Skip to main content
119 votes

Would removing spaces in a string protect against SQL injection?

No. Removing spaces would not prevent SQL injection, as there are many other ways to make the parser process your input. Lets look at an example. Imagine that you had a url which used user supplied ...
wireghoul's user avatar
  • 5,969
72 votes
Accepted

What is protection ring -1?

The "rings" nomenclature (0-3) you usually see these days started with the requested privilege level field in segment selectors as part of the design of x86 protected mode. Back in the day, it was ...
diagprov's user avatar
  • 2,094
51 votes
Accepted

How to protect printers from being hacked

Don't leave your printer exposing port 9100 to the internet. This large-scale printer attack is nothing new. It's happened previously and is very simple to execute. The attacker likely used Shodan ...
Joe's user avatar
  • 2,764
51 votes
Accepted

Protect API from being tampered?

What if the attacker decides to tamper the "from:id" such that it could send arbitrary messages to anyone from any user? Create a session, and use the session identifier as identifier, not the user ...
vidarlo's user avatar
  • 16.6k
49 votes

Would removing spaces in a string protect against SQL injection?

We're in 2016! SQL injections are a thing of the past unless you use insecure code. Whatever language you use, if you want to prevent any and all SQL injections, use prepared statements or any other ...
Julie Pelletier's user avatar
48 votes

Why did they stop adding physical "write protect" mechanism?

Floppy disks used to have a physical means of preventing writing to them. No software could bypass that, no matter what. It had to be flicked physically and manually by a human being. They didn't. It ...
vidarlo's user avatar
  • 16.6k
27 votes

Protecting firmware .bin from reverse engineering

@Marcus is completely correct about using encryption, and how the key has to be stored somewhere safe and possibly used in conjunction with secure boot. As far as tools go, there are many symmetric ...
multithr3at3d's user avatar
23 votes

How to protect myself online from the government?

If your adversary is a nation state actor, and you need to ask this question on StackExchange, then you're doing it wrong. You cannot be "100% safe" from a determined, powerful adversary. While it's ...
forest's user avatar
  • 67k
18 votes

Protecting firmware .bin from reverse engineering

What you want is impossible; there's no "tool" that can do that. When you encrypt your file, and then only someone in ownership of the key can get the contents – that's the point of ...
Marcus Müller's user avatar
18 votes

Why did they stop adding physical "write protect" mechanism?

The old floppy disk write protect isn't really at the disk level, and doesn't physically prevent writing. It instructs the drive to prevent writing, as it's detected by the drive electronics (on ...
Chris H's user avatar
  • 4,435
17 votes

Would removing spaces in a string protect against SQL injection?

It would limit the problem, but not eliminate it. Consider the following situation: $un = str_replace(" ", "", $_POST["username"]); $pw = hash($_POST["password"]; $sql = "SELECT * FROM users WHERE ...
Anders's user avatar
  • 65.7k
15 votes

Why did they stop adding physical "write protect" mechanism?

Ultimately because on USBs, it was a very niche feature that the vast, vast majority of people didn't care about. It adds complexity (and thus cost) to the drives, it's another component that can fail ...
Gh0stFish's user avatar
  • 13k
13 votes

Would removing spaces in a string protect against SQL injection?

No. Let's say you have this as your SQL: "select * from people where last_name = '" + surname + "'" If I enter: 'OR(1=1)OR'a'=' into the input it turns into: select * from people where last_name = '...
JimmyJames's user avatar
  • 3,069
13 votes

Protect API from being tampered?

Basically, you have to treat every input from the user as potentially malicious. Vidarlo has already mentioned two security issues and how they can be prevented in his answer. I'd also add that the ...
Lukas's user avatar
  • 3,178
13 votes

Why did they stop adding physical "write protect" mechanism?

It is many things... Even if the cost were $0.001 per SD card, at current market, we're talking about a hundreds of thousands (and possibly millions) of dollars extra. The cost is way more - ...
Matija Nalis's user avatar
  • 2,295
12 votes

I have to write down credit card information on paper and send it. How can I minimize my risk?

They shouldn’t be asking you to write down your CVV number at all. Payment Card Industry security standards prohibit merchants from storing that information, and on paper counts. If they can’t process ...
Mike Scott's user avatar
  • 10.3k
12 votes

Protect API from being tampered?

What if the attacker decides to tamper the "from:id" such that it could send arbitrary messages to anyone from any user? Do not use from:id in your API. You already know it from user authenticated ...
Oleg V. Volkov's user avatar
10 votes

CSRF double submit cookie pattern questions

Starting with the questions: Scripts can send CSRF requests (via XMLHttpRequest and fetch), not just forms and implicit GETs of page resources. However, there are very strong limits on what types of ...
CBHacking's user avatar
  • 49.4k
10 votes

Why did they stop adding physical "write protect" mechanism?

In ancient days when people were WOW'd by how many kilobytes your computer had, the write capability could be disabled via a single wire. Modern interfaces and techniques don't lend themselves to that ...
user10216038's user avatar
  • 8,143
9 votes

What is protection ring -1?

Ring -1 is the hypervisor, implemented as Intel VT-x ("Vanderpool") [Wikipedia] or AMD-V ("Pacifica") [Wikipedia].
Thomas Weller's user avatar
9 votes

Why would I protect my computer?

Four threats to data: distortion destruction disruption disclosure Sure, you can do a threat impact analysis and determine that the data on your computer is not worth the effort to protect it. That'...
schroeder's user avatar
  • 131k
9 votes

How to protect printers from being hacked

The attack you link to was against printers which were directly accessible from the internet. If you have a typical home network which is connected to the internet by some DSL or cable router you don'...
Steffen Ullrich's user avatar
8 votes
Accepted

Ring 1 and Ring 2 Memory Protection Architecture

The four ring system was designed by Intel for anyone to use, and Microsoft chose a scheme to simplify development work and provide a faster OS at the cost of some security. As far as Microsoft is ...
phyrfox's user avatar
  • 5,734
6 votes

Disk encryption with OTP to protect source code

Send one of your engineers with the laptop. Rationale: If it's important enough to send a laptop, it's important enough to send a person There will be no problems caused by ad-hoc encryption and lock-...
Law29's user avatar
  • 731
6 votes
Accepted

How does Google protect against scraping?

One "obvious" way that comes to mind (but I have no idea whether Google does this) is it is looking for related requests that a browser would generate after retrieving the main page. A browser will ...
TripeHound's user avatar
  • 1,330
6 votes

Protecting firmware .bin from reverse engineering

In order to prevent reverse-engineering of their Management Engine, Intel used: An obscure CPU architecture (not their own) an exotic compression algorithm with hardware-backed dictionary a less-...
fraxinus's user avatar
  • 3,568
6 votes

Mitigating vulnerabilities in audio libraries that cause physical damage

However, nothing is being done about it at this repo which I think is very irresponsible. Because the "issue" that you're reporting is essentially "users can change the audio volume&...
Gh0stFish's user avatar
  • 13k
5 votes
Accepted

How does software developer protect their code against binary patching?

You can't prevent people toying around with your exe, if you check if it wasn't tempered then they'll patch the code that checks that to. One thing you can do is not distribute the whole program but a ...
Ronan Thibaudau's user avatar
5 votes
Accepted

I have to write down credit card information on paper and send it. How can I minimize my risk?

Privacy.com allows you to generate virtual card numbers which are per-merchant and can have limitations put upon them (e.g., $15/month). They use your checking account as a backend to cover the ...
gowenfawr's user avatar
  • 73k

Only top scored, non community-wiki answers of a minimum length are eligible