License plate SQL injection, would it work?

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > License plate SQL injection, would it work?

ShadowMoo: Mar 13, 2011; by Shine

Read an old story about people trying to put SQL code on their plates to fool traffic cams. To someone who has extremely limited experience with SQL, would this actually work?

# ? Apr 5, 2014 22:29

Adbot: ADBOT LOVES YOU

# ? Apr 24, 2024 19:34

kloa: Feb 14, 2007

I guess it could, depending on how the camera systems works (which I have no idea). I'm guessing the camera's either save a video of you running the light, save a compressed image of you running the light, or if it's really sophisticated, it could look up your license plate on-the-fly.

The first 2 options are probably human verified, so the SQL wouldn't work. It would have to be an automated system.

code:

SELECT *
FROM DMV_MASTER_DATABASE
WHERE LICENSE_PLATE = ?;

If the camera software was as simple as this, then you could throw something like ' OR 1=1; and it wouldn't ever grab your plate.

# ? Apr 5, 2014 22:56

SixFigureSandwich: Oct 30, 2004; Exciting Lemon

There are systems that actually read the license plate that is on your car. Beyond that I have no idea how that data is processed.

# ? Apr 5, 2014 22:59

thebigcow: Jan 3, 2001; Bully!

will they charge you destruction of police property or something more interesting

# ? Apr 5, 2014 23:29

HalloKitty: Sep 30, 2005; Adjust the bass and let the Alpine blast

http://gizmodo.com/5498412/sql-injection-license-plate-hopes-to-foil-euro-traffic-cameras

But no follow up, sadly.

# ? Apr 5, 2014 23:36

dissss: Nov 10, 2007; I'm a terrible forums poster with terrible opinions.

Here's a cat fucking a squid.

You're supposed to name your child with an awkward string, not try and get it onto a license plate

http://xkcd.com/327/

Anyway the only way SQL injection can work is if the system in question does not handle query parameterisation properly. Even if the reading system doesn't do this you only have a few characters to work with, and the licensing authority is only going to allow a limited character set.

# ? Apr 6, 2014 01:13

pram: Jun 10, 2001

Yes because license plate numbers have semicolons and parentheses

# ? Apr 6, 2014 01:40

Lum: Aug 13, 2003

(Note: This is written from a UK perspective)

I'm going to go with no.

Firstly the most common types of speed camera out there, Gatso and Truvelo, take photographs onto film which is then manually viewed by a police officer to determine if an offence has taken place and if so the vehicle details are keyed in manually. You'd have to get a particularly dumb officer to actually enter all that stuff by hand.

Even for the cameras that do read number plates (digital Gatso, SPECS, ANPR etc.), there is one big flaw in the SQL injection plan, which is that a licence plate is only 7 characters long (I believe this can go up to 9 in the USA?) so you wouldn't be able to get any meaningful SQL command in there.

What would happen is one of two things.

Eventually you'll get seen by a copper and pulled over for driving with obscured number plates, which will likely get you a small fine and told to fix it.
As #1 but you'll get a copper who knows what SQL injection is and instead of being told to fix it you'll get charged with attempting to pervert the course of justice which carries much higher penalties including a possible prison sentence.

You'd be much better off just buying one of the many camera detecting devices out there, the GPS+database based ones work very well, or learn to be particularly observant while speeding! (which is probably good advice anyway)

# ? Apr 6, 2014 16:39

ArchetypeAnarch: Apr 1, 2014

Assuming that the system is even automated (as was pointed out earlier that certain systems still require manual data entry) if the software employs even the lightest of input sanitation (eg. encoding/escaping special characters) or user based restricted permissions to the database, none of those attacks would get through. Clever idea though. Its XKCD's "Little Bobbie Tables" personified.

# ? Apr 26, 2014 04:34

adorai: Nov 2, 2002; 10/27/04 Never forget; Grimey Drawer

ArchetypeAnarch posted:

Assuming that the system is even automated (as was pointed out earlier that certain systems still require manual data entry) if the software employs even the lightest of input sanitation (eg. encoding/escaping special characters) or user based restricted permissions to the database, none of those attacks would get through. Clever idea though. Its XKCD's "Little Bobbie Tables" personified.

as a consolation prize, it will probably make your plate immune to being recognized.

