Questions tagged [databases]

Security related aspects of databases and database access.

72 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
140 views

What is the Meow Attack and how can I guard my databases against it?

Recently, there has been some news articles about unsolicited attacks on unsecured public facing Elastic and Mongo databases. These are commonly being called "Meow" attacks, resulting in ...
3
votes
0answers
72 views

storing equality and diversity data - is it normally encrypted?

Is it the normative secure practice for databases storing E&D data (ethnicity, for example) on personally identifiable individuals? Assume a system where all other security features are also up ...
3
votes
0answers
116 views

Is it a security risk to send a database primary key to an external system?

I'm registering the devices of my app users with a third-party push notification service. I need to associate each device with its user at the service so that I can target a specific user's devices ...
2
votes
1answer
86 views

Ransomware encryption on opened files

I am wondering if ransomware can encrypt currently opened/locked files by an application? Example: Some application opens files and lock them for manipulation e.g. Database. So I assume that when the ...
2
votes
1answer
118 views

Encrypting links between registered users and their sensitive data

I want to make it impractical to link the users to their sensitive data without their passwords – even with a full access to the database. Furthermore, if a user has multiple pieces of sensitive data, ...
2
votes
1answer
439 views

Is the most recent version of ojdbc7 still vulnerable to CVE-2016-3506?

Looking at the Oracle security advisory page here: https://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Oracle in 2016 disclosed vulnerabilites in their OJDBC7 versions 12.1.0....
2
votes
0answers
523 views

Developping an authentication system between client, server, and CouchDB database

I'm creating a self hosted application which relies on CouchDB to store its data. The client (react) might access the database, which is proxied by the express server to myapp.com/database. The server ...
2
votes
0answers
1k views

SQLMap Strange Dump Result

Using SQLMap in this way: sqlmap -u "xxxxx" --dbms=MySql --dbs --user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0" -D xxxxx -T "#__xxxxx" --columns I am obtaining ...
2
votes
0answers
897 views

Amazon Web Services - Relational Database Service - Security Scan

My company is utilizing AWS for it's infrastructure including Mysql RDS instances for our databases. Everything we have is in a VPC and requires access through our VPN. Our databases are all not ...
2
votes
0answers
66 views

Storing Tenants Cloud Keys In a Database

Imagine you are building a public service where you need to store the customer's cloud credentials(like their aws secret and access keys) in your database to regularly use by your backend services in ...
2
votes
0answers
35 views

Specification Document

I have been asked to research on a certain database then write down a specification document which covers Authentication, Authorization and Encryption. Has anyone ever come across such a documentation?...
1
vote
0answers
25 views

Is there record of a pubilc RDS instance with strong password having been hacked?

I am auditing an AWS account and I found a public RDS instance, that is with public DNS, no Security Group IP connection filtering and in a public Subnet However, the instance has a relatively strong ...
1
vote
0answers
50 views

When using parameterized SQL queries, is there still any *security* issue with simply blindly accepting user input variables?

Suppose I have this: parameterized_database_call('SELECT * FROM widgets WHERE id = $1', $_GET['widget_id']); The SQL query is parameterized, as I've done for many years now. (I'm trying to repress ...
1
vote
0answers
82 views

Keeping data confidential from the system administrator

Problem How do I ensure that I cannot access confidential data manually through the database? Practically speaking, this is a firestore database on google cloud, and I have access to the administrator ...
1
vote
0answers
51 views

Does Snowflake Data Sharing add any real security?

Snowflake is a cloud database like Google BigQuery or Amazon Redshift. Unlike them, however, it markets a "Secure Data Sharing" feature. They go to some effort (including a full "Data ...
1
vote
2answers
213 views

HIPAA data encryption - Is database level encryption is enough?

