Seen on Visual Studio Magazine

Two security researchers, Thai Duong and Juliano Rizzo, have discovered a bug in the default encryption mechanism used to protect the cookies normally used to implement Forms Authentication in ASP.NET. Using their tool (the Padding Oracle Exploit Tool or POET), they can repeatedly modify an ASP.NET Forms Authentication cookie encrypted using AES and, by examining the errors returned, determine the Machine Key used to encrypt the cookie. The process is claimed to be 100 percent reliable and takes between 30 and 50 minutes for any site.

Once the Machine Key is determined, attackers can create bogus forms authentication cookies. If site designers have chosen the option to embed role information in the security cookie, then attackers could arbitrarily assign themselves to administrator roles. This exposure also affects other membership provider features, spoofing protection on the ViewState, and encrypted information that might be stored in cookies or otherwise be made available at the client.

While the exposure is both wide and immediate, the fix is simple. The hack exploits a bug in .NET's implementation of AES encryption. The solution is to switch to one of the other encryption mechanisms -- to 3DES, for instance. Since encryption for the membership and roles providers is handled by ASP.NET, no modification of existing code should be required for Forms Authentication.

The encryption method can be set in the web.config file for a site, in IIS 7 for a Web server, or in the config file for .NET on a server in %SYSTEMROOT%\Microsoft.NET\Framework\version\CONFIG\. On 64-bit systems, it must also be set in %SYSTEMROOT%\Microsoft.NET\Framework64\version\CONFIG\. A typical entry would look like this:

    <machineKey validationKey="AutoGenerate,IsolateApps"         
                           validation="3DES"                           
                           decryptionKey="AutoGenerate,IsolateApps"
                           decryption="3DES" />  

On a Web farm, this setting will have to be made on all the servers in the farm.

These settings are also used to prevent spoofing (ViewState data is encoded but not encrypted), so making this change will also switch the ViewState to using 3DES. Developers who are using AES in their code to encrypt information made available at the client should consider modifying their code to use a different encryption mechanism.

Other Posts:

Google instant makes searching for God harder

Tabnabbing: A New Kind Of Phishing Attack

Big news in security: 1024-bit RSA encryption cracked!

Tips to enhance your SQL Server security

What is LDAP injection?

Jeff Atwood recently posted on the topic of sorting strings in a more natural order that the default string sorting gives us.  His main point is, when we’re dealing with numbers, a simple alphabetic sorting doesn’t cut it.

So. just for fun, here’s my little C# 2.0 Implementation of a more human-friendly sorter.

public class FriendlySorter<T> : IComparer<T>

{

    publicint Compare(T x, T y)

    {

        if (x == null || y == null) return 0;

        if (x.ToString() == y.ToString()) return 0;

 

        string[] left = Regex.Split(x.ToString(), "([0-9]+)");

        string[] right = Regex.Split(y.ToString(), "([0-9]+)");

 

        int index = 0;

 

        while (true)

        {

            while (left[index] == right[index]) index++;

 

            if (left.Length == index && right.Length == index) return 0;

            if (left.Length <= index) return -1;

            if (right.Length <= index) return 1;

 

            try

            {

                return (int.Parse(left[index]) - int.Parse(right[index]));

            }

            catch

            {

                int CompareResult = String.Compare(left[index], right[index]);

                if (CompareResult != 0) return CompareResult;

            }

 

            index++;

        }

    }

}

The following code :

List<string> list = newList<string>();

 

list.Add("Track 1 : abc");

list.Add("Track 2 : abc");

list.Add("Track 10 : abc");

list.Add("Track 5 : abc");

list.Add("Track 11 : abc");

list.Add("Track 22 : abc");

list.Add("Track 9 : abc");

 

list.Sort(newFriendlySorter<string>());

Will produce the results :

For small sets the performance is Ok.  But when dealing with a larger amount of data (1000+ items), the sorting performance drops a lot (I currently have 5 seconds to sort 1000 random elements).  I will probably try to enhance it in the future and update this post.

Happy holidays !

It’s simply amazing! Scott Guthrie announced today that the .NET framework source code is going to be released later this year.  He says it will be released at the same time that Visual Studio 2008 and the 3.5 Framework are going to be released.  This means that you will be able to drill down inside the framework when debugging your applications in Visual Studio 2008.

This is a bold move from Microsoft’s part by any standards.  I think the motivation behind this release is two-fold:

1. This seems to be part of a larger company-wide politic to show to developers that Microsoft genuinely care about them.

2. They also need to work with the flow.  More and more, tools like Lutz Roeder’s .NET Reflector (a utility and Visual Studio plugin to decompile and visualize .NET assemblies) are becoming popular and the Framework is, for all intent and purposes, already opened and ripped apart.  I look at classes of the framework myself using this tool from time to time.

All that being said, this is really great news and I can’t wait to play with this and see the internals of the framework “in action”.

Click here to view the full article from Scott.

If you don’t know who Scott Guthrie is..  Well he’s the team leader for :

• IIS
• ASP.NET
• The AJAX Toolkit
• The CLR
• The Compact Framework
• Windows Forms
• Commerce Server
• Visual Web Developer 2005
• Visual Studio Tools for WPF

In others words, if you love your job as a programmer using Microsoft’s technologies, it’s because of this guy.