Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

Post reply on HN
Print view View original

371–380 of 463 posts

Re: I Went to SQL Injection Court

#371

Post by lyu07282 »

spoaceman7777 wrote: post #367
lyu07282 wrote: post #357

Earlier quoted context omitted.

> You can "always" do that? Well I just did that. My database said: no such table: information_schema.columns Don't expect attackers to give up after one try. It depends on the database software, not everyone implements this exact ANSI standard for reflection but every database supports reflection. That's why the first step after finding a SQLi is to fingerprint the database software and go from there. > And what if…

You can definitely disable it, in a variety of ways, for whatever role, user, etc. you wish to.

Nevermind you are right its possible, but I still think it breaks so much stuff that at least I've never seen anybody doing it or recommending it. All kinds of ORMs and migration tools would break for example. But I guess it would be a defense-in-depth strategy.

Re: I Went to SQL Injection Court

#372

Post by manquer »

Y_Y wrote: post #356
manquer wrote: post #150

Earlier quoted context omitted.

It shouldn't be surprising ? It is the same problem people trying to open sourcing closed projects experience, there is all sorts of locked-in proprietary code which the developer and the customer only have the license to use but not share the source. Even projects which from day one are staunchly open and built without direct commercial interests like government contractors need also suffer from this. The Linux kern…

Maybe FOIA should trump licensing in this case. Suppose I write a manual on how to issue bad parking tickets and hide them in a database, and then license that (in since restrictive manner) to the state of Illinois. I think the public's right to see that document is more important than my right to prevent copying and dissemination.

That is true for all kinds of IP . The balance between the two is what IP laws do. Give inventors some protections to encourage innovations while keeping the public benefits in mind .

Copyright is time limited author’s death and 70 years for individuals and 95 years for corporations .

While there are arguments to be made for lesser duration , better preservation requirements etc the balancing of public good to private value is the basis of all copyright laws since statute of Anne 1709.

In a court case you can get access to all types of information as part of discovery, if you are harmed or believed to have been, there are other avenues available for you . If you have standing to sue and the discovery requests are made by a competent lawyer you can get access to internal communications to trade secrets to any other document supporting your claim . you or your lawyer can not use such information for economic benefit or disclose it, they are still protected .

Given that you have options legally to get this data , there is no public need that trumps private property rights because of real or potential harm that justifies blanket access by default

PS: note software is not just copyrighted , it is also covered by patents (20 years) and trade secrets (no expiry ). Also while the law provides protection it does not require disclosure on expiry .

Re: I Went to SQL Injection Court

#373

Post by acka »

IanGabes wrote: post #322
default-kramer wrote: post #266

Earlier quoted context omitted.

A good DBA would restrict the account so that it can't access the information schema. It's easy to imagine an environment with a vigilant DBA and less vigilant web developers.

This makes sense, but the the vast majority of tooling including ORMs, autocomplete SQL IDEs, and even suspect application code relies on table descriptions and listings provided by the information schema

That is why we have development and production environments. The production environment is expected to operate in a potentially hostile space and does not need developer conveniences beyond the ability to generate alerts and produce logs, which should be stored in a safe way, everything else should be locked down as much as possible.

Re: I Went to SQL Injection Court

#374

Post by fc417fc802 »

dataflow wrote: post #348
tptacek wrote: post #344

Earlier quoted context omitted.

It's either a file layout or it is not a file layout. If you write an affidavit saying it's "sort of like a file layout", the conclusion will be that it is not one. Now, the Illinois Supreme Court found that it was a file layout (wrongly). But they didn't use any of this kind of message board logic to do it; they pulled up a definition for "file layout" from a technical dictionary (which, ironically, pretty clearly e…

> Now, the Illinois Supreme Court found that it was a file layout (wrongly). But they didn't use any of this kind of message board logic to do it; they pulled up a definition for "file layout" from a technical dictionary (which, ironically, pretty clearly established, even more than this thread does, that schemas aren't file layouts) "Wrongly" was exactly what I just spent an hour writing a long comment disputing, wi…

If I understand correctly, you're saying that you expect items in a column to tend to cluster near one another on disk. Notably though that doesn't give you any sort of relative or absolute offset. Neither does it have anything to say about, for example, blocks of different types which might be interleaved. Or compression. Or indexes. Or copy on write related garbage collection. Or journaling. Or any number of other things.

Now if you wanted to argue that a schema serves the same purpose as a file layout, ie that it's how a programmer interfaces with the data, and that it impacts workload performance, that would be fair enough. And given that laws are all about intent perhaps that would be relevant. (Or perhaps not. I didn't read about the case yet.)

But I think it's fairly reasonable to say that in typical usage an SQL schema is decidedly not a file layout in a literal sense.

Re: I Went to SQL Injection Court

#375

Post by zachrip »

brohee wrote: post #364
zachrip wrote: post #225

Earlier quoted context omitted.

That's a good point, has anyone hardened a database by locking out users who select columns that don't exist? Or run other dubious queries? This would obviously interrupt production but if someone is running queries on your db it's probably worth it?

If you are mature enough to do that, you're mature enough to net SQL injections in the first place. There shouldn't be that many handwritten queries to review in the first place as most mundane DB access is usually through a framework that handles injection properly...

