Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

Post reply on HN
Print view View original

71–80 of 463 posts

Re: I Went to SQL Injection Court

#71

Post by skissane »

tptacek wrote: post #2

Kurt posted this to troll me. Just know my audience here was, mostly, non-technical people involved in politics in my local Chicagoland municipality. Permit me a PSA about local politics: engaging in national politics is bleak and dispiriting, like being a gnat bouncing off the glass plate window of a skyscraper. Local politics is, by contrast, extremely responsive. I've gotten things done --- including a law passed…

> Local politics is, by contrast, extremely responsive. I've gotten things done --- including a law passed

You live in a country where local governments have the power to make laws… in a lot of other countries they don’t - or, to be more precise, their lawmaking power is extremely limited.

Actually, even in the US, that’s often true too - only local governments with “home rule” can enact laws on any topic (provided it doesn’t contradict state or federal law), those without it can only enact laws on specific topics authorised by the state legislature. Some states grant home rule to all counties and municipalities, others none, others to some but not others (e.g. in Texas a municipality can give itself home rule powers, with approval of its voters, but only once it reaches a population of 5000).

Re: I Went to SQL Injection Court

#72

Post by kelnos »

lcnPylGDnU4H9OF wrote: post #54
chaps wrote: post #42

Earlier quoted context omitted.

Yep, that was done in the FOIA request related to this lawsuit: select utc.column_name as colname, uo.object_name as tablename, utc.data_type as type from user_objects uo join user_tab_columns utc on uo.object_name = utc.table_name where uo.object_type = 'TABLE' https://www.muckrock.com/foi/chicago-169/canvas-database-sch...

Yeah, it's obvious the double standard here, then. Curious indeed why they are so adamant to keep the schema/data secret.

Because they know that eventually the data contained in that table is going to be used to support some sort of lawsuit that their parking enforcement activity is biased, and is targeting people of color.

It's already ridiculous that they spent several years blocking this request while it went through court. If the plaintiffs spoke to pretty much anyone involved in maintaining the system, or with any of their internal infosec people, they would know that there's no real security risk to releasing this information.

They've already spent orders of magnitude more time and money litigating the issue than it would take to just release the information in the first place, so this is clearly not a cost or resourcing issue.

They don't want to release it because they'd prefer it's secret, because secrecy makes it harder for the public to hold them accountable. That's all.

Re: I Went to SQL Injection Court

#73

Post by chaps »

hathawsh wrote: post #51
chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

Kudos to you for enduring through this fight! We can only achieve transparency when people choose not to be complacent. Thank you. What do you think are the next steps?

My first step is to actually finish my post :)

But after that, getting a reasonable law passed to fix this now-broken nonsense.

Re: I Went to SQL Injection Court

#75

Post by [deleted] »

tptacek wrote: post #2

Kurt posted this to troll me. Just know my audience here was, mostly, non-technical people involved in politics in my local Chicagoland municipality. Permit me a PSA about local politics: engaging in national politics is bleak and dispiriting, like being a gnat bouncing off the glass plate window of a skyscraper. Local politics is, by contrast, extremely responsive. I've gotten things done --- including a law passed…

[deleted]

Re: I Went to SQL Injection Court

#76

Post by SkidanovAlex »

While I believe that the city should share the schema, and that the city is effectively argues for security through obscurity, I disagree with the main premise of the article: that knowing SQL schema doesn't help the attacker.

If I understand the argument of the author here:

> Attackers like me use SQL injection attacks to recover SQL schemas. The schema is the product of an attack, not one of its predicates

The author appears to imply that once the vulnerability is found, the schema can be recovered anyway. It is not always the case. It is perfectly viable to find a SQL injection that would allow to fetch some data from the table that is being queried, but not from any other table, including `information_schema` or similar. If all the signal you get from the vunlerability is also "query failed" or "query succeeded, here's the data", knowing the schema makes it much easier to exploit.

> the problem is that every computer system connected to the Internet is being attacked every minute of every day

If you specifically log failed DB queries, than for all the possible injections that such 24/7 attacks would find you have already patched them. The log would then be not deafening until someone stumbles on the actual injection (that, for example, only exists for logged in users, and thus is not found by bots), in which case you have time to see it and patch before the attacker finds a way to actually utilize it.

Knowing schema both expedites their ability to take advantage of the vulnerability, but also increases their chances of probing the injection without triggering the query failure to begin with.

Re: I Went to SQL Injection Court

#77

Post by hot_gril »

tptacek wrote: post #68
hot_gril wrote: post #66

Earlier quoted context omitted.

There's a solid chance that the schema gives away what DBMS is being used. But even if it didn't, I'd still call it a file layout in this context.

So?

So if you have the schema and the DBMS, you probably know how data is arranged in the files ("files" in the filesystem sense).

Re: I Went to SQL Injection Court

#78

Post by CharlesW »

koolba wrote: post #65

> [Public bodies] shall provide a sufficient description of the structures of all databases under the control of the public body to allow a requester to request the public body to perform specific database queries. I sure hope the impact of this is not that government entities switch to schema less databases!

"Schemaless" is like "serverless" in that there's always a schema, even if it's not enforced by the database and instead applied dynamically by the application layer.

Re: I Went to SQL Injection Court

#79

Post by hyperpape »

paulddraper wrote: post #70
hyperpape wrote: post #59

Earlier quoted context omitted.

It literally does not describe a file, and does not literally describe the data layout of anything on disk (though with enough knowledge, you may be able to infer facts about probable layouts).

> does not literally describe the data layout of anything on disk Huh? Depends on the DMBS, but each InnoDB table is a file. And the schema determines the file structure.

> but each InnoDB table is a file.

A table isn't a schema, it is a component of a schema, and most databases don't use InnoDB.

Re: I Went to SQL Injection Court

#80

Post by pchristensen »

tptacek wrote: post #55
pchristensen wrote: post #43

Earlier quoted context omitted.

My real goal is zoning. God speed to you sir! What is your goal wrt zoning?

The categorical elimination of single-family zoning along with any building envelope restrictions that would make as-of-right 3-flats uneconomical.

That would be an outstanding outcome! Is this just for Oak Park, or beyond?
Post reply on HN