Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
ShadowMoo
Mar 13, 2011

by Shine


Read an old story about people trying to put SQL code on their plates to fool traffic cams. To someone who has extremely limited experience with SQL, would this actually work?

Adbot
ADBOT LOVES YOU

kloa
Feb 14, 2007




I guess it could, depending on how the camera systems works (which I have no idea). I'm guessing the camera's either save a video of you running the light, save a compressed image of you running the light, or if it's really sophisticated, it could look up your license plate on-the-fly.

The first 2 options are probably human verified, so the SQL wouldn't work. It would have to be an automated system.

code:
SELECT *
FROM DMV_MASTER_DATABASE
WHERE LICENSE_PLATE = ?;
If the camera software was as simple as this, then you could throw something like ' OR 1=1; and it wouldn't ever grab your plate.

SixFigureSandwich
Oct 30, 2004


Exciting Lemon

There are systems that actually read the license plate that is on your car. Beyond that I have no idea how that data is processed.

thebigcow
Jan 3, 2001

Bully!

will they charge you destruction of police property or something more interesting

HalloKitty
Sep 30, 2005

Adjust the bass and let the Alpine blast


http://gizmodo.com/5498412/sql-injection-license-plate-hopes-to-foil-euro-traffic-cameras

But no follow up, sadly.

dissss
Nov 10, 2007

I'm a terrible forums poster with terrible opinions.

Here's a cat fucking a squid.

You're supposed to name your child with an awkward string, not try and get it onto a license plate

http://xkcd.com/327/

Anyway the only way SQL injection can work is if the system in question does not handle query parameterisation properly. Even if the reading system doesn't do this you only have a few characters to work with, and the licensing authority is only going to allow a limited character set.

pram
Jun 10, 2001


Yes because license plate numbers have semicolons and parentheses

Lum
Aug 13, 2003



(Note: This is written from a UK perspective)

I'm going to go with no.

Firstly the most common types of speed camera out there, Gatso and Truvelo, take photographs onto film which is then manually viewed by a police officer to determine if an offence has taken place and if so the vehicle details are keyed in manually. You'd have to get a particularly dumb officer to actually enter all that stuff by hand.

Even for the cameras that do read number plates (digital Gatso, SPECS, ANPR etc.), there is one big flaw in the SQL injection plan, which is that a licence plate is only 7 characters long (I believe this can go up to 9 in the USA?) so you wouldn't be able to get any meaningful SQL command in there.

What would happen is one of two things.
  1. Eventually you'll get seen by a copper and pulled over for driving with obscured number plates, which will likely get you a small fine and told to fix it.
  2. As #1 but you'll get a copper who knows what SQL injection is and instead of being told to fix it you'll get charged with attempting to pervert the course of justice which carries much higher penalties including a possible prison sentence.
You'd be much better off just buying one of the many camera detecting devices out there, the GPS+database based ones work very well, or learn to be particularly observant while speeding! (which is probably good advice anyway)

ArchetypeAnarch
Apr 1, 2014


Assuming that the system is even automated (as was pointed out earlier that certain systems still require manual data entry) if the software employs even the lightest of input sanitation (eg. encoding/escaping special characters) or user based restricted permissions to the database, none of those attacks would get through. Clever idea though. Its XKCD's "Little Bobbie Tables" personified.

adorai
Nov 2, 2002

10/27/04 Never forget

Grimey Drawer

ArchetypeAnarch posted:

Assuming that the system is even automated (as was pointed out earlier that certain systems still require manual data entry) if the software employs even the lightest of input sanitation (eg. encoding/escaping special characters) or user based restricted permissions to the database, none of those attacks would get through. Clever idea though. Its XKCD's "Little Bobbie Tables" personified.
as a consolation prize, it will probably make your plate immune to being recognized.

