Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Update on ASP.NET Vulnerability (asp.net)
13 points by ronnier on Sept 24, 2010 | hide | past | favorite | 2 comments


Backstory: ASP.NET relies, in several places, on AES (or 3DES) blobs that it bounces off clients in cookies, in the Viewstate, and in URL arguments. The underlying implementation of block cipher encryption (in general --- not just AES) is vulnerable to a devastating side channel attack that allows attackers to "crack" the ciphertext byte-by-byte, instead of in 128-bit blocks.

It's good (and unsurprising) to see Microsoft taking this so seriously. I recommend that you follow their advice on workarounds. While doing so, keep in mind that the framework is still bouncing encrypted blobs off clients and relying totally on the notion that clients can't read them, and that the underlying problem (the server's behavior changes based on whether padding is valid) is still there. Keep your eyes open.


Also one of the researchers behind POET recommends this tool:

http://huagati.blogspot.com/2010/09/testing-aspnet-poet-snif...




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: