Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

Post reply on HN
Print view View original

171–180 of 463 posts

Re: I Went to SQL Injection Court

#171

Post by arp242 »

SJC_Hacker wrote: post #114
crazygringo wrote: post #83

Earlier quoted context omitted.

Why not? Conceptually, that's literally what it is. Rows of values labeled by columns.

Spreadsheets are poorly structured. Different entries in the same column can have different data types. There is no concept of a superkey, so duplicates are allowed. There is a concept of ordering by row/column number which does not necessarily exist in a DBMS. Querying facilities are generally poor. Now you can kinda fix this by restricing the type of column, etc. but most people don't bother They are good at what t…

For a quick 30-second explanation of what a "databases" and "schemas" even are in the first place for non-technical people, it's more than "good enough", and spreadsheets are the most common example that people are generally already familiar with. Unique keys, typing, etc. really isn't relevant here, especially not in the context of what the court case is about. The important bit to get across is that it's a 2D table with rows and columns, and that's all there is to it (that is: it doesn't include the source code to query it).

Re: I Went to SQL Injection Court

#172

Post by kasey_junk »

kelnos wrote: post #72
lcnPylGDnU4H9OF wrote: post #54

Earlier quoted context omitted.

Yeah, it's obvious the double standard here, then. Curious indeed why they are so adamant to keep the schema/data secret.

Because they know that eventually the data contained in that table is going to be used to support some sort of lawsuit that their parking enforcement activity is biased, and is targeting people of color. It's already ridiculous that they spent several years blocking this request while it went through court. If the plaintiffs spoke to pretty much anyone involved in maintaining the system, or with any of their internal…

There is an explanation for the fight that doesn't involve something nefarious with CANVAS (though I think CANVAS is dodgy from talking with Matt).

The precedent set here will let data journalists (like Matt) setup effectively automated FOIA workflows on _any_ database they can get the name of for a FOIA request. So even if _this_ db isn't dodgy it enables any of them that are to be found quickly.

Or even less cynically, its just going to cost a ton of resources to respond to all those automated FOIA requests.

Re: I Went to SQL Injection Court

#173

Post by butlike »

Terr_ wrote: post #151

> Each spreadsheet has a header row, labeling the columns, like “price” and “quantity” and “name”. A database schema is simply the names of all the tabs, and each of those header rows. This is also how I explain it to my relatives, I'm kind of surprised this analogy (one so direct that it's almost literal) didn't fly with the judges. If database column names cannot be revealed, then shouldn't that mean the state is a…

It's a reverse vlookup

Re: I Went to SQL Injection Court

#174

Post by jbritton »

ajkjk wrote: post #149

This was fine, legally, but I'd be pretty irritated if someone I knew wasted everyone's time on this. The schema clearly is (marginally) useful for hacking, but who cares; it clearly is a file layout also, but who cares; those matter legally but not morally. Morally, this is just dumb: it's not something they really needed, and they're just irritating people and wasting resources for the fun of it. Shameful.

I think a file layout describes the exact arrangement of bytes in a file. A schema is higher level. It describes what is stored, not how it is stored. A database could be one file, or a file per table, or a file per column. Data could be stored across multiple drives.

Re: I Went to SQL Injection Court

#175

Post by lucb1e »

bobsmooth wrote: post #4

What stands out to me about this article is the time between court appearances. Seems like if you want to accomplish anything in court you need to be prepared to spend years of your life on it.

Can confirm this is the case everywhere. Even before taking anything to trial, one can spend months on trying to come up with a mutually agreeable solution, in my case getting seemingly one step further each time¹. I'm not sure I'd not just give up and move on with my life if this dragged on for years and wasn't about something that majorly impacts my life or that of a loved one

¹ Details: it was a warranty case, so first they agreed to repair it, then they didn't do that (but maintained that they were going to, whenever I asked about the status), then they agreed to refund, then they didn't do that, then I set a deadline, they iirc agreed, then they didn't pay, then I included specifics of what my next steps would be (lots of research here, seeing what even my options are and what I can truthfully claim that won't get shot down by a judge later) if they didn't pay before some other deadline (so I showed I was serious now), then the deadline crept up and they finally refunded the day before it would expire and I was frankly disappointed because, by now, I was prepared and ready, and all I got was the original sum that I had paid them. I checked the legal interest rate and changing my demand to include that simply wasn't worth wasting more time on this, and I didn't find any sort of precedent that I could bill any time I provably spent, not even to the value of minimum wage, so any time you invest is just lost free time (which I didn't have much of during that particular year). Protip: scroll down the reviews before buying something worth more than a few tenners from a small store. I wasn't the first person who had to threaten litigation...