I disagree, if all it took was maturity then we wouldn't see giant data breaches of the largest companies in the world weekly.

Re: I Went to SQL Injection Court

#376

Post by dataflow »

fc417fc802 wrote: post #374
dataflow wrote: post #348

Earlier quoted context omitted.

> Now, the Illinois Supreme Court found that it was a file layout (wrongly). But they didn't use any of this kind of message board logic to do it; they pulled up a definition for "file layout" from a technical dictionary (which, ironically, pretty clearly established, even more than this thread does, that schemas aren't file layouts) "Wrongly" was exactly what I just spent an hour writing a long comment disputing, wi…

If I understand correctly, you're saying that you expect items in a column to tend to cluster near one another on disk. Notably though that doesn't give you any sort of relative or absolute offset. Neither does it have anything to say about, for example, blocks of different types which might be interleaved. Or compression. Or indexes. Or copy on write related garbage collection. Or journaling. Or any number of other…

> If I understand correctly, you're saying that you expect items in a column to tend to cluster near one another on disk.

That's one thing I'm saying would be sufficient to consider this file layout, yes. I'm not saying it's necessary. Databases can obviously be row-oriented too. Knowing that they don't cluster would also be layout information. As could any number of other things.

> Notably though that doesn't give you any sort of relative or absolute offset. Neither does it have anything to say about, for example, blocks of different types which might be interleaved. Or compression. Or indexes. Or copy on write related garbage collection. Or journaling. Or any number of other things.

It doesn't have to include offsets or any of those other things. File layout information could be as simple as "data should be aligned to a page boundary for performance" or "this field must reserve space for up to 16 characters" or even "data from different records should not be stored in an overlapping manner, to allow fast erasure"... I could go on. And notice the wardrobe layout example doesn't have offsets either, but the decision to separate jackets from shirts is absolutely one about layout nonetheless.

> But I think it's fairly reasonable to say that in typical usage an SQL schema is decidedly not a file layout in a literal sense.

It is not complete file layout information. But it certainly can be part of the file layout information.

Imagine you had a table with columns name1 VARCHAR(64) and name2 VARCHAR(64) in that order. Now imagine you modified a couple of bytes on the disk, such that you swap the 1 and the 2. You can imagine a database where that would be sufficient to confuse it into thinking the two columns had swapped contents, right? Could you really claim the schema didn't contain any file layout information in that scenario, when it certainly affected which bytes are interpreted as belonging to which columns?

Re: I Went to SQL Injection Court

#377

Post by Paracompact »

NoboruWataya wrote: post #238
Y_Y wrote: post #62

Earlier quoted context omitted.

Of course I can't disagree that it's good that it's now settled. Still I can't help but imagine a world where the meaning, at least in terms of which words apply to which others (rather than qualifiers like "reasonable"), should be settled before the law is debated, voted on, and passed. Even (some) programmers have learnt the dangers of parsing at run time (e.g. "eval is evil"). How can we decide it's the law we wan…

> How can we decide it's the law we want if we don't know what it means yet? FWIW, judicial interpretation of legislation is generally seen as an exercise in figuring out what the legislature meant. Courts start by looking at the "plain meaning" of the words used, but where that doesn't yield an unambiguous answer they will often look at the overall scheme or purpose of the legislation to try and figure out which int…

> It's far from perfect of course, but it's not like legislation just consists of a bunch of random symbols that are later imbued with meaning by a court operating in a vacuum.

Isn't this exactly what happened? A court of computer laypeople reached for Merriam-Webster in order to disambiguate a sample of programmer argot that was written into law by another group of computer laypeople. The legal profession isn't just dirty, it seems doomed to defeat itself in even its most rigorous practice.

Re: I Went to SQL Injection Court

#378

Post by Y_Y »

manquer wrote: post #372
Y_Y wrote: post #356

Earlier quoted context omitted.

Maybe FOIA should trump licensing in this case. Suppose I write a manual on how to issue bad parking tickets and hide them in a database, and then license that (in since restrictive manner) to the state of Illinois. I think the public's right to see that document is more important than my right to prevent copying and dissemination.

That is true for all kinds of IP . The balance between the two is what IP laws do. Give inventors some protections to encourage innovations while keeping the public benefits in mind . Copyright is time limited author’s death and 70 years for individuals and 95 years for corporations . While there are arguments to be made for lesser duration , better preservation requirements etc the balancing of public good to privat…

If it were enough that government data were available via discovery then we wouldn't need FOIA laws in the first place.

Patents aren't relevant here since they are disclosed upon granting and cover the design rather than the implementation, for trade secrets the situation is more complicated ( https://www.americanbar.org/groups/litigation/resources/news... ).

Re: I Went to SQL Injection Court

#379

Post by waitwhatwhoa »

chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

When can we submit witness slips? Is there a mailing list for updates we can join? Good luck!

Re: I Went to SQL Injection Court

#380

Post by scotty79 »

> Does the “would jeopardize” language in the statute apply to everything in the exemption, or just to the nearest noun “any other information”?

I think law and lawmaking would be vastly improved if only lawyers learned the miracle of parentheses.

Post reply on HN