# ? Apr 26, 2014 06:23

Straker: Nov 10, 2005

Red light cameras take pictures a couple seconds apart so they can (for example) tell if you were just slow making a left hand turn as the light changed, or that sort of thing, and obviously a human has to go through all those, so no even if their software was poorly written (lowest bidder and all) I can't see this plan working very well.

# ? Apr 26, 2014 06:39

Lum: Aug 13, 2003

adorai posted:

as a consolation prize, it will probably make your plate immune to being recognized.

Yes, but as I mentioned before, it'll get you in trouble for attempting to pervert the course of justice.

You'd be better off sticking a sign over your plate saying "I am a fuckwit" (insert your preferred slur here) and then denying all knowledge of it being there and removing it as soon as you get pulled over. Not your fault you never noticed someone vandalising your car right?

# ? Apr 26, 2014 07:08

Fortuitous Bumble: Jan 5, 2007

Yeah even if it worked you'd be better off placing the strings on other people's cars if your goal was to cause trouble. Kind of like that Japanese hacker dude that sent threatening emails through a collar on a stray cat.

# ? Apr 26, 2014 08:35

Shaocaholica: Oct 29, 2002; Fig. 5E

Or you could just stick with the:

00OO00OO

II11II11II

XKXKXKXK

MNMNNNMN

plates

# ? Apr 26, 2014 19:00

Straker: Nov 10, 2005

License plates are easily OCRed for a reason though, that would be useless. I think old fashioned is probably better, if you want to be an annoying little poo poo get one of those tacky translucent yellow license plate covers or my favorite, from one of those stupid old anarchist handbooks/jolly roger cookbook type things: steal someone's plates, put them on another car, then put the second car's plates on your own :v:

edit: I just realized it should be pretty trivial to use a chunk of privacy filter to make your license plate unreadable from an angle, such as speed/red light cameras, without immediately getting pulled over, but on the other hand if you ever parked in public you'd be hosed once any kind of cop/meter reader notices your plate looks black from eye level when you're standing by the car

Straker fucked around with this message at 00:24 on Apr 28, 2014

# ? Apr 28, 2014 00:20

~Coxy: Dec 9, 2003; R.I.P. Inter-OS Sass - b.2000AD d.2003AD

Lifehack: if you buy a 9 character vanity plate, you can get out of traffic fines by responding to the demand letter with the objection that the listed number plate in the letter isn't yours.
Whichever form printing software they use cuts it down to 8 chars for whatever reason.

Worked for several years in my state, unfortunately I think they fixed it recently.

# ? Apr 28, 2014 04:40

Westie: May 30, 2013; Baboon Simulator

Shaocaholica posted:

Or you could just stick with the:

00OO00OO

II11II11II

XKXKXKXK

MNMNNNMN

plates

II11II11II is a VRM that appears on ANPR equipment quite often - some ANPR equipment erroneously picks up gates and fences as registration plates, lol.

# ? Apr 28, 2014 17:33

Shaocaholica: Oct 29, 2002; Fig. 5E

I wonder what the error rate is with similar chars like 1/I, M/N, K/X, 0/O etc. Given that the cameras have limited resolution and lighting conditions etc etc.

# ? Apr 28, 2014 18:05

President Ark: May 16, 2010

I'm pretty sure that'd only work once and then after that they'd just go "Oh, it's that douchebag Jon Doe with the license plate that's all Ks and Xs. We have his address bookmarked, send him a ticket."

# ? Apr 28, 2014 18:08

Shaocaholica: Oct 29, 2002; Fig. 5E

President Ark posted:

I'm pretty sure that'd only work once and then after that they'd just go "Oh, it's that douchebag Jon Doe with the license plate that's all Ks and Xs. We have his address bookmarked, send him a ticket."

Except with say 8 chars there's 2^8 (256) possible combinations of 2 like chars so thats 256 potential douchebags.

# ? Apr 28, 2014 18:15

wdarkk: Oct 26, 2007; Friends: Protected
World: Saved
Crablettes: Eaten

Shaocaholica posted:

Except with say 8 chars there's 2^8 (256) possible combinations of 2 like chars so thats 256 potential douchebags.

Unless they own the same car in the same color it'll still be easy.

# ? Apr 29, 2014 03:13

FatCow: Apr 22, 2002; I MAP THE FUCK OUT OF PEOPLE

pram posted:

Yes because license plate numbers have semicolons and parentheses

They do in NC.