Re: I Went to SQL Injection Court

#176

Post by pockmarked19 »

robocat wrote: post #160
pockmarked19 wrote: post #101

Earlier quoted context omitted.

Reminds me that the recently discovered “leak emails using YouTube” exploit kicked off from reading what is essentially, a schema. https://brutecat.com/articles/leaking-youtube-emails

> kicked off from reading what is essentially, a schema. I wouldn't call json a schema. In the HN discussion tptacek replied that "$10,000 feels extraordinarily high for a server-side web bug": https://news.ycombinator.com/item?id=43025038 However his comment assumes monetisation is selling the bug; (tptacek deeply understands the market for bugs). However I would have thought monetisation could be by scanning as man…

> I wouldn't call json a schema.

What you see there is a protobuf, serialized as JSON. If a protobuf definition isn’t a schema, I don’t know what is.

Re: I Went to SQL Injection Court

#177

Post by [deleted] »

ajkjk wrote: post #149

This was fine, legally, but I'd be pretty irritated if someone I knew wasted everyone's time on this. The schema clearly is (marginally) useful for hacking, but who cares; it clearly is a file layout also, but who cares; those matter legally but not morally. Morally, this is just dumb: it's not something they really needed, and they're just irritating people and wasting resources for the fun of it. Shameful.

[deleted]

Re: I Went to SQL Injection Court

#178

Post by Terr_ »

kmoser wrote: post #164
Terr_ wrote: post #151

> Each spreadsheet has a header row, labeling the columns, like “price” and “quantity” and “name”. A database schema is simply the names of all the tabs, and each of those header rows. This is also how I explain it to my relatives, I'm kind of surprised this analogy (one so direct that it's almost literal) didn't fly with the judges. If database column names cannot be revealed, then shouldn't that mean the state is a…

Knowing a spreadsheet header doesn't help an attacker gain access to that spreadsheet in any way. Knowing SQL column names may give an attacker an advantage in accessing a database.

Compare: "Knowing the writing style of current employees may give an attacker an advantage while phishing, therefore, we cannot turn over any memos or emails whatsoever."

Ditto for the org-chart.

Re: I Went to SQL Injection Court

#179

Post by tptacek »

ajkjk wrote: post #149

This was fine, legally, but I'd be pretty irritated if someone I knew wasted everyone's time on this. The schema clearly is (marginally) useful for hacking, but who cares; it clearly is a file layout also, but who cares; those matter legally but not morally. Morally, this is just dumb: it's not something they really needed, and they're just irritating people and wasting resources for the fun of it. Shameful.

No. I'm involved in local government, and on the citizens commission where we keep track of our our municipality (adjacent to Chicago) stores and manages information. I'm acutely familiar with how people are spending their time in these organizations, and what is and isn't a big lift for them.

Increasingly, year over year, more and more information that would previously have been stored in filing cabinets or shared drives is moving into turnkey applications that municipalities buy and enroll all their data in. Those applications are opaque. But almost all of them are front-ends to SQL databases.

Being able to recover schemas from publicly operated databases is vital to keeping public records and data public, rather than de-facto hidden from inquiry.

Matt's suit was anything but a waste of people's time. Hopefully, it'll result in a change to our state law.

Re: I Went to SQL Injection Court

#180

Post by lucb1e »

tptacek wrote: post #89
SkidanovAlex wrote: post #76

While I believe that the city should share the schema, and that the city is effectively argues for security through obscurity, I disagree with the main premise of the article: that knowing SQL schema doesn't help the attacker. If I understand the argument of the author here: > Attackers like me use SQL injection attacks to recover SQL schemas. The schema is the product of an attack, not one of its predicates The auth…

If you specifically log failed database queries, where "failure" means "indicative of SQL injection", then nothing you can do with the schema is going to reduce the signal in that feed --- even a single SQL syntax error would be worth following up on. No, I don't think your logic holds.

> nothing you can do with the schema is going to reduce the signal in that feed --- even a single SQL syntax error would be worth following up on

Syntax errors coming from your web application mean there is a page somewhere with a bugged feature, or perhaps the whole page is broken. Of course that's worth following up on?

Edit: maybe I should add a concrete example. I semi-regularly look at the apache error logs for some of my hobby projects (mainly I check when I'm working on it anyway and notice another preexisting bug). I've found broken pages based on that and either fixed them or at least silenced the issue if it was an outdated script or page anyway. Professionals might handle this more professionally, or less because it's about money and not just making good software, idk

Post reply on HN