ...
9
votes
1answer
1k views
Employer stores plain text personal data in a 'data warehouse' [closed]
I'm unsure if I have posted this in the correct community but the organisation I am currently working for currently uses an SQL 'data warehouse' which contains a bunch of tables from various sources, ...
0
votes
3answers
106 views
Is it safe to protect the write permission only with a publicly accessible hashed password?
A user stores a raw information (a comment on a website, a like on a post etc.) in a database. He pairs it with a hashed password and keep the original password safely for him/herself. This password ...
2
votes
2answers
48 views
Separate Auth DB for Increased Security
I'm a dev working on an app that has a monolith DB (PostgreSQL). We are using a third party provider for AUTH and MFA, but want to move MFA back into our control. The plan was to move the encrypted ...
1
vote
0answers
57 views
What's the advantage in encrypting data for data masking?
I'm in the process of selecting a product for data masking sensitive information in our DB so that developers won't see restricted information while testing production data.
I came across some ...
16
votes
2answers
3k views
Data Encryption by Application vs Data Encryption in Database
For a GDPR (EU General Data Protection Regulation) implementation, I need to encrypt some personal information. There are two ways we can encrypt the data:
Let the web application have the sole ...
1
vote
0answers
36 views
How can I log access and usage of a MySQL database?
I am currently looking for an existing implementation method to generate logging of accesses and of usage of a series of MySQL databases by developers (not services) for further auditing. My current ...
0
votes
1answer
129 views
Malicious IP addresses [closed]
I am looking for updated lists of IP addresses that belong to malware's C&C, botnets, malicious scanners, or other sort of malicious activities.
Is there any public database of malicious IP ...
1
vote
0answers
58 views
Is AWS Cognito vulnerable to MITM when using iOS with Lambda and RDS
I'm a bit new to coding backend services. And I'm not sure how to solve this problem.
So users in an iOS app can be authenticated with Cognito and afterwards gain the rights to invoke lambda ...
1
vote
1answer
81 views
What kinds of attacks are possible with credentials to a read-only Postgres user?
Assuming I implement the literal SQL-injection on an HTTP endpoint with a read-only user that limits execution time to e.g. some amount of seconds. What's the worst that could happen? I know simple ...
2
votes
1answer
81 views
How is end-to-end encrypted data stored in a database?
A traditional database holds the data in each column and then has a relational ID to tie that row to a parent (e.g. a user's ID) so it can be found in a query.
Taking the same scenario but this time ...
3
votes
1answer
81 views
Security concerns in disseminating database design?
I work for a government agency, and we've been requested via a freedom of information request for the layout of the tables of one of our systems, a data dictionary and schema design request.
What are ...
1
vote
0answers
30 views
How to anonymise a numeric data attribute, whilst preserving indexability?
I would like to (1-way) anonymise some bounded, numeric data attributes (e.g. age, optimistically bounded by 0 and 200), whilst still retaining the ability to use the resulting data in an index for ...
1
vote
2answers
113 views
Is VirusTotal useful for finding malware in a WordPress database SQL export?
Does VirusTotal detect malware in an SQL export? I have an infected WordPress site. I removed the malware with various tools, however I know from experience, that sometimes it hides itself somewhere ...
0
votes
0answers
31 views
Development and Production on the same RDS instance, but under different databases?
I was told to create a single RDS instance (amazon web services RDS) onto which I should create two users, development and production, and two databases, development and production. The idea is that ...
0
votes
0answers
40 views
Foreign key constraint danger - information leakage?
Suppose we have an SQL database.
Suppose we have a user D who has no read access to some table named EMP (employees).
Suppose we allow him to create a table with a foreign key regarding EMP table. Is ...
1
vote
3answers
116 views
Which function to hash 128 bit API key with?
I'm generating 128 bit API keys. AFAIK 128 is totally secure for generated key. In the DB I want to store hashes, not the plain text (to be protected against DB leak), but what hashing algorithm ...
1
vote
1answer
95 views
Do I need to use salt with api key hashing?
I will generate api keys. I plan to store their hashes instead of plain text. do i also need salt, similar to storing password?
AFAIK salt prevents rainbow table attack and those are more ...
12
votes
3answers
3k views
Would encrypting a database protect against a compromised admin account?
I was discussing with someone ways to prevent data disclosure from a compromised admin account on a database server. The other person proposed encrypting the data at rest within the database. It ...
0
votes
2answers
62 views
Does choice of DBMS matters in the protection of XSS and other injection attacks
I have filtered into 3 most used databases, MySQL, Microsoft SQL server and mangoDB. I have to choose the most secure database from these three.
Does my choice of DBMS has a role in protection ...
1
vote
0answers
344 views
How to crack encrypted Android SQLite DB? [closed]
I am testing an android app which has DB encrypted (AES-256), I extracted it from system files /data/data//databases, I have following doubts,
How do we ensure that DB is encrypted properly and it is ...
133
votes
3answers
14k views
Is HostGator storing my password in plaintext?
I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.
I asked a customer care representative to help me add an SSL certificate to a site I host with them. ...
2
votes
1answer
114 views
How safe is it to open source access to MySQL database on github, only permitting SELECT query?
