Slashdot Mirror

← Back to Stories (view on slashdot.org)

New Crypto Attack Affects Millions of ASP.NET Apps

Posted by CmdrTaco on from the duck-and-cover dept.

Trailrunner7 writes "A pair of security researchers have implemented an attack that exploits the way that ASP.NET Web applications handle encrypted session cookies, a weakness that could enable an attacker to hijack users' online banking sessions and cause other severe problems in vulnerable applications. Experts say that the bug, which will be discussed in detail at the Ekoparty conference in Argentina this week, affects millions of Web applications."

2 of 156 comments (clear)

  1. Not so bad after all... by EvilRyry · · Score: 4, Informative

    >If the padding is invalid, the error message that the sender gets will give him some information about the way that the site's decryption process works.

    This is one reason you should send user friendly error messages to your consumers instead of stack traces, stack traces can contain details that an attacker could use against you. It sounds like you're safe if you're following best practices already.

  2. Re:Who knew! by Anonymous Coward · · Score: 4, Informative

    What a surprise, encryption has flaws!

    Nope, the cryptography is still flawless. ASP.NET just failed to use it correctly. AES-CBC would be perfectly secure if they used MAC to authenticate the data. MACs have been a critical part of crypto protocol design since the "DES ages" and padding oracle attacks have been known since 2002.
    Just like RC4 is still secure if used properly, but WEP is broken due to protocol flaws (the problems with RC4 were known before WEP was designed).

    So kids, make sure you always use MAC with your ciphers.