Straker
Nov 10, 2005


Red light cameras take pictures a couple seconds apart so they can (for example) tell if you were just slow making a left hand turn as the light changed, or that sort of thing, and obviously a human has to go through all those, so no even if their software was poorly written (lowest bidder and all) I can't see this plan working very well.

Lum
Aug 13, 2003



adorai posted:

as a consolation prize, it will probably make your plate immune to being recognized.

Yes, but as I mentioned before, it'll get you in trouble for attempting to pervert the course of justice.

You'd be better off sticking a sign over your plate saying "I am a fuckwit" (insert your preferred slur here) and then denying all knowledge of it being there and removing it as soon as you get pulled over. Not your fault you never noticed someone vandalising your car right?

Fortuitous Bumble
Jan 5, 2007



Yeah even if it worked you'd be better off placing the strings on other people's cars if your goal was to cause trouble. Kind of like that Japanese hacker dude that sent threatening emails through a collar on a stray cat.

Shaocaholica
Oct 29, 2002

Fig. 5E


Or you could just stick with the:

00OO00OO

II11II11II

XKXKXKXK

MNMNNNMN


plates

Straker
Nov 10, 2005


License plates are easily OCRed for a reason though, that would be useless. I think old fashioned is probably better, if you want to be an annoying little poo poo get one of those tacky translucent yellow license plate covers or my favorite, from one of those stupid old anarchist handbooks/jolly roger cookbook type things: steal someone's plates, put them on another car, then put the second car's plates on your own :v:

edit: I just realized it should be pretty trivial to use a chunk of privacy filter to make your license plate unreadable from an angle, such as speed/red light cameras, without immediately getting pulled over, but on the other hand if you ever parked in public you'd be hosed once any kind of cop/meter reader notices your plate looks black from eye level when you're standing by the car

Straker fucked around with this message at 23:24 on Apr 27, 2014

~Coxy
Dec 9, 2003

R.I.P. Inter-OS Sass - b.2000AD d.2003AD

Lifehack: if you buy a 9 character vanity plate, you can get out of traffic fines by responding to the demand letter with the objection that the listed number plate in the letter isn't yours.
Whichever form printing software they use cuts it down to 8 chars for whatever reason.

Worked for several years in my state, unfortunately I think they fixed it recently.

Westie
May 30, 2013



Baboon Simulator


Shaocaholica posted:

Or you could just stick with the:

00OO00OO

II11II11II

XKXKXKXK

MNMNNNMN


plates

II11II11II is a VRM that appears on ANPR equipment quite often - some ANPR equipment erroneously picks up gates and fences as registration plates, lol.

Shaocaholica
Oct 29, 2002

Fig. 5E


I wonder what the error rate is with similar chars like 1/I, M/N, K/X, 0/O etc. Given that the cameras have limited resolution and lighting conditions etc etc.

President Ark
May 16, 2010

:iiam:


I'm pretty sure that'd only work once and then after that they'd just go "Oh, it's that douchebag Jon Doe with the license plate that's all Ks and Xs. We have his address bookmarked, send him a ticket."

Shaocaholica
Oct 29, 2002

Fig. 5E


President Ark posted:

I'm pretty sure that'd only work once and then after that they'd just go "Oh, it's that douchebag Jon Doe with the license plate that's all Ks and Xs. We have his address bookmarked, send him a ticket."

Except with say 8 chars there's 2^8 (256) possible combinations of 2 like chars so thats 256 potential douchebags.

wdarkk
Oct 26, 2007

Friends: Protected
World: Saved
Crablettes: Eaten


Shaocaholica posted:

Except with say 8 chars there's 2^8 (256) possible combinations of 2 like chars so thats 256 potential douchebags.

Unless they own the same car in the same color it'll still be easy.

FatCow
Apr 22, 2002
I MAP THE FUCK OUT OF PEOPLE


pram posted:

Yes because license plate numbers have semicolons and parentheses

They do in NC.

Lum
Aug 13, 2003



wdarkk posted:

Unless they own the same car in the same color it'll still be easy.