# ? Apr 29, 2014 18:15

Lum: Aug 13, 2003

wdarkk posted:

Unless they own the same car in the same color it'll still be easy.

# ? Apr 29, 2014 20:32

cynic: Jan 19, 2004

Maybe not on speed cameras, but there are plenty of automatic number plate recognition systems around for things like congestion charges, tax disc checks, private carparks etc, and a quick read does indicate that these are often uploaded to web services at some point - they may also be running embedded databases for upload in batches, and often connected to other systems, such as automated billing systems. But you're relying on several things namely;

None of the code has checks on length.
None of the code has checks on valid characters (for instance you'd imagine that ' would get discarded by license plate recognition systems as being "probably a dead bee instead of a valid character").
None of the code escapes characters correctly.
There are no human checks in place before entry to the database.

It's not impossible, but I'd be very surprised if there were any systems you could compromise in that way.

# ? Apr 30, 2014 11:44

nexxai: Jul 17, 2002; quack quack bjork; Fun Shoe

(Not mine.)

# ? Apr 30, 2014 15:11

Gucci Loafers: May 20, 2006; Ask yourself, do you really want to talk to pair of really nice gaudy shoes?

kloa posted:

I guess it could, depending on how the camera systems works (which I have no idea). I'm guessing the camera's either save a video of you running the light, save a compressed image of you running the light, or if it's really sophisticated, it could look up your license plate on-the-fly.

The first 2 options are probably human verified, so the SQL wouldn't work. It would have to be an automated system.
code:
SELECT *
FROM DMV_MASTER_DATABASE
WHERE LICENSE_PLATE = ?;
If the camera software was as simple as this, then you could throw something like ' OR 1=1; and it wouldn't ever grab your plate.

How come the ' OR 1=1; wouldn't read?

# ? Apr 30, 2014 15:49

stuxracer: May 4, 2006

Tab8715 posted:

How come the ' OR 1=1; wouldn't read?

It would read, but would return every record from the table since 1=1.

# ? Apr 30, 2014 16:14

spog: Aug 7, 2004; It's your own bloody fault.

http://www.snopes.com/autos/law/noplate.asp

quote:

Claim: A man whose car bore personalized license plates reading 'NO PLATE' received notices for thousands of unpaid parking tickets.

TRUE

Origins: Allowing motorists to obtain personalized plates provides them with an opportunity to obtain something distinctively unique, something that commands far more attention than the usual humdrum string of letters and digits. Sometimes, though, one's choice of license plate can command an unexpected and undesirable form of attention.

In 1979 a Los Angeles man named Robert Barbour found this out the hard way when he sent an application to the California Department of Motor No plate Vehicles (DMV) requesting personalized license plates for his car. The DMV form asked applicants to list three choices in case one or two of their desired selections had already been assigned. Barbour, a sailing enthusiast, wrote down "SAILING" and "BOATING" as his first two choices; when he couldn't think of a third option, he wrote "NO PLATE," meaning that if neither of his two choices was available, he did not want personalized plates. Plates reading "BOATING" and "SAILING" had indeed already been assigned, so the DMV, following Barbour's instructions literally, sent him license plates reading "NO PLATE." Barbour was not thrilled that the DMV had misunderstood his intent, but he opted to keep the plates because of their uniqueness.

Four weeks later he received his first notice for an overdue parking fine, from faraway San Francisco, and within days he began receiving dozens of overdue notices from all over the state on a daily basis. Why? Because when law enforcement officers ticketed illegally parked cars that bore no license plates, they had been writing "NO PLATE" in the license plate field. Now that Barbour had plates bearing that phrase, the DMV computers were matching every unpaid citation issued to a car with missing plates to him.

Barbour received about 2,500 notices over the next several months. He alerted the DMV to the problem, and they responded in a typically bureaucratic way by instructing him to change his license plates. But Barbour had grown too fond of his plates by then to want to change them, so he instead began mailing out a form letter in response to each citation. That method usually worked, although occasionally he had to appear before a judge and demonstrate that the car described on the citation was not his.

