Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

Post reply on HN
Print view View original

161–170 of 463 posts

Re: I Went to SQL Injection Court

#161

Post by kmoser »

copypasterepeat wrote: post #58
Y_Y wrote: post #53

Is it not absurd that the supreme and appeal courts disagreed on a syntactical matter? Never mind that this isn't uncommon, or that (IMHO) it would be ridiculous to interpret it as "any file layouts at all, and other stuff too, but only bad other stuff". It's crazy to me that were happy for laws to sit on the books being utterly ambiguous. I know this suits the courts who benefit from the leeway, and that (despite va…

I am not a lawyer, but my understanding is that's just how the justice system works. Reasonable people can disagree about what exactly a complicated statement says, since language is full of ambiguities. People have been discussing what the U.S. Constitution says exactly from the day it was written and there are still a lot of disagreements. The standard response to this is that laws should be written in ways that ar…

Nobody reasonably expects all laws to be written completely unambiguously. But since laws (and indeed all manner of legal documents) are filled with lists and modifiers, I don't think it's unreasonable to require that they be written to a certain standard which defines how these lists and modifiers should be interpreted, similar to RFC 2119 https://microformats.org/wiki/rfc-2119.

Re: I Went to SQL Injection Court

#162

Post by lq9AJ8yrfs »

In the new language proposed in SB0226 (as linked, didnt search for authoritative sources, can't tell how durable that link will be for posterity, arrgh archiving the web is hard etc), doesn't that language leave open a hole for excessive complexity to be a reservoir for FOIA resistance?

Feels like there is an important theme here that SB0226 is dancing around --could government be legible in addition to being "plain-text" transparent?

"plain-text description" of "each field of each database of the public body" and "specific database queries" may not do what you mean.

Not sure how to fix it though.

I could see gratuitous ORMs and database-of-databases patterns winning tax dollars with taunt-them-with-the-schema listed as a feature.

Re: I Went to SQL Injection Court

#163

Post by tptacek »

pchristensen wrote: post #152
tptacek wrote: post #87

Earlier quoted context omitted.

You'd hope that Oak Park, Evanston, Wilmette, and then Berwyn and Schaumburg could get this done, and then your next step would be either Chicago (tough because of aldermanic structure) or statewide, the way California did. Either way: you start in one municipality and work from there. It helps that zoning matters more in Oak Park (and Evanston) than almost anywhere else in Chicagoland.

Why does zoning matter more in Oak Park and Evanston? High demand from being on the El and close to Chicago?

Yep. Historically both of these places basically exist to concentrate the interests of the upper middle class and to reinforce segregation. They're both basically Chicago but with a better funded school system (because lawyers and doctors get to funnel all their property taxes into the school down the street from them), which makes them highly desirable.

Re: I Went to SQL Injection Court

#164

Post by kmoser »

Terr_ wrote: post #151

> Each spreadsheet has a header row, labeling the columns, like “price” and “quantity” and “name”. A database schema is simply the names of all the tabs, and each of those header rows. This is also how I explain it to my relatives, I'm kind of surprised this analogy (one so direct that it's almost literal) didn't fly with the judges. If database column names cannot be revealed, then shouldn't that mean the state is a…

Knowing a spreadsheet header doesn't help an attacker gain access to that spreadsheet in any way. Knowing SQL column names may give an attacker an advantage in accessing a database.

Re: I Went to SQL Injection Court

#165

Post by jaxgeller »

davethedevguy wrote: post #145
jaxgeller wrote: post #88

I FOIA'ed >1M pages of docs for my project cleartap.com, a DB of water quality of the USA. Most states would charge a small amount to gather the documents. Michigan wanted $50K to for the FOIA request. I think because of the Flint lead crisis. They wanted me to go away.

I noticed that you do have data for Flint. Did you have to pay it, or is there some appeals process if you're quoted an unreasonable amount? Great project by the way!

Ended up finding the majority of Michigan through scraping.

