117

No. Removing spaces would not prevent SQL injection, as there are many other ways to make the parser process your input. Lets look at an example. Imagine that you had a url which used user supplied input unsafely in a query: http://example/index.php?id=1 => SELECT * from page where id = 1 In your example the attacker would use spaces: http://example/index....


83

The ANSSI, French government service in charge of IT security, has published a document providing brief advice to people having to travel abroad. Relevant here are the advisories concerning preparation before travel: Review the applicable company policy, Review destination country applicable laws, Prefer to use devices dedicated to travel (computers, ...


82

There is no method to make WEP uncrackable, or at least secure. So I suggest buying a new router that suports WPA2.


74

There are two different passwords that access different functions. If an attacker has the admin password, then he / she can change the SSID, WiFi password, and any other settings on the WiFi router. To fix: ensure your WiFi security setting is WPA or WPA2. Then change the WiFi password to a long one (at least 12 characters, more is better) with special ...


63

The "rings" nomenclature (0-3) you usually see these days started with the requested privilege level field in segment selectors as part of the design of x86 protected mode. Back in the day, it was possible to make exclusive sections of the memory space called segments. In "real mode" it was necessary since you only had 20-bit addressable memory. When ...


59

First off, I want to say that just because a company is big doesn't mean their security will be any better. That said, I'll mention that having done security work in a large number of Fortune 500 companies, including lots of name-brands most people are familiar with, I'll say that currently 60-70% of them don't do as much as you'd think they should do. Some ...


56

Many applications make futile attempt to foil keyloggers and spyware by using convoluted (and cumbersome) password entry methods. None work against keyloggers and many actually cause users to be LESS secure because they make it hard to use password managers. The best way to handle that kind of things is to use one-time passwords. There are several ways to ...


50

As with many well-designed systems, the package system of Debian has defense in depth: multiple layers, each of which can be verified. How do we trust the package file is what the system promises? The hash value is computed and compared against the stored value. How do we trust the hash value isn't accidentally matching some other file? Multiple hash ...


50

Don't leave your printer exposing port 9100 to the internet. This large-scale printer attack is nothing new. It's happened previously and is very simple to execute. The attacker likely used Shodan to scan the entire internet for printers with port 9100 open to the internet. Due to way RAW printing over port 9100 works, all is required after this is to ...


49

Any Faraday cage will do the trick. So a shielding of just about anything conductive, be it aluminum foil, conductive paint, wire mesh, or any of a number of similar alternatives is going to be opaque to radiation. That means no radio waves in or out, which means the RFID signal is blocked. Note that the size of the mesh has to be significantly smaller than ...


48

We're in 2016! SQL injections are a thing of the past unless you use insecure code. Whatever language you use, if you want to prevent any and all SQL injections, use prepared statements or any other type of data binding. Prepared statements separate the query from the data, making it impossible for the data to affect the query. To directly answer your ...


44

In most password-protected systems it usually is possible, but very unlikely. Behind many password validation mechanisms is the use of salted hash functions. For the sake of simplicity, let's forget about salt for a moment. When a user sets its password, hash(password) is stored in the database When the user logs in presenting password', hash(password') ...


40

There is really only one solution to your problem. I do note however that you're not interested in upgrading your router, so I will talk a little about that. Remember that by not upgrading your router, you are only delaying the inevitable. What will work long enough for you to get a new router: PULL THE PLUG This is honestly the best solution until you ...


28

Disclaimer: I work for a very big company that does a good job in this area, but my answer is my own personal opinion and is not indicative of my employer's position or policies. First of all, how to protect code from being leaked: Network Security: This is the obvious one -- if Chinese hackers get credentials into your internal systems, they'll go for ...


23

If your adversary is a nation state actor, and you need to ask this question on StackExchange, then you're doing it wrong. You cannot be "100% safe" from a determined, powerful adversary. While it's fallacious to say "if they want you, they'll get you", it is true that you cannot be 100% safe from any powerful adversary. They will always have 0days that you ...


21

You are right in that one of the ways an attacker could intercept the code is to hack your phone. An attacker could also: Clone your phone's sim, and request a banking code to be sent to your phone's number. they could also possibly clone a non-sim phone as well Steal your phone. Once they have your phone they could perform transactions Perform a man in the ...