A couple of years later, the DMV finally caught on and sent a notice to law enforcement agencies requesting that they use the word NONE rather than NO PLATE to indicate a cited vehicle was missing its plates. This change slowed the flow of overdue notices Barbour received to a trickle, about five or six a month, but it also had an unintended side effect: Officers sometimes wrote MISSING instead of NONE to indicate cars with missing license plates, and suddenly a man named Andrew Burg in Marina del Rey started receiving parking tickets from places he hadn't visited either. Burg, of course, was the owner of a car with personalized plates reading "MISSING."

Nonetheless, some motorists still choose personalized plates destined to land them in similar trouble. Jim Cara of Elsmere, Delaware, found that out the hard way when he selected the phrase "NOTAG" for the license of his Suzuki Hayabusa motorcycle in 2004:

Jim Cara wanted a vanity license tag that would make people laugh.

But when he chose "NOTAG" for the plate on his Suzuki Hayabusa, a sleek blue and silver motorcycle with a speedometer that reaches 220 mph, the joke backfired.

The new tag arrived Saturday under an avalanche of Wilmington parking violations.

"All the traffic tickets say, 'Notice of violation. License number: no tag,'" Cara said.

City computers, talking to state Division of Motor Vehicles computers, had finally found an address for ticketed vehicles that lacked license tags: Cara's home in Elsmere.

"I messed up the system so bad," Cara said. "I wonder if they can put me in jail or something?"

He has received more than 200 violation notices. The mail carrier came twice on Saturday. Cara opened a few. They ranged from $55 to $125 for violations such as meter expirations.

Cara, 43, who works for the American Motorcycle Association, said he's been a lifelong prankster. This time, though, "the cleanup is going to be worse than the joke," he said.

Los Angeles Times columnist Steve Harvey collected a few more similar tales from readers in August 2004:
"A few days ago, you printed a bit about people getting notices of unpaid parking tickets on vehicles with license plates NOTAG and NO PLATE," wrote Richard Turner of Beverly Hills.

He recalled thinking, "It would be cute to have VOID as my license plate. It was cute for a few years, until I started getting the unpaid parking ticket notices. Apparently, 'void' tickets got keyed into computers as valid tickets, but with my plate. Although I got all the tickets dismissed, I ditched the plates."

And Ralph August of Westchester says a friend encountered the same barrage of strangers' parking tickets after he put an UNKNOWN plate on his car. The DMV took UNKNOWN away from him.

In October 2009, the Birmingham News reported on Hunstville, Alabama, resident Scottie Roberson, who � in homage to his nickname ("Racer X") and his favorite number (seven) � had obtained personalized plates bearing a string of seven X's: 'XXXXXXX.' Suddenly, within a year's time, Roberson received multiple mailed notices of parking violations, totaling more than $19,000 in fines, from the city of Birmingham � even though he had taken his car to that city on only a single occasion in the previous five years. The culprit was his license plate:

About a year ago, Roberson began receiving letters stating he had outstanding parking tickets, sometimes as many as 10 in one day in 10 places, he said.

Roberson said he has been to Birmingham only once in the past five years and left without a ticket. He said city officials told him the tickets were issued by mistake because of his vanity plate � XXXXXXX.

When Birmingham parking patrols find cars without license plates parked illegally or at expired meters, they enter seven X's in place of the plate number, city officials said. The parking citation form calls for a plate number, and the practice is to use X's when no number is available.

Read more at http://www.snopes.com/autos/law/noplate.asp#KsofYfPCCKdXZlDt.99

# ? Apr 30, 2014 16:15

kloa: Feb 14, 2007

stuxracer posted:

It would read, but would return every record from the table since 1=1.

Yeah, I probably should've put AND 1=2, which is always false. Then it wouldn't grab it.

# ? Apr 30, 2014 16:22

Gucci Loafers: May 20, 2006; Ask yourself, do you really want to talk to pair of really nice gaudy shoes?

stuxracer posted:

It would read, but would return every record from the table since 1=1.

I'm a little sql illiterate but wouldn't it just look for the string "OR 1=2" from the license_plate column in the DMV table?

# ? Apr 30, 2014 18:11

The MUMPSorceress: Jan 6, 2012; ^SHTPSTS; Gary’s Answer

spog posted:

http://www.snopes.com/autos/law/noplate.asp

This isn't even a SQL problem. This is a "people filling out the forms are stupid" problem. Why would you put a combinations of letters and numbers that could be a valid license plate number into the plate field for a car that has no plates. Draw one giant X or a big line through the box, problem solved.

