Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

Post reply on HN
Print view View original

411–420 of 463 posts

Re: I Went to SQL Injection Court

#411

Post by mrgoldenbrown »

IanGabes wrote: post #322
default-kramer wrote: post #266

Earlier quoted context omitted.

A good DBA would restrict the account so that it can't access the information schema. It's easy to imagine an environment with a vigilant DBA and less vigilant web developers.

This makes sense, but the the vast majority of tooling including ORMs, autocomplete SQL IDEs, and even suspect application code relies on table descriptions and listings provided by the information schema

My ide logging into my local dev copy of the DB and my public facing prod application should not be using the same SQL login.

Re: I Went to SQL Injection Court

#412

Post by AdamJacobMuller »

dataflow wrote: post #351
AdamJacobMuller wrote: post #307

Earlier quoted context omitted.

> And I don't think I disagree with the court on schema vs. file layouts either. I disagree that the law should prohibit disclosing "file layouts" but it's pretty clear that the law does block that, and I fundamentally agree with you that schemas are directly analogous to file layouts and thus restricted.

>> And I don't think I disagree with the court on schema vs. file layouts either. > I disagree that the law should prohibit disclosing "file layouts" Note, the court wasn't ruling what the law should say, only what the law says. At least that's my understanding of it. I certainly wasn't opining on what the law should say.

Understood. I mention that distinction only because I find many people (not you) who say that "X law doesn't apply because if it did, it would be bad" vs directing your ire at the actual laws, which are poorly written and the legislators who are negligent in fixing those laws.

Courts should decide based on the law, not based on what is "good".

Re: I Went to SQL Injection Court

#413

Post by AdamJacobMuller »

WatchDog wrote: post #313
AdamJacobMuller wrote: post #307

Earlier quoted context omitted.

> And I don't think I disagree with the court on schema vs. file layouts either. I disagree that the law should prohibit disclosing "file layouts" but it's pretty clear that the law does block that, and I fundamentally agree with you that schemas are directly analogous to file layouts and thus restricted.

It seems like an unnecessarily ambiguous term. Without additional context, I would interpret the term “file layout” to mean the file and directory structure of an application. Such an application could potentially store data as plain files, the names of those files may contain personal or sensitive information.

> It seems like an unnecessarily ambiguous term.

Agree, and, I don't even understand why it's in there in the first place (it should just not be) but that's a job for the legislature to resolve, not the courts.

Re: I Went to SQL Injection Court

#414

Post by thaumasiotes »

tptacek wrote: post #345
thaumasiotes wrote: post #342

Earlier quoted context omitted.

> If something doesn't enable people to attack a system, but is merely one of the valuable things you could get from that system, it does not jeopardize that system under Illinois law. The problem I have with this is that the schema isn't something an attacker recovers for its own sake. It's something the attacker recovers in order to further their attack. This necessarily means that it does enable people to attack t…

I don't understand your argument. If I have a SQLI, I can, as you acknowledge, fetch the schema. So what does it matter if the schema is published a priori? All that matters is whether I have SQLI.

No, as other comments in the thread have pointed out, you can easily have an SQLI that doesn't send information back to you. You may find value in changing what's in the database even if you can't read from it.

If you do have the ability to retrieve information, then one of the first things you'll do is retrieve the schema.

And the reason you'll retrieve the schema, if you can, is that it facilitates the attacks you actually want to make. It has no value to you other than enabling your attacks. This observation seems sufficient to answer the question "does knowing the schema enable attacks?".

Re: I Went to SQL Injection Court

#415

Post by wglb »

valenterry wrote: post #300
wglb wrote: post #287

Earlier quoted context omitted.

Sanitization almost always fails. This becomes an arms race.

If you do it wrong, yes. Sure, there is no 100% security, but honestly, it's 2025. We already know the techniques how to prevent SQL injection of any kind. I wrote about this here: https://valentin.willscher.de/posts/sql-api/

The parser isn't shown there, so it isn't clear what would happen with weird input.

Have you had anyone do a penetration test on it?