<Insert BMW joke>

cynic
Jan 19, 2004





Maybe not on speed cameras, but there are plenty of automatic number plate recognition systems around for things like congestion charges, tax disc checks, private carparks etc, and a quick read does indicate that these are often uploaded to web services at some point - they may also be running embedded databases for upload in batches, and often connected to other systems, such as automated billing systems. But you're relying on several things namely;

None of the code has checks on length.
None of the code has checks on valid characters (for instance you'd imagine that ' would get discarded by license plate recognition systems as being "probably a dead bee instead of a valid character").
None of the code escapes characters correctly.
There are no human checks in place before entry to the database.

It's not impossible, but I'd be very surprised if there were any systems you could compromise in that way.

nexxai
Jul 17, 2002

quack quack bjork

Fun Shoe


(Not mine.)

Crosby B. Alfred
May 20, 2006


kloa posted:

I guess it could, depending on how the camera systems works (which I have no idea). I'm guessing the camera's either save a video of you running the light, save a compressed image of you running the light, or if it's really sophisticated, it could look up your license plate on-the-fly.

The first 2 options are probably human verified, so the SQL wouldn't work. It would have to be an automated system.

code:
SELECT *
FROM DMV_MASTER_DATABASE
WHERE LICENSE_PLATE = ?;
If the camera software was as simple as this, then you could throw something like ' OR 1=1; and it wouldn't ever grab your plate.

How come the ' OR 1=1; wouldn't read?

stuxracer
May 4, 2006



Tab8715 posted:

How come the ' OR 1=1; wouldn't read?
It would read, but would return every record from the table since 1=1.

spog
Aug 7, 2004

It's your own bloody fault.


http://www.snopes.com/autos/law/noplate.asp

quote:

Claim: A man whose car bore personalized license plates reading 'NO PLATE' received notices for thousands of unpaid parking tickets.

TRUE

Origins: Allowing motorists to obtain personalized plates provides them with an opportunity to obtain something distinctively unique, something that commands far more attention than the usual humdrum string of letters and digits. Sometimes, though, one's choice of license plate can command an unexpected and undesirable form of attention.

In 1979 a Los Angeles man named Robert Barbour found this out the hard way when he sent an application to the California Department of Motor No plate Vehicles (DMV) requesting personalized license plates for his car. The DMV form asked applicants to list three choices in case one or two of their desired selections had already been assigned. Barbour, a sailing enthusiast, wrote down "SAILING" and "BOATING" as his first two choices; when he couldn't think of a third option, he wrote "NO PLATE," meaning that if neither of his two choices was available, he did not want personalized plates. Plates reading "BOATING" and "SAILING" had indeed already been assigned, so the DMV, following Barbour's instructions literally, sent him license plates reading "NO PLATE." Barbour was not thrilled that the DMV had misunderstood his intent, but he opted to keep the plates because of their uniqueness.

Four weeks later he received his first notice for an overdue parking fine, from faraway San Francisco, and within days he began receiving dozens of overdue notices from all over the state on a daily basis. Why? Because when law enforcement officers ticketed illegally parked cars that bore no license plates, they had been writing "NO PLATE" in the license plate field. Now that Barbour had plates bearing that phrase, the DMV computers were matching every unpaid citation issued to a car with missing plates to him.

Barbour received about 2,500 notices over the next several months. He alerted the DMV to the problem, and they responded in a typically bureaucratic way by instructing him to change his license plates. But Barbour had grown too fond of his plates by then to want to change them, so he instead began mailing out a form letter in response to each citation. That method usually worked, although occasionally he had to appear before a judge and demonstrate that the car described on the citation was not his.

A couple of years later, the DMV finally caught on and sent a notice to law enforcement agencies requesting that they use the word NONE rather than NO PLATE to indicate a cited vehicle was missing its plates. This change slowed the flow of overdue notices Barbour received to a trickle, about five or six a month, but it also had an unintended side effect: Officers sometimes wrote MISSING instead of NONE to indicate cars with missing license plates, and suddenly a man named Andrew Burg in Marina del Rey started receiving parking tickets from places he hadn't visited either. Burg, of course, was the owner of a car with personalized plates reading "MISSING."

