Slashdot Mirror

← Back to Stories (view on slashdot.org)

New Crypto Attack Affects Millions of ASP.NET Apps

Posted by CmdrTaco on from the duck-and-cover dept.

Trailrunner7 writes "A pair of security researchers have implemented an attack that exploits the way that ASP.NET Web applications handle encrypted session cookies, a weakness that could enable an attacker to hijack users' online banking sessions and cause other severe problems in vulnerable applications. Experts say that the bug, which will be discussed in detail at the Ekoparty conference in Argentina this week, affects millions of Web applications."

2 of 156 comments (clear)

  1. Re:Who knew! by ammorais · · Score: 5, Interesting

    What a surprise, encryption has flaws!

    RTFA. It's not about flaws in encryption. It's about "ASP.NET's implementation of AES has a bug in the way that it deals with errors when the encrypted data in a cookie has been modified"
    So it's the ASP.NET AES implementation that has flaws. The problem seems to be that the errors reveal enough information about how to decrypt the data.

  2. Re:when it comes to anything important: by TheNinjaroach · · Score: 5, Insightful

    roll your own at the lowest possible layer. anything else and you're leaving your chin open.

    I don't know about that. I'm not out to write my own implementation of OpenSSL anytime soon. Some tasks are simply best left to field experts.

    --
    I went to eat some animal crackers and the box said, "Do not eat if seal is broken." I opened the box and sure enough..