# ? Apr 30, 2014 18:19

stuxracer: May 4, 2006

Tab8715 posted:

I'm a little sql illiterate but wouldn't it just look for the string "OR 1=2" from the license_plate column in the DMV table?

No. That is not the intent of including that.

# ? Apr 30, 2014 18:46

mobby_6kl: Aug 9, 2009; by Fluffdaddy

I'd also say it's highly unlikely, but possibe; we've seen larger security fuckups before.

More interestingly (and terrifyingly) about difficult to OCR plates:

Due to license plate reader error, cop approaches innocent man, weapon in hand
Mistaking a "7" for a "2" on wanted Oldsmobile, not a BMW, leads to traffic stop.
http://arstechnica.com/tech-policy/2014/04/due-to-license-plate-reader-error-cop-approaches-innocent-man-weapon-in-hand/

The cop had a gun out of the holster but didn't aim it. That's prpbably just a matter of time before some unrelated car gets shot up to hell based on ocr error. They already managed that with like two dissimilar trucks once so someone telling them that the plate was matched...

# ? Apr 30, 2014 19:38

kloa: Feb 14, 2007

Tab8715 posted:

I'm a little sql illiterate but wouldn't it just look for the string "OR 1=2" from the license_plate column in the DMV table?

You can read up on SQL injection on your own time, but the initial ' is to close the license plate WHERE clause early and then attach some kind of extra qualifier (AND 1=2) so that the full statement is false and never queries your license plate.

IE: The camera ticket would be saved normally, but if you attach a false statement, then the whole query brings back 0 results, instead of the speeders information.

# ? Apr 30, 2014 19:40

Inspector_666: Oct 7, 2003; _{benny with the good hair}

LeftistMuslimObama posted:

This isn't even a SQL problem. This is a "people filling out the forms are stupid" problem. Why would you put a combinations of letters and numbers that could be a valid license plate number into the plate field for a car that has no plates. Draw one giant X or a big line through the box, problem solved.

I would imagine it's also a "lovely software" problem, since on the little digital printers that lots of TCOs use nowadays they probably need to have a certain amount of alphanumeric inputs to specific fields in order to print.

# ? Apr 30, 2014 19:43

~Coxy: Dec 9, 2003; R.I.P. Inter-OS Sass - b.2000AD d.2003AD

LeftistMuslimObama posted:

This isn't even a SQL problem. This is a "people filling out the forms are stupid" problem. Why would you put a combinations of letters and numbers that could be a valid license plate number into the plate field for a car that has no plates. Draw one giant X or a big line through the box, problem solved.

That wouldn't solve the problem by itself because then all that happens is the transcriptionist entering the ticket into the database takes it upon herself to enter "MISSING" or "XXXXXXX" or "NO TAG" because the drat input field in the UI is compulsory. :v:

# ? May 1, 2014 04:37

The MUMPSorceress: Jan 6, 2012; ^SHTPSTS; Gary’s Answer

~Coxy posted:

That wouldn't solve the problem by itself because then all that happens is the transcriptionist entering the ticket into the database takes it upon herself to enter "MISSING" or "XXXXXXX" or "NO TAG" because the drat input field in the UI is compulsory.

DESIGN!!!!

# ? May 1, 2014 15:59

KillHour: Oct 28, 2007

I work for a company that sells Milestone software (https://www.milestonesys.com). They have an automatic LPR plugin. I'll give this a try some time next week - should be fun.

# ? Jul 3, 2014 04:09

SixFigureSandwich: Oct 30, 2004; Exciting Lemon

~Coxy posted:

That wouldn't solve the problem by itself because then all that happens is the transcriptionist entering the ticket into the database takes it upon herself to enter "MISSING" or "XXXXXXX" or "NO TAG" because the drat input field in the UI is compulsory.

Yeah, it seems easier for the DMV to not issue plates that are potentially confusing, like MISSING and VOID.

# ? Jul 3, 2014 12:07

Adbot: ADBOT LOVES YOU

# ? Apr 24, 2024 19:34

Inspector_666: Oct 7, 2003; _{benny with the good hair}

John Dough posted:

Yeah, it seems easier for the DMV to not issue plates that are potentially confusing, like MISSING and VOID.

We might as well start calling each other Comrade! :byodood:

# ? Jul 3, 2014 15:20

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > License plate SQL injection, would it work?