If the database has a built in encryption possible such as Azure SQL Server's, Transparent Data Encryption (TDE) would this be enough for getting the HIPAA compliance ? Or even before storing any data ...
1
vote
0answers
18 views

Abstract data access to user data in large-scale webservices

I am doing research on large-scale webservices and I am trying to understand what common techniques are to prevent user data being accidentally leaked to other logged in users. Especially where end-to-...
1
vote
0answers
40 views

Does TDE not protect against disk theft?

I read the following on Microsoft's site. Can someone please clarify - "With TDE, is the data stored in my data, log, and backup files protected from a disk theft?" Yes, but only if the files ...
1
vote
0answers
102 views

Is AWS Cognito vulnerable to MITM when using iOS with Lambda and RDS

I'm a bit new to coding backend services. And I'm not sure how to solve this problem. So users in an iOS app can be authenticated with Cognito and afterwards gain the rights to invoke lambda ...
1
vote
0answers
33 views

How to anonymise a numeric data attribute, whilst preserving indexability?

I would like to (1-way) anonymise some bounded, numeric data attributes (e.g. age, optimistically bounded by 0 and 200), whilst still retaining the ability to use the resulting data in an index for ...
1
vote
0answers
45 views

Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?

LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider. Any input would be swell! - A case ...
1
vote
0answers
33 views

How should I secure my database in Microservice architecture

Can someone tell me whether I should secure may connections to the database from my microservice? Should I worry about the communication between my microservice and database?
1
vote
0answers
35 views

Web application secrets protection following code execution

I would like to clarify protection practices for handling database secrets with database connected web application, using Docker containers. The aim is to determine how to protect secrets even if an ...
1
vote
0answers
25 views

Is it possible to open Chrome's databases.db in another MacBook?

According to this post, Chrome passwords are stored in /Users/$USER/Library/Application Support/Google/Chrome/Default/databases/Databases.db. Is it possible for an attacker to copy Chrome passwords ...
1
vote
0answers
294 views

Secure local database or service

I’m trying to secure a database of questions and I wonder if it’s actually possible. There are 2 ways the client (mobile App) can get questions: Local DB within the app. Service that returns ...
1
vote
0answers
72 views

Security practices to securely poll authenticated 3rd party API on behalf of clients

It turns out there is a need for our application to be able to poll data at a specific schedule from external API on behalf of clients. The API can be any rest API that the client would choose. We ...
1
vote
1answer
269 views

Mysql Information schema column_privileges empty

I can try some SQL-injection against a ad-hoc damn web application in my virtual enviroment for educational purpose. In one of these I obtain the table column_privileges (of Mysql Information schema) ...
1
vote
0answers
114 views

Implementation of SQL “LIKE” Operator in Database Outsourcing

Recently, I read some papers about DB Outsourcing that implement aggregate functions over encrypted data. What I want to know, is there a method in DB Outsourcing to implement SQL LIKE operator that ...
1
vote
0answers
72 views

Database was Deleted, Suspected Tampering

So basically at the beginning of the year a database of intellectual property (IP) disappeared at the close of a falling out between some upper-level employees and the executive staff at my company. ...
1
vote
0answers
158 views

how to secure sensitive data from IT administrators?

My team is outsourcing some of its IT management, including the administrative role. Since our income is based on data we store in the DB, I would like to avoid sharing access to it with the ...
1
vote
1answer
464 views

Postfix + MySQL ENCRYPT() encryption method change

I already have my mail server (postfix, courier, mysql) and roundcube as my webmail client, Encrypt() is the current password encryption function, Is there a way to change the default password ...
1
vote
0answers
35 views

Encrypting PKs exposed via an API to protect from DDoS attacks

Here is a simple scenario. I have an endpoint /person/:id that returns persons information from the database. When :id is not known, resource is looked up from the database. A malicious user can use ...
1
vote
0answers
66 views

AWS DMS to use CloudHSM

I have a source database that need to be migrated to another one. This target will be created and integrated with CloudHSM so that the data migrated is encrypted. For migration I am planning to use ...
1
vote
0answers
65 views

Are exposed database names on shared server a security hole?

