Security related aspects of databases and database access.
0
votes
1answer
67 views
How does Shodan crawl internet-connected devices?
I wonder how Shodan crawls internet-connected devices and adds them to its database. I know Google, for instance, finds new websites by following links in websites it already found, but that strategy ...
1
vote
0answers
45 views
Storing private messages in a database
I am creating a portal where users can send private messages (PMs) for a very large audience. So I want to encrypt the messages and store them in the database. But I do not want to ask the users for ...
1
vote
1answer
55 views
Cracking encrypted SQB databases
I've recovered a .SQB SQL database backup file from a backup server and do not have the password.
As I do not have the password available to me, I'm looking to determine what type of encryption is ...
3
votes
1answer
54 views
How to minimize security risk when having to work with decrypted (plain text) passwords due to 3rd party API design
I'm developing an application (C#) for Microsoft SharePoint platform that uses SQL Server's (2008 R2) Remote BLOB Storage (RBS) technology. To accomplish certain client-side tasks, I must obtain ...
2
votes
1answer
30 views
/WEB-INF/web.xml showing MySQL credentials?
I found the file /WEB-INF/web.xml on a domain I'm associated with. The XML file contains:
<database>
<jndi-name>jdbc/mysql</jndi-name>
<driver>
...
2
votes
1answer
96 views
Encrypt Android app data and send to web service
I want to develop an Android app that may contain sensitive personally identifying information (national ID number, phone number, etc.) among other data that will be stored in an Android phone.
Let's ...
1
vote
1answer
44 views
How do I store a user's secret key on a server?
I'm learning about security at the moment and one thing I'd like to try out is having a key server distribute keys to clients that will allow them to securely save and read data locally.
My basic ...
1
vote
0answers
13 views
Specification Document
I have been asked to research on a certain database then write down a specification document which covers Authentication, Authorization and Encryption. Has anyone ever come across such a ...
1
vote
1answer
52 views
Multi Tenant Database - HIPAA
We are planning to develop a EHR/Billing Software and we are aware about HIPAA rules and regulations. Our current application architecture using a shared database with all client's(Provider/Practice) ...
0
votes
1answer
92 views
What are common problems that reveal PHP code? [closed]
What is the best method for securing PHP scripts that contain database passwords?
From what I've read, PHP can be revealed when an error occurs and is not caught.
Is there any way to reveal PHP by ...
0
votes
1answer
100 views
Which approach to encrypting data on a per-user basis is more secure?
As a bit of a thought experiment, I've been thinking through how one might design a web application where a user's data (say, from a form on a webpage) is stored, encrypted, on the server, using a ...
1
vote
1answer
79 views
Uploading Executable Files
Using proxy software, I was able to bypass a file upload control file-checking for an asp.net system I am pen testing. I noticed they are saving the file into the database as bytes, and it is ...
0
votes
1answer
60 views
Are there any secure ways to store the secret key used in a TOTP scheme?
I'm writing a little webapp that demonstrates 2 factor authentication. I'm using the TOTP protocol as described in RFC 6238. In our scheme, we are storing, in addition to a b-crypted password hash ...
1
vote
0answers
67 views
Store which parts of an IP address, for user to remain anonymous?
I'm thinking about building a very anonymous forum, where people can comment and upvote each other's comments anonymously. People are supposed to remain anonymous even if the forum's database contents ...
0
votes
2answers
114 views
What is truly unbreakable these days? [closed]
Just very curious, count my knowledge in cryptography, algorithms, and security in general as non-existent. Now I am aware that this might be a VERY broad question, but here it goes. What is the most ...
0
votes
1answer
59 views
Application Server <-> Database Firewall [closed]
What threats can a firewall between an application server and a database server mitigate that would not otherwise be mitigated when both the database server and application server are behind the same ...
4
votes
3answers
179 views
What is a good rebuttal to users who wish all data WITHIN Db be encrypted?
