TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

I Went to SQL Injection Court

1230 pointsby mrkurt3 months ago

45 comments

chaps3 months ago
Hi everyone, I&#x27;m the plaintiff in this lawsuit. I&#x27;m still working on my companion post for tptacek&#x27;s post! I&#x27;ll have it ready Soon TM, but feel free to me any questions in the meantime here.<p>While you&#x27;re waiting, check out this older post: <a href="https:&#x2F;&#x2F;mchap.io&#x2F;that-time-the-city-of-seattle-accidentally-gave-me-32m-emails-for-40-dollars4997.html" rel="nofollow">https:&#x2F;&#x2F;mchap.io&#x2F;that-time-the-city-of-seattle-accidentally-...</a>
评论 #43179430 未加载
评论 #43178658 未加载
评论 #43177838 未加载
评论 #43176552 未加载
评论 #43176544 未加载
评论 #43177525 未加载
评论 #43177409 未加载
评论 #43179277 未加载
评论 #43186786 未加载
评论 #43178788 未加载
评论 #43182698 未加载
评论 #43177388 未加载
评论 #43180004 未加载
评论 #43177722 未加载
评论 #43177299 未加载
评论 #43180263 未加载
SkidanovAlex3 months ago
While I believe that the city should share the schema, and that the city is effectively argues for security through obscurity, I disagree with the main premise of the article: that knowing SQL schema doesn&#x27;t help the attacker.<p>If I understand the argument of the author here:<p>&gt; Attackers like me use SQL injection attacks to recover SQL schemas. The schema is the product of an attack, not one of its predicates<p>The author appears to imply that once the vulnerability is found, the schema can be recovered anyway. It is not always the case. It is perfectly viable to find a SQL injection that would allow to fetch some data from the table that is being queried, but not from any other table, including `information_schema` or similar. If all the signal you get from the vunlerability is also &quot;query failed&quot; or &quot;query succeeded, here&#x27;s the data&quot;, knowing the schema makes it much easier to exploit.<p>&gt; the problem is that every computer system connected to the Internet is being attacked every minute of every day<p>If you specifically log failed DB queries, than for all the possible injections that such 24&#x2F;7 attacks would find you have already patched them. The log would then be not deafening until someone stumbles on the actual injection (that, for example, only exists for logged in users, and thus is not found by bots), in which case you have time to see it and patch before the attacker finds a way to actually utilize it.<p>Knowing schema both expedites their ability to take advantage of the vulnerability, but also increases their chances of probing the injection without triggering the query failure to begin with.
评论 #43182950 未加载
评论 #43177993 未加载
评论 #43177202 未加载
评论 #43177029 未加载
评论 #43179972 未加载
评论 #43179003 未加载
tptacek3 months ago
Kurt posted this to troll me. Just know my audience here was, mostly, non-technical people involved in politics in my local Chicagoland municipality.<p>Permit me a PSA about local politics: engaging in national politics is bleak and dispiriting, like being a gnat bouncing off the glass plate window of a skyscraper. Local politics is, by contrast, extremely responsive. I&#x27;ve gotten things done --- including a law passed --- in my spare time and at practically no expense (<i>drastically</i> unlike national politics).<p>An amazing thing about local politics, at least in a lot of places, is that they revolve around message boards. The boards won&#x27;t be in places you want to be (in particular: a lot of them are Facebook Groups) and you just have to suck it up. But if you enjoy participating in a community like HN, you can participate in politics, too, and message-board your way towards making things happen.
评论 #43176847 未加载
评论 #43176056 未加载
评论 #43176087 未加载
评论 #43176421 未加载
评论 #43201593 未加载
评论 #43176151 未加载
评论 #43176887 未加载
Y_Y3 months ago
Is it not absurd that the supreme and appeal courts disagreed on a syntactical matter? Never mind that this isn&#x27;t uncommon, or that (IMHO) it would be ridiculous to interpret it as &quot;any file layouts at all, and other stuff too, but only bad other stuff&quot;. It&#x27;s crazy to me that were happy for laws to sit on the books being utterly ambiguous.<p>I know this suits the courts who benefit from the leeway, and that (despite valiant efforts) we&#x27;re not going to get &quot;formal formal&quot; language into statutes. I know that the law is an ass. I know that the laws are written by fallible and naive humans.<p>Even after all that, if the basic sentence structure of what&#x27;s in the law isn&#x27;t clear <i>to the courts</i>, hasn&#x27;t the whole system fallen at the first hurdle?
