Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

Post reply on HN
Print view View original

301–310 of 463 posts

Re: I Went to SQL Injection Court

#301

Post by tptacek »

hunter2_ wrote: post #298
tptacek wrote: post #296

Earlier quoted context omitted.

They send emails to IT. The classic example of a thing you can get through FOIA is large-scale dumps of emails from Exchange Servers, which is also not something a Clerk can do themselves, but which IT staff can immediately retrieve. Leave the "Clerk" bit of this out and just imagine you're requesting straight from the IT department. What you can do: get anything not otherwise exempt that they know how to retrieve (i…

If research is my job, and looking around is research, then couldn't I look around and see what they have instead of asking them to do so?

Maybe? If you work there, I guess? Or if you're really nice to them? But they're under no obligation to help you. The tradeoff in Illinois (and most other good FOIA law): you can get almost anything you want --- way more than most people think --- but you can't get public staff to go do research work for you.

Again: this is why pulling schemas is so valuable.

Re: I Went to SQL Injection Court

#302

Post by [deleted] »

chaps wrote: post #184
foota wrote: post #182

Earlier quoted context omitted.

I agree this is something of a technical solution, but the court wasn't interpreting whether you could ask for rows from a database, but whether you could ask for the schema directly. I don't think the court had the option of saying "you can't ask for the schema, but asking for a sample row is ok".

The short answer is yes, you can do this. I've seen this work for emails, where the request is basically, "Give me the most recent email of blah@gov.com". And yeah, the plan was to eventually submit a batch of requests using the table names, similar to `SELECT * FROM {table_name_from_schema_request} LIMIT 1`, but one FOIA request per-table.

[deleted]

Re: I Went to SQL Injection Court

#303

Post by Terr_ »

flutas wrote: post #209
kmoser wrote: post #164

Earlier quoted context omitted.

Knowing a spreadsheet header doesn't help an attacker gain access to that spreadsheet in any way. Knowing SQL column names may give an attacker an advantage in accessing a database.

Per the post, this also wouldn't fly. > Believe it or not, there’s case law on “would” versus “could” with respect to safety. “Could” means you could imagine something happening. But the legal standard for “would” is “clear evidence of harm leaving no reasonable doubt to the judge”. The statute set the bar for me very low and I managed to clear it.

Reminds me of Shall versus May in RFCs. (Though those are, of course, statements of obligation rather than natural consequence.)

Re: I Went to SQL Injection Court

#304

Post by neilv »

> [...] where the only way to get at the underlying data is to FOIA a database query.

Can you request the desired information using natural language, based on your guesses of what information they store?

Re: I Went to SQL Injection Court

#305

Post by dmurray »

tptacek wrote: post #295
hunter2_ wrote: post #290

Earlier quoted context omitted.

It still seems like a massively gray area: despite the distinction between "would jeopardize" and "could jeopardize" as explained by TFA, the definition of "jeopardize" includes "danger" which means "could lead to harm" not "would lead to harm" at which point it hardly matters whether a thing "could endanger" or "would endanger" the security of the system.

"Would" versus "could" has nothing to do with why your analysis doesn't hold. If something doesn't enable people to attack a system, but is merely one of the valuable things you could get from that system, it does not jeopardize that system under Illinois law. The standard of proof for the jeopardy doesn't enter into it, because no claim of jeopardy has been made. Again: this part of the case is settled. We didn't lo…

> this part of the case is settled.

Maybe for this case, but it sounds like enough hinges on the details of the system that in another database, a court could uphold that there "would" be jeopardy instead of there "could" be. So you won on the more fragile part of the ruling.

On the other hand, interpreting the law as exempting database schemas is something that can be applied to any computer system, and it presumably sets a binding precedent (I'm not familiar with Illinois jurisprudence, but that's how I'd expect something called the State Supreme Court to work) so losing on that point is worse for future cases.

Re: I Went to SQL Injection Court

#306

Post by dmurray »

lmm wrote: post #247
dmurray wrote: post #234

Earlier quoted context omitted.

And this part seems self-defeating: > Attackers like me use SQL injection attacks to recover SQL schemas. The schema is the product of an attack, not one of its predicates”. If it's the product of an attack, but not the end goal, surely it's of value to the attacker? It seems clear to me that the statute does, as worded, in principle allow the city not to disclose the database schema - it would compromise the securit…

> If it's the product of an attack, but not the end goal, surely it's of value to the attacker? Well sure, but it doesn't help them attack. That's like arguing that since the bank robber wants dollar bills, dollar bills must be a useful tool for breaking into bank vaults.

If both sides agreed to the analogy of giving the bank robber the blueprints to the vault, I think any lay judge would agree that endangers the bank's security.

Re: I Went to SQL Injection Court

#307

Post by AdamJacobMuller »

dataflow wrote: post #194
chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how th…

> And I don't think I disagree with the court on schema vs. file layouts either.

I disagree that the law should prohibit disclosing "file layouts" but it's pretty clear that the law does block that, and I fundamentally agree with you that schemas are directly analogous to file layouts and thus restricted.

Re: I Went to SQL Injection Court

#308

Post by snickell »

closeparen wrote: post #269
Waterluvian wrote: post #236

Earlier quoted context omitted.

On the surface that’s a very attractive idea. A sort of “you shouldn’t be in here, even if we left the door unlocked.”

So if you deploy code before you run the associated db migration, or misspell a column name, you magnify the impact from whichever code paths (& application tier nodes) are running the broken SQL, to your entire production environment.

Simple variation to a hard shutoff: immediately page "significant risk a successful sql exploit was found", and then slow down attackers:

If an SQL query requests an unknown table, log the error, but have that query time out instead of responding with an error. Or, even better, the offending query appears to succeed, but returns fake table data, turning it into a honeypot built-in to the DB. This could be done at the application layer, or in the DB.

The goal is to buy an hour for defenders to determine how to respond, or if its a red herring. There are a variety of ways of doing this without significant user impact.

Re: I Went to SQL Injection Court

#309

Post by lmm »

dmurray wrote: post #306
lmm wrote: post #247

Earlier quoted context omitted.

> If it's the product of an attack, but not the end goal, surely it's of value to the attacker? Well sure, but it doesn't help them attack. That's like arguing that since the bank robber wants dollar bills, dollar bills must be a useful tool for breaking into bank vaults.

If both sides agreed to the analogy of giving the bank robber the blueprints to the vault, I think any lay judge would agree that endangers the bank's security.

I'd say it's more like knowing the layout of the drawers inside the cage. If a robber is inside the cage, they've already won. And if an auditor is checking the bank has what it says it does, they've got legitimate grounds to ask which money is in which drawer, and "no, it's a security risk" is not a good answer.

Re: I Went to SQL Injection Court

#310

Post by tptacek »

AdamJacobMuller wrote: post #307
dataflow wrote: post #194

Earlier quoted context omitted.

I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how th…

> And I don't think I disagree with the court on schema vs. file layouts either. I disagree that the law should prohibit disclosing "file layouts" but it's pretty clear that the law does block that, and I fundamentally agree with you that schemas are directly analogous to file layouts and thus restricted.

A SQL schema literally does not indicate the locations of data inside of a file. In fact, the whole reason schemas exist is to decouple the relationships between table rows and the pages and indexes that store that data. We had relational databases before SQL, and there are non-SQL relational (and non-relational) databases today, but you program them, at the query level, with code that is aware of what tables live where.

A schema is the opposite of a file layout. A schema is to a file layout what a Google search is to an IP address.

Post reply on HN