Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

Post reply on HN
Print view View original

401–410 of 463 posts

Re: I Went to SQL Injection Court

#401

Post by fsckboy »

qingcharles wrote: post #282
tptacek wrote: post #267

Earlier quoted context omitted.

A losing public body is also generally on the hook for attorney's fees, which can be considerable. But the general problem here is that the public bodies are all spending someone else's money, so the real deterrent you have is how much of their time you can credibly threaten to eat up with legal actions.

That's true, as long as you are represented. I knew one lawyer in Illinois who would sit in FOIA court and take all the non-represented persons aside and offer to take their cases and split the attorney fees 50/50. I believe it isn't strictly above-board, but it is a solution to a problem. People don't like being put under oath, so you can somewhat temper a public body's future refusals by deposing them or sticking a…

so the attorney gets half of what the attorney gets? Zeno's Paradox.

Re: I Went to SQL Injection Court

#402

Post by fsckboy »

dataflow wrote: post #194
chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how th…

>It's not the file layout, but it's analogous...How do you argue they aren't analogous?

laws don't get to be analogous

foia request: "I'd like the report the committee prepared about the costs for the new bridge"

response: "denied. the report contains costs laid out in tables with headings, which while not being schemas are analogous, with schemas not being files but being analogous"

Re: I Went to SQL Injection Court

#403

Post by aftbit »

tczMUFlmoNk wrote: post #217
dataflow wrote: post #194

Earlier quoted context omitted.

I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how th…

You can always `SELECT table_name, column_name, data_type FROM information_schema.columns`, which is part of the SQL standard. https://www.postgresql.org/docs/current/infoschema-columns.h... Plus, generally if you have SQL injection, you have multiple tries. You're not going to be locked out after one shot. And there's only so many combinations of `SELECT {id,userid,user_id,uid} FROM {user,users,login,logins,customer…

Ah so what you're saying is that we ought to rename our logins table to "duckwords" because nobody will ever guess that? Also we should probably store passwords in plaintext but name the column "entercod3" because nobody will think of that. Oh and we should use printf with %s to build our queries right?

Re: I Went to SQL Injection Court

#405

Post by hennell »

ra wrote: post #208
chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

They can produce a report using english language labels instead of the db column names. Their argument isn't fact it's vexatious obstenance.

As mentioned in the post FOIA tends to only include existing records/information, it doesn't extend to producing new work. So producing a new report would be considered too much work. (But fighting a lawsuit to not reveal the schema is fine )

Re: I Went to SQL Injection Court

#406

Post by econ »

HDThoreaun wrote: post #397
econ wrote: post #394

Earlier quoted context omitted.

If you have an injection friendly application then that is the security problem. Say someone hacks the db, is the problem easy to guess table names? The column should never have be called "passwords"? Perhaps 30 years ago that would sound good. Obscurity should hardly ever be a line of defense. If it is the only defense the problem isn't that it wasn't obscure enough. Edit: I'll do you one better. If you so much as s…

What do you do when you know you've got a pile of poorly written insecure software and no money to improve it?

I probably delete everything and pretend it never happened. It depends ofc on the worse case scenario. What can i do/afford to deal with the greatest risk? I might use it on a machine without internet.

Re: I Went to SQL Injection Court

#408

Post by numpad0 »

Xelynega wrote: post #323
HDThoreaun wrote: post #317

Earlier quoted context omitted.

I dont think "file layout" has to mean the exact location of every byte. An abstract file layout is still a file layout.

How can you literally interpret the two words "file layout" without it pertaining to the layout of a file?

DBs can be files on disk though? Besides they're a bit like easy hand rolling powder mix for filesystems. Filesystem entries has properties like filenames and inode numbers and file contents. Databases has columns like emails and membership IDs and their favorite cookies. I don't think "file layout" is an absurd framing.

Re: I Went to SQL Injection Court

#409

Post by numpad0 »

chaps wrote: post #184
foota wrote: post #182

Earlier quoted context omitted.

I agree this is something of a technical solution, but the court wasn't interpreting whether you could ask for rows from a database, but whether you could ask for the schema directly. I don't think the court had the option of saying "you can't ask for the schema, but asking for a sample row is ok".

The short answer is yes, you can do this. I've seen this work for emails, where the request is basically, "Give me the most recent email of blah@gov.com". And yeah, the plan was to eventually submit a batch of requests using the table names, similar to `SELECT * FROM {table_name_from_schema_request} LIMIT 1`, but one FOIA request per-table.

No offense, but how can you be 1) insisting it's safe to give up the information to you and 2) openly planning to use the information obtained for further exploitation, at the same time? You can't have the cake and eat it too, unless the information available in 2) technically do not depend on 1) but doing it this way would only save them massive time or something.

Re: I Went to SQL Injection Court

#410

Post by dragonwriter »

qingcharles wrote: post #358
dragonwriter wrote: post #284

Earlier quoted context omitted.

I think it is likely to ne about budgets. That is, sure, FOIA and similar state laws usually allow the agency to collect something related to actual costs, but that's mostly meaningless since even if actually covers staff time it doesn't retroactively give them staff to cover it in the impacts areas, and often the FOIA volume doesn't effectively feedback into legislative budget processes for future staffing either, w…

In my experience (and probably in Matt's) this has 100% not been the issue. The people responsible for the FOIA responses aren't in any way connected to budgeting or resources. It is just a body-wide personality issue. Some aspect of maliciousness mixed with laziness... or something.

> In my experience (and probably in Matt's) this has 100% not been the issue. The people responsible for the FOIA responses aren't in any way connected to budgeting or resources.

In my experience working in government, including on state-equivalent-of-FOIA requests, almost everyone working on those kinds of requests is “involved in” budgeting and resources, and more to the point anyone in a position to sign off on a decision of whether something should or should not be denied as exempt is a manager, for whom (that is, for any manager, down to the line level, over any function in any government agency, but FOIA-type requests, eepecially if there are going to be assertions of exemptions in total or in part, generally involve coordination and signofffs between multiple managers, e.g., from the most relevant line unit, the public information unit, and legal) managing budgeted resources and doing the work of justifying requests for additional resources that is the root of the agency-initiated budget change request process, and then participating in drills and internal analyses and responses as those proposals work through the budget process is a central part of their job.

Post reply on HN