I was working for a client this week, and they use PostgreSQL database for web applications. They have their database on a shared server. When I connected to the database host with pgAdmin, I was ...
1
vote
0answers
1k views

How does the Facebook App on iPhone access the SMS data from iMessages? What are the details?

(This is not a repeat question to "How is Facebook accessing my iPhone texts in order to recommend friends?", linked below. I wish to know the internal details of how downloading the Facebook app on a ...
1
vote
0answers
240 views

Is there a solution for On-the-fly-encryption with active directory rules & policies?

I am looking at having our servers' sql databases for a few program and documents to be always encrypted on the HDD, but available to AD users. So one or multiple users with the right AD privileges ...
1
vote
0answers
1k views

How to identify column types during sql injection with “union all select” construct?

Situation is following: I have identified sql injection attack vector, and have following information about target table: It has six columns. (Identified using "order by"). I can see output of 3 of ...
1
vote
0answers
1k views

Connecting to postgres with SSL

I need help understanding some basics about the postgres database server and SSL. I am developing a Windows desktop application that will connect to a postgres database, in single user mode, with both ...
1
vote
0answers
117 views

Private data encryption in database in case there is no password

I am currently investigating the architecture of the secure, but user friendly service, which combines storing of sensitive private data together with simple authorization procedure. The approach ...
1
vote
0answers
861 views

Storing private messages in a database

I am creating a portal where users can send private messages (PMs) for a very large audience. So I want to encrypt the messages and store them in the database. But I do not want to ask the users for ...
1
vote
0answers
126 views

Secure 'pg_settings' for PostgreSQL

I have been looking for some kind of hardening guide towards PostgreSQL which I can use for a security audit of a PostgreSQL DB. I came across this url, have checked the same. Anything more to this?: ...
1
vote
0answers
317 views

Security considerations for SQL database with employee data in blob field

With elevated SQL permissions, I am able to export a blob and retrieve a pdf with employee data (SSN) from a SQL Server database. This database is a backend to a third party web app we use internally ...
0
votes
2answers
58 views

Is it possible to hack a database inside of local network by external attacker?

Can an attacker from global network hack a database located on office machine inside of local office network? For example after hacking a router, a gateway or the very machine? Or maybe there is ...
0
votes
0answers
45 views

Does a method exist in which a database can be checked for a certain value but the value not derived?

I want to make a database where I can put ten-digit numbers and it will record it however just by looking at it no one should be able to say what was entered in it. Using that database one should only ...
0
votes
1answer
52 views

public MySQL via XAMPP - security - whitelisting IP's versus VPN

I'm working on app that uses MySQL database on XAMPP Control Panel on Windows. I am concerned about security part. I received advice about connecting to MySQL through VPN so it won't be accessible so ...
0
votes
0answers
60 views

How could I improve the security of my design?

I’m building an open-source notes app using electron. I’ll be using rxdb which uses crypto-js to encrypt fields using AES-256 after getting a passphrase and using pbkdf2 to generate a key. Rxdb is a ...
0
votes
0answers
58 views

What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically

Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues. You want to review your database ...
0
votes
1answer
43 views

SQL TLS termination on Load Balancer

From what I understood TLS is protocol independent of HTTPS and can be used with other protocols as well. For example in order to connect to MS SQL server via encrypted connection I'll have to enable ...
0
votes
0answers
48 views

How to deal with new clients in a hybrid encrypted database?

I'm working on a private project and I'm not really sure about hybrid encryption. I am not a security expert but just a student. Background: I'm working on a project that uses couchDB as a database in ...
0
votes
0answers
74 views

Saving secrets (API-keys for external application) per user in database (PKI?)

I'm developing a web-app which communicates with an external email message application through its HTTP API. My web-app consists of a JS (Svelte) front-end and a Node.js back-end. Each user on my app ...