Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

Post reply on HN
Print view View original

311–320 of 463 posts

Re: I Went to SQL Injection Court

#311

Post by tptacek »

dmurray wrote: post #305
tptacek wrote: post #295

Earlier quoted context omitted.

"Would" versus "could" has nothing to do with why your analysis doesn't hold. If something doesn't enable people to attack a system, but is merely one of the valuable things you could get from that system, it does not jeopardize that system under Illinois law. The standard of proof for the jeopardy doesn't enter into it, because no claim of jeopardy has been made. Again: this part of the case is settled. We didn't lo…

> this part of the case is settled. Maybe for this case, but it sounds like enough hinges on the details of the system that in another database, a court could uphold that there "would" be jeopardy instead of there "could" be. So you won on the more fragile part of the ruling. On the other hand, interpreting the law as exempting database schemas is something that can be applied to any computer system, and it presumabl…

Losing on what point? Everybody agrees it is bad schemas are per se exempt from FOIA. On the security concerns of releasing schemas, we won in basically every court.

Re: I Went to SQL Injection Court

#312

Post by tptacek »

neilv wrote: post #304

> [...] where the only way to get at the underlying data is to FOIA a database query. Can you request the desired information using natural language, based on your guesses of what information they store?

Probably not, because then you'd be asking them to go do research. You FOIA for specific documents and records.

Re: I Went to SQL Injection Court

#313

Post by WatchDog »

AdamJacobMuller wrote: post #307
dataflow wrote: post #194

Earlier quoted context omitted.

I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how th…

> And I don't think I disagree with the court on schema vs. file layouts either. I disagree that the law should prohibit disclosing "file layouts" but it's pretty clear that the law does block that, and I fundamentally agree with you that schemas are directly analogous to file layouts and thus restricted.

It seems like an unnecessarily ambiguous term.

Without additional context, I would interpret the term “file layout” to mean the file and directory structure of an application.

Such an application could potentially store data as plain files, the names of those files may contain personal or sensitive information.

Re: I Went to SQL Injection Court

#314

Post by rafram »

How were you able to stand as an expert witness when you have a personal relationship with the plaintiff? I don’t know the specifics of the law in Illinois, but my understanding is that that would generally be a disqualifying conflict of interest.

Re: I Went to SQL Injection Court

#315

Post by hondo77 »

rafram wrote: post #314

How were you able to stand as an expert witness when you have a personal relationship with the plaintiff? I don’t know the specifics of the law in Illinois, but my understanding is that that would generally be a disqualifying conflict of interest.

I have this cousin, Vinny, who's a lawyer, and he was able to use his girlfriend as an expert witness. Both sides agreed she really knows her stuff because that's what really matters.

Re: I Went to SQL Injection Court

#316

Post by HDThoreaun »

tczMUFlmoNk wrote: post #217
dataflow wrote: post #194

Earlier quoted context omitted.

I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how th…

You can always `SELECT table_name, column_name, data_type FROM information_schema.columns`, which is part of the SQL standard. https://www.postgresql.org/docs/current/infoschema-columns.h... Plus, generally if you have SQL injection, you have multiple tries. You're not going to be locked out after one shot. And there's only so many combinations of `SELECT {id,userid,user_id,uid} FROM {user,users,login,logins,customer…

Being able to inject doesnt mean you get the output of a select. The inject can be on non-select statements.

Re: I Went to SQL Injection Court

#317

Post by HDThoreaun »

tptacek wrote: post #310
AdamJacobMuller wrote: post #307

Earlier quoted context omitted.

> And I don't think I disagree with the court on schema vs. file layouts either. I disagree that the law should prohibit disclosing "file layouts" but it's pretty clear that the law does block that, and I fundamentally agree with you that schemas are directly analogous to file layouts and thus restricted.

A SQL schema literally does not indicate the locations of data inside of a file. In fact, the whole reason schemas exist is to decouple the relationships between table rows and the pages and indexes that store that data. We had relational databases before SQL, and there are non-SQL relational (and non-relational) databases today, but you program them, at the query level, with code that is aware of what tables live wh…

I dont think "file layout" has to mean the exact location of every byte. An abstract file layout is still a file layout.

Re: I Went to SQL Injection Court

#318

Post by HDThoreaun »

butlike wrote: post #169
Volundr wrote: post #155

Earlier quoted context omitted.

I'm not an attacker, just a boring old software dev. If there's an SQL Injection I'd say all bets are off re: schema. That said I've definitely worked on applications where knowing the schema could help you exfill data in the absence of a full injection. The most obvious being a query that's constructed based on url parameters, where the parameters aren't whitelisted. So I actually do agree that the schema could pote…

Wouldn't admitting this in court pin you with some sort of negligence? (if you knew having a schema revealed would compromise your app in some way).

This is the city government here. The people arguing the case didnt write the code and dont have time to look through all their code but one thing they do know is that it was written by monkeys. They probably have some level of reason to believe their are SQL injections available in the code.

Re: I Went to SQL Injection Court

#319

Post by HDThoreaun »

hot_gril wrote: post #257
kmoser wrote: post #226

Earlier quoted context omitted.

Knowledge of the column names doesn't give you insight into whether a vulnerability exists . It gives you insight into what you can do with a vulnerability, should it exist. For example, if you want to set your account balance to $1 million, you'd need to know the column name in order to generate a valid query. Without advance knowledge of the column name, your job becomes harder.

SQL injection will give you the entire schema anyway. It doesn't help if someone tells you the col names beforehand. I'm more wondering about non-SQL-injection vulns.

SQL injection isnt just an ssh tunnel to the database. If the line you've injected isnt a select and the backend never fetches it how does the injection give you the column names?

Re: I Went to SQL Injection Court

#320

Post by tptacek »

HDThoreaun wrote: post #317
tptacek wrote: post #310

Earlier quoted context omitted.

A SQL schema literally does not indicate the locations of data inside of a file. In fact, the whole reason schemas exist is to decouple the relationships between table rows and the pages and indexes that store that data. We had relational databases before SQL, and there are non-SQL relational (and non-relational) databases today, but you program them, at the query level, with code that is aware of what tables live wh…

I dont think "file layout" has to mean the exact location of every byte. An abstract file layout is still a file layout.

It is in literally no sense a layout; the whole point of a schema is that it doesn't tie you down to a layout. SQL schemas make sense even in the absence of files!
Post reply on HN