Questions tagged [databases]

Security related aspects of databases and database access.

Filter by
Sorted by
Tagged with
2
votes
1answer
395 views

Is the most recent version of ojdbc7 still vulnerable to CVE-2016-3506?

Looking at the Oracle security advisory page here: https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Oracle in 2016 disclosed vulnerabilites in their OJDBC7 versions 12.1.0....
0
votes
1answer
59 views

What is the ISO standard for deletion? [closed]

What does the ISO standard for deletion require when deleting personal data ? Hereisanexample : A database SQL stores email as key , password with salt and an encryption key leading to more data in ...
4
votes
2answers
785 views

Encrypt DB Fields preserving search functionality

I would like to protect sensitive information stored on a Postgresql database, but I would not like to encrypt it all. The idea is to encrypt only those fields which hold sensitive information. I was ...
0
votes
0answers
17 views

How to read source code for big projects? [closed]

I was trying to read source code for redis db and I could understand the code but there were too many files, and thousands of lines of code which got me confused. I tried reading flockdb which is ...
0
votes
1answer
43 views

public MySQL via XAMPP - security - whitelisting IP's versus VPN

I'm working on app that uses MySQL database on XAMPP Control Panel on Windows. I am concerned about security part. I received advice about connecting to MySQL through VPN so it won't be accessible so ...
8
votes
1answer
2k views

How does Google save our passwords on their server?

My friend recently told me that: Google doesn't have our passwords saved on their database. Instead they put our password when typed on browser, through an algorithm and it'll produce a unique ...
0
votes
1answer
47 views

Is possible to deliver a dos attack increasing a database table?

If a user through a request can add a record to a table (for each request) is theoretically possible that he could cause a dos attack just increasing the size of a table?
0
votes
0answers
55 views

How could I improve the security of my design?

I’m building an open-source notes app using electron. I’ll be using rxdb which uses crypto-js to encrypt fields using AES-256 after getting a passphrase and using pbkdf2 to generate a key. Rxdb is a ...
0
votes
0answers
52 views

What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically

Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues. You want to review your database ...
0
votes
0answers
47 views

EU GDPR: Can someone store the data inside EU but process them in US [duplicate]

I'm a bit lost in here and need some direction. According to the EU GDPR, the PII data should never leave the EU. But, Can they be taken out and processed outside? such as in a server that is situated ...
0
votes
0answers
28 views

How easy to crack simple, custom algorithm? [duplicate]

Out of curiosity. I am a green as grass programmer coming from other career disciplines and am learning multiple languages right now so play nice and keep it simple please. Interested in simple ...
0
votes
1answer
41 views

SQL TLS termination on Load Balancer

From what I understood TLS is protocol independent of HTTPS and can be used with other protocols as well. For example in order to connect to MS SQL server via encrypted connection I'll have to enable ...
1
vote
1answer
453 views

Postfix + MySQL ENCRYPT() encryption method change

I already have my mail server (postfix, courier, mysql) and roundcube as my webmail client, Encrypt() is the current password encryption function, Is there a way to change the default password ...
2
votes
2answers
103 views

SQL injection using brute force?

I am studying about cyber defense lately for fun and found about a proposed method that as I understand it performs automated SQL injection using brute force by training a model. At some point it says ...
1
vote
2answers
250 views

IP-whitelisting for DB access, does solution fit best practices?

All the data we have on our customers sits in our data-lake, which is hosted by one of our suppliers. Currently the security is such that a limited number of users has (limited) access to the database ...
2
votes
1answer
117 views

Encrypting links between registered users and their sensitive data

I want to make it impractical to link the users to their sensitive data without their passwords – even with a full access to the database. Furthermore, if a user has multiple pieces of sensitive data, ...
1
vote
1answer
265 views

Mysql Information schema column_privileges empty

I can try some SQL-injection against a ad-hoc damn web application in my virtual enviroment for educational purpose. In one of these I obtain the table column_privileges (of Mysql Information schema) ...
0
votes
2answers
142 views

What are the risks of using non-ssl connection between server and (externally hosted) database?