The Setup: Im building an app to model visually world data. A significant part of this project will be the database since that data is what is interesting. I should only need to allow SELECT queries,...
2
votes
3answers
157 views
Are there examples of implementing security as a side effect?
I have long since felt that one of the best ways to effectively implement new security constructs is to implement it in the background, where it is not the primary feature of some new construct. This ...
0
votes
1answer
49 views
Which is more secure: saving reference link to file in file system in the database, or save the entire file into the database?
We have forms where we get clients to upload images of very sensitive information (passport, signature, etc.). We will store their written information into a database. However, there is the issue of ...
1
vote
2answers
89 views
Is it legal to store users searches [closed]
Im developing a webshop and i got a task asking for storing users searches. Is it legal?
It will be stored in a db with the fields Date, Search text, userId
1
vote
1answer
52 views
Best Practices for exporting sensitive database data and transforming it whilist keeping it encrypted?
Say one has to export database data to use in another tool, such as an Excel Spreadsheet or for use as a csv file with some other program.
There's a problem with this, and that's that it ends up in ...
1
vote
2answers
166 views
How to obfuscate a relation between two tables in a database?
I have a kind of weird use case here, and I'm not sure how to deal with it.
I'm working on a project that stores medical data. The following requirement has been addressed by another team, but hasn't ...
0
votes
1answer
45 views
Storing files in database through encryption and Viewing them only on providing key for the file
I have this use case:
User1 uploads his file into the database which should be encrypted.
Any other users who request that file, user1 will be notified for approval, on approving other users should ...
0
votes
1answer
41 views
What would be the best way to evaulate the database management systems? [closed]
I am an Information security analyst, looking for creative, non traditional, and unapproved ways to query/evaluate DBMS applications that includes SQL Server and PostgreSQL. Goal here is to protect ...
0
votes
0answers
298 views
Two-factor authentication on Galaxy Watch - should secrets be encrypted, and is this SQLite example secure?
I recently got a Galaxy Watch and to get acquainted with developing apps for it I'm writing a simple two factor authenticator to generate TOTP codes from entered secrets using the Google Authenticator ...
2
votes
2answers
538 views
Is it worth storing email addresses as hashes?
If your running a web services with lots of users and you get hacked, you may be giving away users's plain text information like email and hashes like password hashes.
Is it worth storing email ...
0
votes
0answers
64 views
Introduce a SQLi in a testing application
So I was building an application to demonstrate SQL injection via cookies and wrote some code to run SQL statements if the statement are passed within a redir cookie header but when using sqlmap to ...
4
votes
1answer
453 views
Is forbiding the ; char enough to prevent SQL injection?
Disclaimer: Parameterized queries are the way to go, no need to discuss about that :)
I've seen the following code at a friends place:
var query = "SELECT * FROM students WHERE name = " + name;
...
0
votes
1answer
70 views
How can I detect an infection in a database?
Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with diff) and that's it. However, ...
0
votes
1answer
39 views
Prevent Database from accessing with knowing system admin user [closed]
My question might be broad. Suppose that we trying to store our client's information data with a database on a server. The server may get a vulnerability and give access to a hacker to get access to ...
3
votes
2answers
104 views
Store database access password in PHP class const?
I have PHP project and I need to store MySQL access information.
I have a config.php file outside public directory and in the file I have:
class Config
{
const host = "dbserver";
const name =...
1
vote
0answers
44 views
Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?
LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider.
Any input would be swell!
-
A case ...
1
vote
0answers
32 views
How should I secure my database in Microservice architecture
Can someone tell me whether I should secure may connections to the database from my microservice? Should I worry about the communication between my microservice and database?
1
vote
1answer
54 views
hiding emails in database [closed]
I am making a webpage (similar to a social media) which will be open-source, but will probably only run off one server, with multiple levels (php, javascript(hopefully without any modules), postgresql)...
15
votes
5answers
436 views
Business founder wants access to database but has no DB skills
Someone asked me to create a site for their online business which I did, handling a lot of the development myself. After I created my account on the site I told my employer "Hey, the site is ready you ...
1
vote
0answers
32 views
Web application secrets protection following code execution
I would like to clarify protection practices for handling database secrets with database connected web application, using Docker containers. The aim is to determine how to protect secrets even if an ...
1
vote
0answers
22 views
Is it possible to open Chrome's databases.db in another MacBook?
According to this post, Chrome passwords are stored in /Users/$USER/Library/Application Support/Google/Chrome/Default/databases/Databases.db. Is it possible for an attacker to copy Chrome passwords ...
1
vote
1answer
118 views
IP-whitelisting for DB access, does solution fit best practices?
All the data we have on our customers sits in our data-lake, which is hosted by one of our suppliers. Currently the security is such that a limited number of users has (limited) access to the database ...
1
vote
1answer
693 views
Are partial passwords a security improvement over full passwords?
With full password authentication, you need to enter the full password every time.
With partial password authentication, you're asked for some subset of the password each time, and which characters ...
4
votes
1answer
99 views
Security consequences of a publicly accessible database?
I've been asked to expose the database of a web app publicly so that an external service can connect directly to the database (via username/password) to read information. This database is currently ...