评论 #43176685 未加载
评论 #43176632 未加载
EMIRELADERO3 months ago
Am I the only one slightly perplexed&#x2F;worried by the point-blank source code exemption?<p>It&#x27;s easy to imagine a scenario where the city decides to develop a specific software in-house and hide the &quot;biases&quot; in the source code, or any other thing one might not find desirable.<p>Hell, they don&#x27;t even need to make everything from scratch! Could just patch and use a permissively licensed 3rd-party component.<p>In my opinion, the proposed amendment does not go far enough.
评论 #43177908 未加载
评论 #43179051 未加载
评论 #43177351 未加载
duxup3 months ago
Very interesting read.<p>It does seem absurd to think of divulging schema as protected, as described it allows for a magical sort of outcome where: &quot;well it&#x27;s in a database you can&#x27;t know anything about, and if you can&#x27;t tell me how to find it you&#x27;re sol&quot;.<p>Working at a small company with lots of clients I wouldn&#x27;t want to hand out DB schema outright, but I also go out of my way to search &#x2F; get the client the data they want ... not reject them.
评论 #43175952 未加载
jaxgeller3 months ago
I FOIA&#x27;ed &gt;1M pages of docs for my project cleartap.com, a DB of water quality of the USA.<p>Most states would charge a small amount to gather the documents.<p>Michigan wanted $50K to for the FOIA request. I think because of the Flint lead crisis. They wanted me to go away.
评论 #43177851 未加载
dylan6043 months ago
&quot;Retrieve the data of every parking ticket issued to ‘Bob O’ and also all the rest of the information in the database including everyone’s passwords.&quot;<p>This is the example of SQL Injection written in plain English, yet &quot;everyone&#x27;s&quot; is problematic here in that it&#x27;s an orphaned single quote. If &quot;Bob O&#x27;Conner&quot; is bad, so is &quot;everyone&#x27;s&quot;
inetknght3 months ago
&gt; <i>You also generally can&#x27;t FOIA the source code of programs they run.</i><p>Alas, that part should be illegal under FOIA.<p>Source code should be <i>open source</i> and <i>verifiable</i>. Being exempt from FOIA circumvents public confidence in the government&#x27;s use of software.<p>I&#x27;d be curious to learn if&#x2F;where courts have decided such things already.
评论 #43179721 未加载
gowld3 months ago
This is part of what discouraged me from going to law school. So much of litigation is Kabuki theater, grant rhetoric not in any way intended at achieving a just or logical outcomes, but designed only to the person in power an excuse to decide however they had already wanted to decide before the case was tried.
评论 #43178072 未加载
Terr_3 months ago
&gt; Each spreadsheet has a header row, labeling the columns, like “price” and “quantity” and “name”. A database schema is simply the names of all the tabs, and each of those header rows.<p>This is also how I explain it to my relatives, I&#x27;m kind of surprised this analogy (one so direct that it&#x27;s almost literal) didn&#x27;t fly with the judges.<p>If database column names cannot be revealed, then shouldn&#x27;t that mean the state is also able to redact the headers of all their spreadsheets?
评论 #43178140 未加载
评论 #43178249 未加载
pavon3 months ago
Great read. Frustrating that the court ruled that a schema was a file layout, since I don&#x27;t think it is, but at the same time if it didn&#x27;t fall under that exception, there is a strong arguments that would be considered &quot;documentation pertaining to all logical ... design of computerized systems&quot;. A schema is literally, the logical design of the database, and the database is a part of the computerized system. Once it was ruled that those examples are &quot;per se&quot; exempt it was a long shot to argue that schema wasn&#x27;t covered by any of the examples.
评论 #43178014 未加载
评论 #43176512 未加载
评论 #43176215 未加载
bobsmooth3 months ago
What stands out to me about this article is the time between court appearances. Seems like if you want to accomplish anything in court you need to be prepared to spend years of your life on it.
评论 #43176021 未加载
评论 #43178262 未加载
评论 #43176257 未加载
kingforaday3 months ago
Given the Illinois Supremes decision, seems like an opportunistic time to say &quot;Everything is a file&quot;.<p>1. <a href="https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Everything_is_a_file" rel="nofollow">https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Everything_is_a_file</a>
probably_wrong3 months ago
Random thought: someone should drive to Chicago, get a parking ticket, and then make a FOIA request for all of their information contained in that database.<p>It won&#x27;t be the whole database schema, but it would be a start.