I am building an application using AWS Lambda and using a MongoDB database hosted directly with MongoDB (Atlas). For some reason, I get an error when trying to connect via SSL and I've been working on ...
1
vote
0answers
50 views

When using parameterized SQL queries, is there still any *security* issue with simply blindly accepting user input variables?

Suppose I have this: parameterized_database_call('SELECT * FROM widgets WHERE id = $1', $_GET['widget_id']); The SQL query is parameterized, as I've done for many years now. (I'm trying to repress ...
0
votes
0answers
47 views

How to deal with new clients in a hybrid encrypted database?

I'm working on a private project and I'm not really sure about hybrid encryption. I am not a security expert but just a student. Background: I'm working on a project that uses couchDB as a database in ...
2
votes
2answers
992 views

Are partial passwords a security improvement over full passwords?

With full password authentication, you need to enter the full password every time. With partial password authentication, you're asked for some subset of the password each time, and which characters ...
-1
votes
1answer
227 views

Do websites ever delete data about me and my activities? [closed]

I wanted to know for how long Porn websites retain data about visitors' IP addresses and the specific pages they visit. I wanted to check it for Pornhub, xnxx, and xvideos. However, my country ...
0
votes
1answer
49 views

Should I obscure database primary keys for the frontend even if these ids are uuidv4 Ids?

After reading through the answers of the related question (the same question but about integer primary keys), I was wondering if there is any reason to hash uuidv4 primary keys and sending the hash to ...
0
votes
1answer
81 views

What (aside from the law) prevents cloud-hosting owners from eavesdropping on servers/code?

Given a server hosted on a cloud platform, what would stop the cloud platform owner from stealing the server's data and/or code? As far as I can tell, a motivated cloud owner could retrieve the data ...
1
vote
2answers
211 views

How to not use database identifiers in a URL in the context of a REST API

During my IT school years, I was told that including rows identifiers from a database in the resource URL, in the context of a REST API, is a bad practice. To my understanding, the rationale behind ...
0
votes
1answer
52 views

Can I recover files that I had on windows from a SSD that I converted to apfs (mac) and which method or tool to use?

I had some files that I want to recover from windows, but I formatted the ssd drive to macos (apfs)? Is there a tool or method to recover those files?
1
vote
2answers
178 views

HIPAA data encryption - Is database level encryption is enough?

If the database has a built in encryption possible such as Azure SQL Server's, Transparent Data Encryption (TDE) would this be enough for getting the HIPAA compliance ? Or even before storing any data ...
0
votes
1answer
82 views

Securing my Firebase account

I use a firebase database to store users locations in it (by using GeoFire). Except for this parameter, everything else in the database does not include any information. My problem is that I cannot ...
4
votes
2answers
457 views

Database Security

Would having the IP address and name of my database visible to the public be a security risk? I have hosting with godaddy, a shared hosting plan. When I connect to my DB, via MS-SQL-MS, I can see the ...
20
votes
6answers
43k views

What is the best practice for placing database servers in secure network topologies

I have a classic DMZ architecture: My webserver is placed in the DMZ. The webserver needs to communicate with a database server. This database server is the most critical component of my network as ...
0
votes
0answers
58 views

Saving secrets (API-keys for external application) per user in database (PKI?)

I'm developing a web-app which communicates with an external email message application through its HTTP API. My web-app consists of a JS (Svelte) front-end and a Node.js back-end. Each user on my app ...
0
votes
0answers
25 views

Implications of querying OrientDB directly from front-end

Give that OrientDB exposes a REST HTTP API, and that it seems to have quite a few security features, what are the (especially security) implications of querying OrientDB directly from a front end web ...
0
votes
0answers
83 views

Sanitising data for a flutter application

I am having trouble with some user input security. I have a Flutter app where users can submit comments that can contain text e.g. a-z characters, numbers, symbols and emojis. These are stored in a ...
1
vote
2answers
157 views

What personal data should be encrypted in a database?

