[flagged]
The author already said he messed up. What are you adding by saying this?
Occasionally on HN, you will see comments that callout a portion of the article as being particularly important or insightful.
I Went to SQL Injection Court
251–260 of 463 posts
Re: I Went to SQL Injection Court
#252Earlier quoted context omitted.
Hard to say. One of my personal drivers for this lawsuit is a tip I received that said that Chicago has a list of vendors whose tickets are dropped in the back-end. When I requested that info, the city said they had no such list. I trust my source, so having schema information could help figure out the extent and if they were lying.
Earnest question: If you suspect them of lying on the issue, why would you trust them to release the full schema in response to the FOIA request, and not just omit any possibly incriminating columns?
By that logic there's no point investigating any crime or doing any kind of audit. You increase the costs of covering up, and put them in a dilemma - remember this is exactly what brought down Nixon.
Re: I Went to SQL Injection Court
#253Earlier quoted context omitted.
An Excel spreadsheet template is an arrangement of rows/columns/cells which is encoded in a XML document which is encoded in a ZIP file archive.
I don't follow your point.
Yes, it's a file format.
(Kinda a file format inside a file format inside a file format.)
Re: I Went to SQL Injection Court
#254When a law is ambiguous by wording, why do they never ask the people who drafted the law what was intended?
Re: I Went to SQL Injection Court
#255Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...
Matt, you do the Lord's work.
Bear in mind that Matt technically lost this, even with the backing of some of the absolute best civil rights lawyers in the country, Loevy and Loevy, fighting on his behalf. This shows you the absurd difficulty in fighting city hall, especially if you're crazy enough to do it without representation.
The one thing working in our favor is what is proposed in TFA: change the law. Once the state Supreme Court has ruled you're hosed unless you can get an amendment. Illinois has a very strong history of amending its FOIA statute, although a proportion of those changes are to further protect information from disclosure, not always on the side of sunshine.
Another change that needs to happen is strong punishment for bodies who lose these fights. In Illinois this is limited to a "$5000 civil penalty" against the body. What is a civil penalty? It's vaguely defined. They used to throw the money to the plaintiff, but in the later cases I fought they simply awarded the money to the county. As one State's Attorney said to me "I don't care if I lose every case, I just write a check out to myself."
(one final note: be careful what you wish for when you litigate, you can end up with an appellate decision like this that solidifying in law the exact thing you were fighting. It's nobody's fault, but it happens. I ended up with one absurd decision that removed prisoners' rights rather than enhanced them.)
Re: I Went to SQL Injection Court
#256Earlier quoted context omitted.
I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how th…
'); SELECT * FROM logins --
Look everyone, it's Little Bobby Tables.
Re: I Went to SQL Injection Court
#257Earlier quoted context omitted.
To probe for what? How does knowledge of a column name make it easier for me to discern whether a SQL injection vulnerability exists? I've spent a lot of time in my career probing for SQL injection, and I can't remember an instance where my stimulus/response setup involved the table names. SQL injection is a property of a SQL query , not of the schema itself. To have a meaningful chance of blind-one-shotting a query,…
Knowledge of the column names doesn't give you insight into whether a vulnerability exists . It gives you insight into what you can do with a vulnerability, should it exist. For example, if you want to set your account balance to $1 million, you'd need to know the column name in order to generate a valid query. Without advance knowledge of the column name, your job becomes harder.
SQL injection will give you the entire schema anyway. It doesn't help if someone tells you the col names beforehand. I'm more wondering about non-SQL-injection vulns.
Re: I Went to SQL Injection Court
#258> You also generally can't FOIA the source code of programs they run.
Alas, that part should be illegal under FOIA.
Source code should be open source and verifiable. Being exempt from FOIA circumvents public confidence in the government's use of software.
I'd be curious to learn if/where courts have decided such things already.
Re: I Went to SQL Injection Court
#259Earlier quoted context omitted.
Wouldn't admitting this in court pin you with some sort of negligence? (if you knew having a schema revealed would compromise your app in some way).
"Defense in depth" is an easy argument to make. I sure hope I don't have any SQL injection holes, but I can't prove it with 100% certainty.
I can't imagine how the schema would reveal SQL injection holes. Maybe other holes, though. Any poor choices for PKs, dumb use of MD5 computed fields, insecure random, misuse of NULL, weird uniqueness constraints (this also ties back to NULLs), vulnerable extensions, wrong timestamp type, too-small integer type, varchar limits, predictable index speed...
Edit: More NULL, or maybe lack thereof cause they use the string "NULL" instead? https://news.ycombinator.com/item?id=20676904
Re: I Went to SQL Injection Court
#260Earlier quoted context omitted.
Which is why in the ordinary course of a pentest you'd use the SQL injection vulnerability to recover the information in the schema .
Maybe I'm ignorant, but if the account the app is using doesn't have access to the information_schema how do you do this?
I don’t think that’s a very common setup but perhaps I’m just exposing my own ignorance. Just consider the popularity of ORMs. They explicitly load the schema into the application in many cases.