评论 #43176387 未加载
alexashka3 months ago
Wowzers, that was <i>a lot</i> of words to express something that&#x27;s very simple.<p>A database schema is just an empty form. By looking at an empty form, you know what fields <i>have</i> be filled in, what type of information they&#x27;ll contain, etc.<p><i>Of course</i> people making data requests need to know what forms are being used to collect and store information.<p>As for security - not letting people do anything because &#x27;it might be dangerous&#x27; is bonkers. The way to secure databases has been known for decades. Let&#x27;s start living in the 21st century :)
评论 #43177764 未加载
boxed3 months ago
&gt; Unfortunately, the Illinois Supreme Court had at their disposal a second dictionary. In the Merriam-Webster Online Dictionary, a “schema” is defined as “a structured framework or plan: outline”. “This is a difference in name only”, said the court. Argh. Schemas are now file layouts. We lose.<p>This is really bad. Words have different meanings in different domains. You can&#x27;t just point to a dictionary definition for the wrong domain. This is absolute madness and should be grounds for termination as a judge. Imagine how angry that judge would be if you did that for some random legal jargon that is very different from the common definition of a word!
rubymancer3 months ago
It&#x27;s Matt Champan! <a href="https:&#x2F;&#x2F;mchap.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;mchap.io&#x2F;</a><p>I helped him process and visualize the original batch of parking ticket data waaaay back in 2016.<p>I can&#x27;t believe he&#x27;s still on this in 2025. We need more junkyard dogs like him fighting for what&#x27;s right.
djeastm3 months ago
I suppose I need to change all my column names to random 16-character strings so I don&#x27;t leave my database insecure!
hnthrow903487653 months ago
&gt;just self-important message-board hedging<p>I can confidently say it does not stop at message boards for many people, self included
评论 #43176288 未加载
koolba3 months ago
&gt; [Public bodies] shall provide a sufficient description of the structures of all databases under the control of the public body to allow a requester to request the public body to perform specific database queries.<p>I sure hope the impact of this is <i>not</i> that government entities switch to schema less databases!
评论 #43176907 未加载
indymike3 months ago
There is no fredom of information if the public is not allowed to know what data the government has.
lq9AJ8yrfs3 months ago
In the new language proposed in SB0226 (as linked, didnt search for authoritative sources, can&#x27;t tell how durable that link will be for posterity, arrgh archiving the web is hard etc), doesn&#x27;t that language leave open a hole for excessive complexity to be a reservoir for FOIA resistance?<p>Feels like there is an important theme here that SB0226 is dancing around --could government be legible in addition to being &quot;plain-text&quot; transparent?<p>&quot;plain-text description&quot; of &quot;each field of each database of the public body&quot; and &quot;specific database queries&quot; may not do what you mean.<p>Not sure how to fix it though.<p>I could see gratuitous ORMs and database-of-databases patterns winning tax dollars with taunt-them-with-the-schema listed as a feature.
Jean-Papoulos3 months ago
I understand freedom of information, but what exactly does the public gain by Matt getting the database schema ?<p>If the answer is &quot;the ability of the request data from a specific table&#x2F;column&quot;, I would say that this should possible to do by asking for the relevant data directly (instead of asking for &quot;the timestamps of each ticket&quot; ask for the &quot;time-related data of each ticket&quot; for example) ?<p>And yes, having your db schema out in the wild can be a vector of attack, if only because it allows targeting the sql injections (the blog author himself argues this in court).<p>The court was right to reject this. Maybe the exact word of the law doesn&#x27;t ask for it, but the spirit certainly does.
评论 #43182852 未加载
评论 #43181599 未加载
rafram3 months ago
How were you able to stand as an expert witness when you have a personal relationship with the plaintiff? I don’t know the specifics of the law in Illinois, but my understanding is that that would generally be a disqualifying conflict of interest.
评论 #43180827 未加载
thayne3 months ago
I&#x27;m confused why file layout is included in the list of exceptions in the first place. If an adversary knowing your <i>file format</i> is a security problem, then you are doing something very wrong!<p>And with the ruling that the condition only applies to &quot;other information&quot; (which to me seems like a very strange reading, and probably not the intent of the law), regardless of if a SQL schema is considered a &quot;file layout&quot;, creates a massive loophole, where the government can just use some obtuse custom file layout to avoid FOIA requests.
makach3 months ago
Does disclosure of a database schema really jeopardize the security of the system? <i>Yes</i><p>How plausible or likely does that jeopardy need to be? <i>Very</i><p>Does a database Schemas constitute “source code”? <i>Yes</i><p>Is a SQL schema a “file format”? <i>No &amp; yes. In that order.</i><p>And, finally, does the “would jeopardize” language apply to everything in the exemption, or just to the nearest noun “any other information”? <i>Yes</i>
lcnPylGDnU4H9OF3 months ago
&gt; where the only way to get at the underlying data is to FOIA a database query<p>Was this ever attempted?<p><pre><code> SELECT * FROM `information_schema`.`tables`;</code></pre>
评论 #43176457 未加载
aqueueaqueue3 months ago
Interesting takeaways from me:<p>All that pompous sounding legalese can still be ambiguous! I feel less bad for not understanding contracts that have 100 word compound sentences.<p>Legal people can&#x27;t keep up with our tech jargon but they have their own jargon including &quot;predicate&quot; lol. So same logical thinking, different jargon framework.<p>Question: why do they want the schema not the data?