Re: I Went to SQL Injection Court

#416

Post by tptacek »

thaumasiotes wrote: post #414
tptacek wrote: post #345

Earlier quoted context omitted.

I don't understand your argument. If I have a SQLI, I can, as you acknowledge, fetch the schema. So what does it matter if the schema is published a priori? All that matters is whether I have SQLI.

No, as other comments in the thread have pointed out, you can easily have an SQLI that doesn't send information back to you. You may find value in changing what's in the database even if you can't read from it. If you do have the ability to retrieve information, then one of the first things you'll do is retrieve the schema. And the reason you'll retrieve the schema, if you can, is that it facilitates the attacks you…

There is a whole sub-field of software security dedicated to retrieving information from SQL injections that don't directly return results. This is not a plausible objection.

Re: I Went to SQL Injection Court

#417

Post by mcnichol »

chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

I don't want to take away any steam from your sails but giving bad information in regards to case law shouldn't be taken lightly. Your "expert witness" did you a disservice.

Schema is very much a critical field in terms of AuthZ privileges. Just knowing the structure is not far off from knowing the max entropy a password may hold. In regards to InfoSec, table structure is the recon phase which limits effort and minimizes time. Someone with that much time in security knows DBs will be hacked, not if but when. Time is an incredibly important tool which is why we have expirations on so many authN and authZ windows of attack.

I'm glad that you are challenging them but I believe a credible engineer would have made mince meat of your expert and hurt the rest of us who want to see you successful.

It's possible rewriting certain statutes can help us but there is no company worth its salt that would share DB schema.

Re: I Went to SQL Injection Court

#418

Post by wglb »

HDThoreaun wrote: post #319
hot_gril wrote: post #257

Earlier quoted context omitted.

SQL injection will give you the entire schema anyway. It doesn't help if someone tells you the col names beforehand. I'm more wondering about non-SQL-injection vulns.

SQL injection isnt just an ssh tunnel to the database. If the line you've injected isnt a select and the backend never fetches it how does the injection give you the column names?

I've seen this done by enumerating possible table names.

Re: I Went to SQL Injection Court

#419

Post by thayne »

I'm confused why file layout is included in the list of exceptions in the first place. If an adversary knowing your file format is a security problem, then you are doing something very wrong!

And with the ruling that the condition only applies to "other information" (which to me seems like a very strange reading, and probably not the intent of the law), regardless of if a SQL schema is considered a "file layout", creates a massive loophole, where the government can just use some obtuse custom file layout to avoid FOIA requests.

Re: I Went to SQL Injection Court

#420

Post by thayne »

mcnichol wrote: post #417
chaps wrote: post #35

Hi everyone, I'm the plaintiff in this lawsuit. I'm still working on my companion post for tptacek's post! I'll have it ready Soon TM, but feel free to me any questions in the meantime here. While you're waiting, check out this older post: https://mchap.io/that-time-the-city-of-seattle-accidentally-...

I don't want to take away any steam from your sails but giving bad information in regards to case law shouldn't be taken lightly. Your "expert witness" did you a disservice. Schema is very much a critical field in terms of AuthZ privileges. Just knowing the structure is not far off from knowing the max entropy a password may hold. In regards to InfoSec, table structure is the recon phase which limits effort and minim…

> Just knowing the structure is not far off from knowing the max entropy a password may hold

Not if the password is hashed, as it should be. Unless the schema somehow indicates that it uses a hash algorithm such as bcrypt that has a maximum password length. And even then, if they pre-hash the password, the password itself could have more entropy than that. And if there is a maximum password length, then you can probably figure that out via other means, like it being listed in the requirements when you set your password. It does tell you the size of the hash of the password, but if the maximum entropy is sufficiently high, as it should be, then it doesn't really matter; it would still be impractical to brute force.

> there is no company worth its salt that would share DB schema

So you are saying that every company with a self-hosted or open source product that uses a database isn't worth their salt? If your DB is running on a customer's infrastructure, that customer will by necessity have access to the schema. And likewise if the source code for a product is publicly available it is trivial to determine the schema.

Post reply on HN