I Went to SQL Injection Court • Hacker News Board

Re: I Went to SQL Injection Court

#211

Post by IshKebab » Tue, Feb 25, 2025, 11:20 PM UTC

dataflow wrote: post #194

chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how th…

'); SELECT * FROM logins --

Re: I Went to SQL Injection Court

#212

Post by ic4l » Tue, Feb 25, 2025, 11:22 PM UTC

IshKebab wrote: post #211

dataflow wrote: post #194

Earlier quoted context omitted.

I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how th…

'); SELECT * FROM logins --

`Especially in a database that doesn't allow wildcards`

Re: I Went to SQL Injection Court

#213

Post by b8 » Tue, Feb 25, 2025, 11:23 PM UTC

Got to see this happen day by day on the Midwest Venture Partners Slack. There was another lawsuit Chappman and Tom did for laser based speed detection in Chicago.

Re: I Went to SQL Injection Court

#214

Post by Muromec » Tue, Feb 25, 2025, 11:24 PM UTC

Y_Y wrote: post #48

hinkley wrote: post #14

Earlier quoted context omitted.

“Never doubt that a small group of thoughtful, committed citizens can change the world: indeed, it's the only thing that ever has.” - Margaret Mead

Like a hedge fund? Or are we including those committed to violence?

Would would you ever exclude ones committed to violence? Violence consistently works.

Re: I Went to SQL Injection Court

#215

Post by lIl-IIIl » Tue, Feb 25, 2025, 11:24 PM UTC

ic4l wrote: post #210

dataflow wrote: post #194

Earlier quoted context omitted.

I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how th…

I agree with you. Knowing the exact column names can speed up an attack and, in some cases, make it more feasible. Why don’t they just request disclosure of what’s actually stored and allow renaming of the columns? It seems odd that knowing the exact column names would be necessary if the goal is simply to understand what data is being stored and its intended purpose.

I wonder if that would be considered a "new report", which they don't have to provide.

Re: I Went to SQL Injection Court

#216

Post by chaps » Tue, Feb 25, 2025, 11:24 PM UTC

dataflow wrote: post #194

chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how th…

The Department of Justice disagrees and voluntarily releases column and table names: https://www.justice.gov/afp/media/1186431/dl?inline=

Re: I Went to SQL Injection Court

#217

Post by tczMUFlmoNk » Tue, Feb 25, 2025, 11:25 PM UTC

dataflow wrote: post #194

chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how th…

You can always `SELECT table_name, column_name, data_type FROM information_schema.columns`, which is part of the SQL standard. https://www.postgresql.org/docs/current/infoschema-columns.h...

Plus, generally if you have SQL injection, you have multiple tries. You're not going to be locked out after one shot. And there's only so many combinations of `SELECT {id,userid,user_id,uid} FROM {user,users,login,logins,customer,customer}` before you find something useful.

Re: I Went to SQL Injection Court

#218

Post by djeastm » Tue, Feb 25, 2025, 11:27 PM UTC

I suppose I need to change all my column names to random 16-character strings so I don't leave my database insecure!

Re: I Went to SQL Injection Court

#219

Post by philipov » Tue, Feb 25, 2025, 11:34 PM UTC

lIl-IIIl wrote: post #215

ic4l wrote: post #210

Earlier quoted context omitted.

I agree with you. Knowing the exact column names can speed up an attack and, in some cases, make it more feasible. Why don’t they just request disclosure of what’s actually stored and allow renaming of the columns? It seems odd that knowing the exact column names would be necessary if the goal is simply to understand what data is being stored and its intended purpose.

I wonder if that would be considered a "new report", which they don't have to provide.

They can either have their cake or eat it. If they don't want to obfuscate the column names, they have to provide the data with the original ones.

Re: I Went to SQL Injection Court

#220

Post by 0x457 » Tue, Feb 25, 2025, 11:34 PM UTC

Y_Y wrote: post #48

hinkley wrote: post #14

Earlier quoted context omitted.

“Never doubt that a small group of thoughtful, committed citizens can change the world: indeed, it's the only thing that ever has.” - Margaret Mead

Like a hedge fund? Or are we including those committed to violence?

It's about that it's a small-dedicated group that brings change and not government or private institution. If it's still hard to grasp, then think about how national movements started.