评论 #43177184 未加载
DangitBobby3 months ago
When a law is ambiguous by wording, why do they never ask the people who drafted the law what was intended?
评论 #43179771 未加载
评论 #43179606 未加载
scotty793 months ago
&gt; Does the “would jeopardize” language in the statute apply to everything in the exemption, or just to the nearest noun “any other information”?<p>I think law and lawmaking would be vastly improved if only lawyers learned the miracle of parentheses.
评论 #43184608 未加载
wswope3 months ago
Anyone with a legal background willing to opine about potential workarounds to this ruling?<p>Specifically, would a request for “data field labels” (i.e. a column list without any table structure info) likely circumvent the exemption?
评论 #43176047 未加载
评论 #43176828 未加载
irrational3 months ago
&gt; I’ll conclude this long piece by saying (1) obviously the bill should pass, and (2) it should be called “The Chapman Act”.<p>(3) I imagine Chicago greatly regrets towing Matt Chapman &quot;over a facially bogus ticket&quot;.
gavin_gee3 months ago
<a href="https:&#x2F;&#x2F;x.com&#x2F;JackRhysider&#x2F;status&#x2F;1885732851779285184" rel="nofollow">https:&#x2F;&#x2F;x.com&#x2F;JackRhysider&#x2F;status&#x2F;1885732851779285184</a>
neilv3 months ago
&gt; <i>[...] where the only way to get at the underlying data is to FOIA a database query.</i><p>Can you request the desired information using natural language, based on your guesses of what information they store?
评论 #43180641 未加载
b83 months ago
Got to see this happen day by day on the Midwest Venture Partners Slack. There was another lawsuit Chappman and Tom did for laser based speed detection in Chicago.
pudding123453 months ago
Do stored procedures count as part of the schema? I&#x27;ve recently found a SQL injection vulnerability in a client&#x27;s SP that was using concat (very badly)
ngriffiths3 months ago
&gt; Congratulations! You now understand databases.<p>Data engineering: doing a lot of fancy work to make a very simple product
gervwyk3 months ago
Should have used mongodb in the first place.
评论 #43179730 未加载
el_snark3 months ago
Enjoyed the read. Good luck with the future developments.<p>Now a nerdy question. As someone who investigates SQL injections, why are you running a server based on nginx 1.4.6? Do you know something I don&#x27;t? :-)
abfan11273 months ago
am I the only disappointed there&#x27;s no mention of little Bobby Tables?
gunian3 months ago
sql injection court seems more fun than slave court where they tell you spending anything above 5 is a crime lmaooooo
lucb1e3 months ago
I got to about 1&#x2F;3rd of the way before I noticed my eyes were kinda struggling to read the article. Toggling different CSS rules, it&#x27;s the #333 gray color. Turning that off is instantly better. The custom font is much thinner than the default, but that by itself doesn&#x27;t seem to be the issue if the color is (closer to) black. (There is also a font-weight rule, but toggling it makes no visual difference in Firefox. Maybe the text is intended to look different?)<p>Since there is no contact method on the website, figured I&#x27;d mention it in a comment; hope this helps
评论 #43177187 未加载
ajkjk3 months ago
This was fine, legally, but I&#x27;d be pretty irritated if someone I knew wasted everyone&#x27;s time on this. The schema clearly <i>is</i> (marginally) useful for hacking, but who cares; it clearly is a file layout also, but who cares; those matter legally but not morally. Morally, this is just dumb: it&#x27;s not something they really needed, and they&#x27;re just irritating people and wasting resources for the fun of it. Shameful.
评论 #43178347 未加载
评论 #43179080 未加载
评论 #43178413 未加载
评论 #43178254 未加载
评论 #43178343 未加载
lubujackson3 months ago
Juxtapose this legal process with DOGE hoovering (in more ways than one) data willy-nilly from everywhere. The dissonance between THIS uninteresting DB schema being so rigorously protected while massive amounts of sensitive data is completely misappropriated is painful.