New Crypto Attack Affects Millions of ASP.NET Apps

Trailrunner7 writes "A pair of security researchers have implemented an attack that exploits the way that ASP.NET Web applications handle encrypted session cookies, a weakness that could enable an attacker to hijack users' online banking sessions and cause other severe problems in vulnerable applications. Experts say that the bug, which will be discussed in detail at the Ekoparty conference in Argentina this week, affects millions of Web applications."

Comments

Re:Not so bad after all...

[Neil Watson]

> Professionally, it's about the equivalent of setting your root password on a machine to 'password'.

That certainly never happens.