19

A useful and practical guide to securing information devices when crossing borders is provided by the Canadian Bar Association here. I would not say the U.S. border is the only one of concern, others such as China might eventually become similarly aggressive (though I've seen little sign of that to date). The guide echos many of the points made in other ...


18

Next time you go to the shop leave your card in your wallet and try as much as you can to pay for your purchase. Try with several different card readers to be sure. If you can't pay, then it's pretty well protected. If you can, well... I can't speak for that particular wallet but it is certainly possible to block RFID in that manner. It just depends if they ...


18

You've already taken the most important first step to protecting yourself, and that it to recognize that caller-id information can be spoofed, and is not entirely trustworthy. The second step is to apply that knowledge, and stop relying on caller-id. If someone calls you and asks for personal information, even if the caller-id appears to be the legitimate ...


18

The best way to protect against that type of border search is actually not to have anything suspicious on the hardware you take through the custom. Using encryption technology will most likely raise suspicion in the first place. Refusing to provide the necessary codes can, in some places, leads to the hardware being confiscated or even to you being arrested....


17

It would limit the problem, but not eliminate it. Consider the following situation: $un = str_replace(" ", "", $_POST["username"]); $pw = hash($_POST["password"]; $sql = "SELECT * FROM users WHERE username = '$un' AND password = '$pw'"; Lets say I post the username admin'--. That would log me in as admin, without using a single space. As wireghoul points ...


16

SSL Connection to the server so no one can sniff passphrases or data over the network. Don't forget your backup: it should be encrypted too. The key should be stored independently so if someone gains access to the backup he cannot use the data. Depending on your country of residence there can be legal requirements for health data protection. Manage access ...


16

If you were dealing with keyloggers in isolation, then it might be possible to mitigate the risk (e.g. using on-screen keyboards, 2FA or similar), however if an attacker has the ability to install a keystroke logger on the system it is very likely (apart from physical keystroke loggers) that they have privileged access to the system in question and as such ...


15

There have been some other good answers here, but there are some other measures that can be useful too. In fact, not all of these are particularly technical. As others have pointed out, adding a passcode to your iPad will allow for full system encryption, which prevents anyone from stealing data from the device. Combining this with auto-lock and auto-wipe ...


15

In addition to what Philipp said, keep in mind that SQL injection attacks are quite often done without knowing the structure of the DB, but once a vulnerability is exposed, it can be used to determine the structure. For example, one of the first SQL injection string that was once taught used to be ';shutdown-- This makes an assumption that the data user ...


14

Full disk encryption is the most common one used. The cost would depend on the time which needs to be implemented by the IT department ontop of normal laptop staging. However in my experience FDE is a must for any organization taking its security serious. Aside from that there are also some really anti-forensic tools, I remember a talk at Brucon where one ...


14

No. You cannot make WEP uncrackable, but there are some things you may be able to do to help the problem until you get a new router. Modify the signal strength. Take off one (or more) antennas from your router (if you have a small apartment). Move your router to the center of your home. These steps may make it more difficult for a neighbor to get a decent ...


14

Ok I am changing my answer after reading all the comments. You need to understand the basics: SSID = The SSID is the name of the wireless broadcast from your router. This is not a username. If the person keeps getting in then its possible your security is not WPA2 like you think it is. or your password for the wifi is really weak or common. try a randomised ...


13

I have two solutions. Both require Full Disk Encryption (FDE). First Solution Credit to Bruce Schneier. Just before leaving home, create a second key. Type it with your forehead, a cat or dog, just so it's random and not possible to remember. Send the second key to a trusted person, preferably someone with a privileged relationship, i.e. lawyer, priest/...


13

No. Let's say you have this as your SQL: "select * from people where last_name = '" + surname + "'" If I enter: 'OR(1=1)OR'a'=' into the input it turns into: select * from people where last_name = ''OR(1=1)OR'a'='' Which executes in Oracle and MySQL (at least) and returns all the rows from the table.


Only top voted, non community-wiki answers of a minimum length are eligible