I am building an application in VB.NET (WinForms) utilizing SQL Server 2008 R2 as a Backend.
The application is to track employee's money they defer each paycheck, or month, to deposit into separate ...
0
votes
0answers
23 views
Why is it not advisable to have the database and web server on the same machine? [duplicate]
I'm bringing this across from a question on stackoverflow, but I'd like to focus specifically on the security aspects of it (and not the performance, etc..).
My hypothesis is that the cost of ...
0
votes
1answer
86 views
Should I encrypt Long-lived Facebook Access Token when storing them in my DB?
I own an application that grabs some Long-Lived Facebook Access token, in order to be use later according to the corresponding logged user.
Should I need to encrypt them before storing them, to avoid ...
1
vote
0answers
22 views
Secure 'pg_settings' for PostgreSQL
I have been looking for some kind of hardening guide towards PostgreSQL which I can use for a security audit of a PostgreSQL DB.
I came across this url, have checked the same. Anything more to this?:
...
0
votes
1answer
74 views
Removing Unnecessary Services & Packages in a MySQL Ubuntu 12.04 Server [closed]
As part of hardening a MySQL 5.6 server running on Ubuntu 12.04 LTS, unnecessary services and packages will have to be removed.
For a server that is serving only as a MySQL server, what services and ...
0
votes
2answers
85 views
What are the Standard Practices for Securely Storing Encryption Keys in Databases
I have a requirement for storing multiple symmetric encryption keys in a database. What I want to know is, are there any standard, accepted practices for storing these keys in a database ?
To add a ...
17
votes
4answers
3k views
What can an attacker do if he knew my database credentials?
If an attacker knows my database username and password, what can he possibly do if he doesn't have access to my server? Let's say my database is using Microsoft SQL Server. Is there a way he can use ...
1
vote
3answers
144 views
How can I prevent my database from being compromised if my CakePHP app is compromised?
I have an app server hosting a CakePHP app and a database server hosting the databases. The servers are physically separate. The databases contain encrypted sensitive information. The encryption keys ...
0
votes
1answer
77 views
A Question about Database Encryption [closed]
I've been looking around for an answer to this for some time now and I felt that this place would be a good venue to ask this.
How can one improve the security in a MySQL database?
The database that ...
2
votes
1answer
279 views
Best practice for data security on a web application
I read a couple articles on privacy/security but still cannot get a clear picture of the best practice to ensure that an attacker will not be able to access users' private information.
For storing ...
1
vote
1answer
59 views
PCI DSS compliance for storing PAN and PII in multi-tenant environment
I wanted to know if I can still be PCI compliant if I store card holder and PII information for multiple tenants in the same database? I.e., have an identifier on the table level to identify the ...
4
votes
4answers
417 views
avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?
Summary
Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
2
votes
1answer
74 views
PCI Complient Storing Credit Card Data On Offline Tablet
I have a client that does work in rural areas where there are no cellphone or internet connections. They need a way to take credit card information in the field, bring it back to their office where ...
2
votes
2answers
70 views
How do vulnerability reports work?
I'm really interested in IT security and I would like to know how vulnerability reports work.
Is there a central database for those things? I often see CVE-XXX-XXX on disclosures, but I don't ...
1
vote
2answers
88 views
How to securely provide data to a web server using a data warehouse?
We have a data warehouse that stores prices for our products. Once every business day, new data points are added representing the day's price for each product.
On the website, a user sees this ...
5
votes
2answers
369 views
Encrypt user data when they log in with Facebook, Gmail, etc
I made a login system. The user can login by:
using a normal email / password (bcrypted).
using a service like facebook, gmail, etc.
So far so good. Now I want to store sensitive information (ftp ...
1
vote
0answers
56 views
Security considerations for SQL database with employee data in blob field
With elevated SQL permissions, I am able to export a blob and retrieve a pdf with employee data (SSN) from a SQL Server database. This database is a backend to a third party web app we use internally ...
1
vote
1answer
200 views
What does Gazzang zNcrypt actually protect against?
