Further follow-up on the latest ASP. NET Security Vulnerabilities

Today, I went to the blog and saw ASP. net Security Vulnerabilities. The content is roughly: hackers can download ASP. net core file (web. config). You can download arbitrary files, such as databases.

This bug is basically fatal, but there are very few descriptions in the blog Park. After reading it for a long time, I didn't understand what it meant and how to attack it, so I went on mining. Write down some details.

 

Microsoft Original:

Http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx

How hackers initiate Attacks:

Code To understand how This Vulnerability works, you need to know about cryptographic into Les. An Oracle In The context of cryptography Is A system which provides hints As You ask it questions. In This   Case , There Is A vulnerability In ASP. NET which acts As A Padding oracle. This allows an attacker to send cipher text to the Web server and learn If It was decrypted properly by examining which error code was returned by the Web server. by making into such requests (and watching what errors are returned) the attacker can learn enough to successfully decrypt the rest of the cipher text.

 

The general meaning is about cryptographic oracle. Hackers repeatedly send information, detect returned error information, and then learn about encryptionAlgorithmAnd finally implement the attack. However, I still did not understand this paragraph, so I continued to search:

 

Http://visualstudiomagazine.com/articles/2010/09/14/aspnet-security-hack.aspx

This articleArticleDescribes the general attack process. As this problem has a huge impact, I will not translate Chinese, just to give a brief overview:

Code They can repeatedly modify an ASP. NET Forms authentication cookie encrypted Using AES and, by examining the errors returned, determine the machine key used to encrypt the cookie. The process Is Claimed to be 100 Percent reliable and takes 30 And 50 Minutes For Any site.

 

 

Two researchers found that they could use a tool to modify ASP. NET forms encrypted by AES to verify cookies, check the returned error information, and obtain the Machine Key. This process is 100% successful and only takes 30 minutes.

 

Code Once the Machine Key Is Determined, attackers can create bogus Forms authentication cookies. If site designers have chosen the option to embed role information In The security cookie, then attackers cocould arbitrarily assign themselves to administrator roles. This exposure also affects other membership provider features, Spoofing Protection on the viewstate, and encrypted information that might be stored In Cookies or otherwise be made available at the client.

 

 

Once the Machine Key is cracked, hackers can simulate the verification cookie. If the website designer starts the option and puts the security information into the security cookie, the attacker can obtain the administrator privilege. The impact scope includes: Membership provider, viewstate, and all information stored in the security cookie.

 

Code While the exposure Is Both wide and immediate, the fix Is Simple. The hack exploits a bug In . Net ' S implementation of AES encryption. the solution is to switch to one of the other encryption mechanisms -- To 3DES, for instance. since encryption for the membership and roles providers is handled by ASP. net, no modification of existing code shocould be required for Forms authentication.

 

This bug is due to a bug in the AES encryption algorithm. Therefore, the solution is to use des (A solution that was later verified to be incorrect).

 

Summary

--------------------

Keyword:

Security cookie, ASP. NET Forms authentication cookie, Machine Key, role information in the security cookie.

Generally, after Asp.net authentication is started and sensitive information is saved in the cookie of the authentication framework by using the AES encryption algorithm, hackers can obtain the machinekey and then obtain administrator privileges.

 

The problem is, what operations, deployment, and framework in Asp.net will be affected. So I further searched.

 

 

Attack method: padded Oracle attack

---------------------------------------

Article:Http://usenix.org/events/woot10/tech/full_papers/Rizzo.pdf

I am not clear about it, and I do not know what the relationship is with Oracle. However, a reply is detailed:

Code Before worrying too much, go to http: // Usenix.org/events/woot10/tech/full_papers/rizzo#and read the original paper from Rizzo and Duong (May 25th, 2010 ). the "padded Oracle attack" relies on a chaining block Cypher (common) but also requires the "oracle ". as some have correctly pointed out above, we need to have ASP. net (or Java since this is not unique. net) return the padding error exception. without that information, the exploit doesn't work. by default, this exception information is not reported by ASP. net and this is retriable behavior for Java. if you go to the aforementioned Link, I think you'll find more interesting reading RELATED TO CRACKING CAPTCHA using this exploit. however, that too requires cooperation from the Web site. it's great learning about exploits and even a little fun but the media sure scares a lot of people (and scares up a lot of clicks) by providing this hyperbole. one guy above said he was happy he used Java. read the PDF above and you will find Rizzo and Duong found the problem with Java (JSF but also Ruby on Rails) and then turned to see if the same exploit wowould work with ASP. net. technically, it is an exploit but if it doesn't happen with properly configured servers (or the default ASP. net configuration), it's much ado about nothing.

 

This problem not only exists in Asp.net, but also in Java. Technically, if you use the default Asp.net configuration, you do not need to worry about it (the so-called default configuration is to create a configuration for an Asp.net project without any modifications ).

 

Form Verification: Asp.net form authentication:

--------------------------------------------------

Http://www.codeproject.com/KB/aspnet/Forms_Auth_Internals.aspx

This is mainly because the permission framework of Asp.net is started, which is called form verification. The principle of this form verification is provided in the above connection.

 

 

Full text Summary

------------------------------------

Having browsed many pages and wasted an hour, I finally got a little clue.

The problem is that if you use the form verification framework provided by Microsoft, a security vulnerability may occur. hackers have cracked the machine key used to save security information and then obtained administrator privileges, download the Server File.

If the entire permission framework is self-written, you do not need to worry about it.

 

Fortunately, all my projectsCodeAnd framework code. Haha!

 

Subsequent supplements

--------------------------------------

Http://tech.ddvip.com/2008-12/1230195492102937.html

This article was published in and details the severe security vulnerabilities in Form Verification of Asp.net. I hope you will have a good time. Microsoft's encryption algorithm is too powerful, making it easy for hackers to copy a verification cookie.