Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

Post reply on HN
Print view View original

291–300 of 463 posts

Re: I Went to SQL Injection Court

#291

Post by wglb »

SkidanovAlex wrote: post #76

While I believe that the city should share the schema, and that the city is effectively argues for security through obscurity, I disagree with the main premise of the article: that knowing SQL schema doesn't help the attacker. If I understand the argument of the author here: > Attackers like me use SQL injection attacks to recover SQL schemas. The schema is the product of an attack, not one of its predicates The auth…

> "query failed" or "query succeeded, here's the data"

Blind SQL injection is a type where no error is produced, but some subtle signal can indicate success or failure. The most interesting one that I know about is where the presence of a successful injection was a normal looking response that was one byte longer than an unsuccessful injection. This was used to not only figure out the schema, but to fully exfiltrate the entire database.

There is nothing in the log on the server that indicates an error.

Most of the relatively introductory SQL injection exercises that I taught proceed without any knowledge of the schema.

This is why SQL injection is so insidious.

Re: I Went to SQL Injection Court

#292

Post by hunter2_ »

tptacek wrote: post #283
aqueueaqueue wrote: post #279

Earlier quoted context omitted.

Oh wow! If that is necessary, that is so kafkaesque! "I want your data" "What data?" "What do you have?" "Ha ha. No. Tell me what you want" "Your data that is the metadata of your data" "Well actually..." ...

You can't ask public bodies to do research for you. That's the public policy balance in our FOIA laws: you can get almost anything (and: talk to Matt, you really can get a lot of stuff), but you have to be specific about what you're asking for, and it has to be "at hand" for the staff responding to the request.

Clerks fielding FOIA requests have SQL consoles "at hand"?

Re: I Went to SQL Injection Court

#293

Post by monksy »

chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

What I want to know: How much malort does the city expensive a year?

Re: I Went to SQL Injection Court

#294

Post by inetknght »

jaza wrote: post #272
inetknght wrote: post #258

> You also generally can't FOIA the source code of programs they run. Alas, that part should be illegal under FOIA. Source code should be open source and verifiable . Being exempt from FOIA circumvents public confidence in the government's use of software. I'd be curious to learn if/where courts have decided such things already.

I assume that - even though there's a strong public interest argument for it - government orgs are prone to blanket banning the release of source code, for the same primary reason that businesses are prone to doing so. That is, too high a chance of sensitive data (passwords, tokens, IP addresses, etc) being hard-coded in all-too-often non-12-factor-aspiring code; and too much security / liability headache if said sen…

> maybe there's software talking to that database, whose source code includes the logic of picking when / where parking inspectors should conduct a "random" blitz of issuing fines.

Oh yes, and that "random" blitz of issuing fines definitely doesn't have any racist part to its algorithm. Just trust the government on that one. The government and the "business" what wrote the code in the first place. Yup, makes sense.

Re: I Went to SQL Injection Court

#295

Post by tptacek »

hunter2_ wrote: post #290
tptacek wrote: post #248

Earlier quoted context omitted.

Lots of things are "of value". That's not the bar the statute sets. To the extent something isn't per se exempted by the statute (as the outcome of the case established schemas are), the burden is on the public body to demonstrate that disclosure Would jeopardize the security of the system.

It still seems like a massively gray area: despite the distinction between "would jeopardize" and "could jeopardize" as explained by TFA, the definition of "jeopardize" includes "danger" which means "could lead to harm" not "would lead to harm" at which point it hardly matters whether a thing "could endanger" or "would endanger" the security of the system.

"Would" versus "could" has nothing to do with why your analysis doesn't hold. If something doesn't enable people to attack a system, but is merely one of the valuable things you could get from that system, it does not jeopardize that system under Illinois law. The standard of proof for the jeopardy doesn't enter into it, because no claim of jeopardy has been made.

Again: this part of the case is settled. We didn't lose at the State Supreme Court because the court was worried there was jeopardy, but because they re-read the statute as per se exempting schemas as "file layouts".

Re: I Went to SQL Injection Court

#296

Post by tptacek »

hunter2_ wrote: post #292
tptacek wrote: post #283

Earlier quoted context omitted.

You can't ask public bodies to do research for you. That's the public policy balance in our FOIA laws: you can get almost anything (and: talk to Matt, you really can get a lot of stuff), but you have to be specific about what you're asking for, and it has to be "at hand" for the staff responding to the request.

Clerks fielding FOIA requests have SQL consoles "at hand"?

They send emails to IT. The classic example of a thing you can get through FOIA is large-scale dumps of emails from Exchange Servers, which is also not something a Clerk can do themselves, but which IT staff can immediately retrieve.

Leave the "Clerk" bit of this out and just imagine you're requesting straight from the IT department. What you can do: get anything not otherwise exempt that they know how to retrieve (it usually helps to provide example commands in the requests). What you cannot do: ask them to go look around and see what they have. That's research. Research is your job, not theirs, under Illinois FOIA.

Re: I Went to SQL Injection Court

#298

Post by hunter2_ »

tptacek wrote: post #296
hunter2_ wrote: post #292

Earlier quoted context omitted.

Clerks fielding FOIA requests have SQL consoles "at hand"?

They send emails to IT. The classic example of a thing you can get through FOIA is large-scale dumps of emails from Exchange Servers, which is also not something a Clerk can do themselves, but which IT staff can immediately retrieve. Leave the "Clerk" bit of this out and just imagine you're requesting straight from the IT department. What you can do: get anything not otherwise exempt that they know how to retrieve (i…

If research is my job, and looking around is research, then couldn't I look around and see what they have instead of asking them to do so?

Re: I Went to SQL Injection Court

#299

Post by rnewme »

chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

The footer links to dead x account.

Re: I Went to SQL Injection Court

#300

Post by valenterry »

wglb wrote: post #287
dataflow wrote: post #223

Earlier quoted context omitted.

This fails if either the UI sanitizes wildcards, or if the database prohibits them, or if it produces so much data that you can't ingest it in time, etc.

Sanitization almost always fails. This becomes an arms race.

If you do it wrong, yes. Sure, there is no 100% security, but honestly, it's 2025. We already know the techniques how to prevent SQL injection of any kind. I wrote about this here: https://valentin.willscher.de/posts/sql-api/
Post reply on HN