Nonetheless, some motorists still choose personalized plates destined to land them in similar trouble. Jim Cara of Elsmere, Delaware, found that out the hard way when he selected the phrase "NOTAG" for the license of his Suzuki Hayabusa motorcycle in 2004:

Jim Cara wanted a vanity license tag that would make people laugh.

But when he chose "NOTAG" for the plate on his Suzuki Hayabusa, a sleek blue and silver motorcycle with a speedometer that reaches 220 mph, the joke backfired.

The new tag arrived Saturday under an avalanche of Wilmington parking violations.

"All the traffic tickets say, 'Notice of violation. License number: no tag,'" Cara said.

City computers, talking to state Division of Motor Vehicles computers, had finally found an address for ticketed vehicles that lacked license tags: Cara's home in Elsmere.

"I messed up the system so bad," Cara said. "I wonder if they can put me in jail or something?"

He has received more than 200 violation notices. The mail carrier came twice on Saturday. Cara opened a few. They ranged from $55 to $125 for violations such as meter expirations.

Cara, 43, who works for the American Motorcycle Associa
tion, said he's been a lifelong prankster. This time, though, "the cleanup is going to be worse than the joke," he said.

Los Angeles Times columnist Steve Harvey collected a few more similar tales from readers in August 2004:
"A few days ago, you printed a bit about people getting notices of unpaid parking tickets on vehicles with license plates NOTAG and NO PLATE," wrote Richard Turner of Beverly Hills.

He recalled thinking, "It would be cute to have VOID as my license plate. It was cute for a few years, until I started getting the unpaid parking ticket notices. Apparently, 'void' tickets got keyed into computers as valid tickets, but with my plate. Although I got all the tickets dismissed, I ditched the plates."


And Ralph August of Westchester says a friend encountered the same barrage of strangers' parking tickets after he put an UNKNOWN plate on his car. The DMV took UNKNOWN away from him.

In October 2009, the Birmingham News reported on Hunstville, Alabama, resident Scottie Roberson, who in homage to his nickname ("Racer X") and his favorite number (seven) had obtained personalized plates bearing a string of seven X's: 'XXXXXXX.' Suddenly, within a year's time, Roberson received multiple mailed notices of parking violations, totaling more than $19,000 in fines, from the city of Birmingham even though he had taken his car to that city on only a single occasion in the previous five years. The culprit was his license plate:

About a year ago, Roberson began receiving letters stating he had outstanding parking tickets, sometimes as many as 10 in one day in 10 places, he said.

Roberson said he has been to Birmingham only once in the past five years and left without a ticket. He said city officials told him the tickets were issued by mistake because of his vanity plate XXXXXXX.

When Birmingham parking patrols find cars without license plates parked illegally or at expired meters, they enter seven X's in place of the plate number, city officials said. The parking citation form calls for a plate number, and the practice is to use X's when no number is available.

Read more at http://www.snopes.com/autos/law/noplate.asp#KsofYfPCCKdXZlDt.99

kloa
Feb 14, 2007




stuxracer posted:

It would read, but would return every record from the table since 1=1.

Yeah, I probably should've put AND 1=2, which is always false. Then it wouldn't grab it.

Crosby B. Alfred
May 20, 2006


stuxracer posted:

It would read, but would return every record from the table since 1=1.

I'm a little sql illiterate but wouldn't it just look for the string "OR 1=2" from the license_plate column in the DMV table?