For example, https://www.cityofflint.com/wp-content/uploads/2023/06/Annua...

Re: I Went to SQL Injection Court

#166

Post by butlike »

doctorpangloss wrote: post #50
chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

What are the administrators of CANVAS hiding?

'ethnicity' header, 'net_income' header... wouldn't doubt chicago could be cave man enough to do this

Re: I Went to SQL Injection Court

#167

Post by default-kramer »

tptacek wrote: post #129
kmoser wrote: post #126

Earlier quoted context omitted.

I don't understand your logic. Knowledge of the schema can give an attacker an edge because they now know the exact column names to probe. Whether these probes get logged is irrelevant; even if it makes the system more vulnerable for an instant, it's still more vulnerable. Even if logging failed queries is your metric, then knowledge of column names would make it more likely for an attacker to craft correct queries,…

To probe for what? How does knowledge of a column name make it easier for me to discern whether a SQL injection vulnerability exists? I've spent a lot of time in my career probing for SQL injection, and I can't remember an instance where my stimulus/response setup involved the table names. SQL injection is a property of a SQL query , not of the schema itself. To have a meaningful chance of blind-one-shotting a query,…

> How does knowledge of a column name make it easier for me to discern whether a SQL injection vulnerability exists?

It doesn't. It just means that as soon as you find one, you can immediately begin crafting valid queries instead of randomly guessing table names and columns, therefore not setting off the "DB query failed" alert.

EDIT: I guess this is the part I missed:

> To have a meaningful chance of blind-one-shotting a query, getting a TRUE/FALSE answer about susceptibility without ever generating a SQL syntax error, I would need to see the queries themselves.

Really? I guess I have to take your word for it because I've never attempted it, but I would have thought that in some (horribly broken) systems `bobby tables' or 1=1 --` would have a very reasonable chance of detecting SQL injection without alerting anyone.

Re: I Went to SQL Injection Court

#168

Post by mbreese »

foota wrote: post #144
chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

Out of curiosity, could you ask for something like "one row of data from every table in the CANVAS database"?

This is a technical solution to a people problem. My reading is that the city doesn’t want to give up this information. If that’s the case, a technical solution wouldn’t work, no matter how easy it is. And given that this has already gone to the Illinois Supreme Court (and lost), the only solution is what is discussed at the end: updating the law.

Re: I Went to SQL Injection Court

#169

Post by butlike »

Volundr wrote: post #155
SkidanovAlex wrote: post #76

While I believe that the city should share the schema, and that the city is effectively argues for security through obscurity, I disagree with the main premise of the article: that knowing SQL schema doesn't help the attacker. If I understand the argument of the author here: > Attackers like me use SQL injection attacks to recover SQL schemas. The schema is the product of an attack, not one of its predicates The auth…

I'm not an attacker, just a boring old software dev. If there's an SQL Injection I'd say all bets are off re: schema. That said I've definitely worked on applications where knowing the schema could help you exfill data in the absence of a full injection. The most obvious being a query that's constructed based on url parameters, where the parameters aren't whitelisted. So I actually do agree that the schema could pote…

Wouldn't admitting this in court pin you with some sort of negligence? (if you knew having a schema revealed would compromise your app in some way).

Re: I Went to SQL Injection Court

#170

Post by [deleted] »

tptacek wrote: post #140
alexashka wrote: post #137

Wowzers, that was a lot of words to express something that's very simple. A database schema is just an empty form. By looking at an empty form, you know what fields have be filled in, what type of information they'll contain, etc. Of course people making data requests need to know what forms are being used to collect and store information. As for security - not letting people do anything because 'it might be dangerou…

The whole back half of the post is about why the analysis is not as simple as you suppose it is. We had no trouble establishing at Chancery Court that schemas don't endanger security. That's not why the case failed at the Illinois Supreme Court. The IL Supremes did not decide spontaneously that schemas actually are dangerous.

[deleted]
Post reply on HN