I am having trouble answering what seems like a simple question. I was hoping to find a Yep/Nope style list somewhere, but can't seem to find one. What data should be encrypted in a cloud (e.g. AWS/...
0
votes
0answers
76 views

Cryptographic way to detect deleted rows in a database table

I have a web application talking to a PostgreSQL database. My threat model is the following: Attacks must not occur at rest. What i'm afraid of is unwanted deletion of data on a specific table, let's ...
71
votes
4answers
77k views

Is it generally a bad idea to encrypt database fields?

I work on a tiny company, it's literally me (the programmer) and the owner. The owner has asked me to encrypt several fields in a database to protect the customers data. This is a web application that ...
1
vote
0answers
71 views

Keeping data confidential from the system administrator

Problem How do I ensure that I cannot access confidential data manually through the database? Practically speaking, this is a firestore database on google cloud, and I have access to the administrator ...
6
votes
6answers
2k views

What's more vulnerable; the data or the DBMS?

When data breaches occur, is a database always involved? In the case of databases being involved, do hackers figure out how the data is stored and read this or do they just figure out how to make ...
1
vote
1answer
146 views

PCI Compliance for developers accessing a production database for support

As a developer, when an Incident comes in and reaches Tier 3 support (The development team), how can the developers get access to query the Production Database, while remaining PCI Compliant? I'm ...
0
votes
1answer
50 views

What are useful use cases for employing asymmetric cryptography in a database?

I see that many relational database systems offer asymmetric (private/public key) cryptography functions. For example, PostgreSQL offers the pgcrypto module, which supports OpenPGP (RFC 4880) ...
0
votes
2answers
62 views

What can you do to make a hashed token database retrievable at a later date?

I have a table for single use tokens, and one of the columns is a token_digest which contains a bcrypt hash of the access token. Since the token_digest is a salted and hashed version of the plaintext ...
0
votes
0answers
49 views

SQL Injection Doesn't Sanitize But Doesn't Execute Commands

I am currently doing a pentesting on a web application and focusing more on SQL Injection. This company I am pentesting have a functionality in which we are allowed to buy things from the vendors/...
3
votes
2answers
201 views

Is it safe to store data of small company in MySQL database on webhost?

A small company has a big list of customers. The list contains personal information like names, phone numbers, addresses, info (like what products bought) and some small notes. The data is stored at ...
0
votes
2answers
142 views

Is it possible for a database to be impenetrable?

I was wondering if it is possible to create some sort of database that is physically impossible to enter. While creating it, you store some information in it and program it to spit that information ...
0
votes
1answer
139 views

Is it okay to log sql queries for debugging

I was adding logging to my application. And I realized that there are times when I need to debug my sql statements and logging them (at debug logging level of course) would make debugging very easy. I ...
0
votes
1answer
72 views

Is it safe to expose port 22 on a database VM? [closed]

I have seen many answers to this question in different scenarios but I am still unsure of the actual answer. I have a VM in the cloud (Azure), which will be hosting my production database. Is it safe ...
0
votes
1answer
81 views

Virus / malware stored inside database

I have a small network of several Windows 10 machines (all protected by BitDefender 2020 Total Security), one of which acts as server with Firebird database. For some time the database is ...
0
votes
2answers
480 views

sqlmap won't give me results i'm looking for [closed]

I am trying to use sqlmap. Although every time I use it, I just get a response of: [13:39:11] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS [13:39:11] [...
3
votes
0answers
138 views

What is the Meow Attack and how can I guard my databases against it?

Recently, there has been some news articles about unsolicited attacks on unsecured public facing Elastic and Mongo databases. These are commonly being called "Meow" attacks, resulting in ...
1
vote
0answers
50 views

Does Snowflake Data Sharing add any real security?

Snowflake is a cloud database like Google BigQuery or Amazon Redshift. Unlike them, however, it markets a "Secure Data Sharing" feature. They go to some effort (including a full "Data ...

1
2 3 4 5
14