In an effort to increase security of our website, I'm reading up on Gazzang zNcrypt, which claims to protect data in databases from breaches.
Technically, it seems to do filesystem encryption. As far ...
4
votes
1answer
63 views
Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks?
Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks?
Reading the "What Are the Oracle Database Built-in Password Protections?" from ...
2
votes
0answers
369 views
How to secure API (private key) for mobile apps
I am building a web service that has to be only accessible for iOS apps.
In the future I want to expand to a mobile website to make my service also available for other mobile operating systems.
Now, ...
4
votes
2answers
107 views
Data integrity of malicious content in the database
From a data integrity standpoint, if I persist the following code into my database:
<script>
alert('hi');
</script>
should I sanitize it before persistence, for instance making ...
-1
votes
1answer
50 views
Network and data security for small online businesses? [closed]
What is the most efficient way of protecting small online business from outside threats. Everything too much expensive is not a solution.
I've been looking for good web application firewall and at ...
1
vote
1answer
78 views
Security risks if a server in not supported anymore
I have an SQL 2000 database server which is not supported by Microsoft anymore. We have our information security policy applied and even PCI requirements.
What are the security risks that we might ...
0
votes
1answer
180 views
How to secure and limit access to a web based application hosted on a local server
I have security concerns over a web based application. I want to limit access to the application only to a whitelisted IP addresses. Here are my thoughts on that:
To host the application myself.
The ...
3
votes
3answers
920 views
Is “Why Should You Avoid AES In MySQL?” true?
From a 2012 Smashing Magazine article quite a bold statement is made to avoid AES in MySQL itself. Or as they put it "Why Should You Avoid AES In MySQL?". However, if you search for SQL encryption, ...
-2
votes
1answer
61 views
Should I do science of computing or systems analyst? [closed]
I want to become a federal analyst of cyber crimes and I dont't know what's the right university course for me, I would like to know what's the cons and pros of choosing one or another course and ...
6
votes
1answer
262 views
SQL Server of my hosting provider allows me to see all databases. How secure is my mine?
My hosting provider allows access to its SQL Server. When I connected to it by SQL Management Studio, all hosted databases were visible.
I can't get the details on these databases, I get this ...
4
votes
1answer
205 views
How secure is MongoDB wire protocol?
I'm building a JavaFX 2.0 standalone application (it'll be distributed as an .exe) and it opens a connection to a MongoDB instance. The connection is just a standard Mongo connection using the Mongo ...
1
vote
1answer
60 views
How to restrict access to a resource based on frequency of access?
I want to restrict access to a particular resource based on time (configurable). So suppose user A has time t configured from him. He can access the resource only once every t time units. The values ...
3
votes
1answer
188 views
Theory about split data in several isolated (different physical server) DBMS to gain in security?
Suppose the following scenario:
1- A web app (on WEBSERVER1) and its database (on DBMS1) having very sensible information deployed in the same physical server (lets said that for simplification). ...
1
vote
1answer
62 views
Oracle database privileges [closed]
I have a 10.2.0.5.0 Oracle Database and a list of users who i need to grant some privileges to (Mainly to generate reports and so on).
I used impersonation, which means i created one Oracle user so ...
1
vote
2answers
161 views
Main requirements to secure my Application in any database related features
I have an application which is hosted on a windows server on which an SQL DB exists. This server communicates with the clients and agents installed on host PCs through TCP/IP and SSL connections. I'm ...
8
votes
2answers
239 views
What's ownership concept for?
I fail to grasp the necessity of using concept of owner (ownership) and find clear explanation of its necessity.
What cannot be done without concept of owner(ownership) in filesystem/database object ...
3
votes
3answers
209 views
How do poor-quality initialization vectors affect the security of CBC mode?
(If the consensus is that this question belongs on crypto, rather than here, please feel free to [tell me to] migrate it.)
From what I have read (looking specifically at AES in Cipher Block Chaining ...