The MUMPSorceress
Jan 6, 2012


^SHTPSTS



Gary’s Answer


This isn't even a SQL problem. This is a "people filling out the forms are stupid" problem. Why would you put a combinations of letters and numbers that could be a valid license plate number into the plate field for a car that has no plates. Draw one giant X or a big line through the box, problem solved.

stuxracer
May 4, 2006



Tab8715 posted:

I'm a little sql illiterate but wouldn't it just look for the string "OR 1=2" from the license_plate column in the DMV table?
No. That is not the intent of including that.

mobby_6kl
Aug 9, 2009



I'd also say it's highly unlikely, but possibe; we've seen larger security fuckups before.

More interestingly (and terrifyingly) about difficult to OCR plates:

Due to license plate reader error, cop approaches innocent man, weapon in hand
Mistaking a "7" for a "2" on wanted Oldsmobile, not a BMW, leads to traffic stop.
http://arstechnica.com/tech-policy/2014/04/due-to-license-plate-reader-error-cop-approaches-innocent-man-weapon-in-hand/

The cop had a gun out of the holster but didn't aim it. That's prpbably just a matter of time before some unrelated car gets shot up to hell based on ocr error. They already managed that with like two dissimilar trucks once so someone telling them that the plate was matched...

kloa
Feb 14, 2007




Tab8715 posted:

I'm a little sql illiterate but wouldn't it just look for the string "OR 1=2" from the license_plate column in the DMV table?

You can read up on SQL injection on your own time, but the initial ' is to close the license plate WHERE clause early and then attach some kind of extra qualifier (AND 1=2) so that the full statement is false and never queries your license plate.

IE: The camera ticket would be saved normally, but if you attach a false statement, then the whole query brings back 0 results, instead of the speeders information.

Inspector_666
Oct 7, 2003

benny with the good hair


LeftistMuslimObama posted:

This isn't even a SQL problem. This is a "people filling out the forms are stupid" problem. Why would you put a combinations of letters and numbers that could be a valid license plate number into the plate field for a car that has no plates. Draw one giant X or a big line through the box, problem solved.

I would imagine it's also a "lovely software" problem, since on the little digital printers that lots of TCOs use nowadays they probably need to have a certain amount of alphanumeric inputs to specific fields in order to print.

~Coxy
Dec 9, 2003

R.I.P. Inter-OS Sass - b.2000AD d.2003AD

LeftistMuslimObama posted:

This isn't even a SQL problem. This is a "people filling out the forms are stupid" problem. Why would you put a combinations of letters and numbers that could be a valid license plate number into the plate field for a car that has no plates. Draw one giant X or a big line through the box, problem solved.

That wouldn't solve the problem by itself because then all that happens is the transcriptionist entering the ticket into the database takes it upon herself to enter "MISSING" or "XXXXXXX" or "NO TAG" because the drat input field in the UI is compulsory. :v:

The MUMPSorceress
Jan 6, 2012


^SHTPSTS



Gary’s Answer

~Coxy posted:

That wouldn't solve the problem by itself because then all that happens is the transcriptionist entering the ticket into the database takes it upon herself to enter "MISSING" or "XXXXXXX" or "NO TAG" because the drat input field in the UI is compulsory. :v:

DESIGN!!!!

KillHour
Oct 28, 2007



I work for a company that sells Milestone software (https://www.milestonesys.com). They have an automatic LPR plugin. I'll give this a try some time next week - should be fun.

SixFigureSandwich
Oct 30, 2004


Exciting Lemon

~Coxy posted:

That wouldn't solve the problem by itself because then all that happens is the transcriptionist entering the ticket into the database takes it upon herself to enter "MISSING" or "XXXXXXX" or "NO TAG" because the drat input field in the UI is compulsory. :v:

Yeah, it seems easier for the DMV to not issue plates that are potentially confusing, like MISSING and VOID.

Adbot
ADBOT LOVES YOU

Inspector_666
Oct 7, 2003

benny with the good hair


John Dough posted:

Yeah, it seems easier for the DMV to not issue plates that are potentially confusing, like MISSING and VOID.

We might as well start calling each other Comrade! :byodood:

  • Locked thread