Re:Security researchers 'destroy' Microsoft ASP.NET security
by mrkurt on Friday September 17, 2010 @01:20PM
(#1701934)
The default "user is logged in" cookie in ASP.NET is vulnerable to this, since that cookie value is just an encrypted username. An evildoer (even a relatively unskilled one) could use this attack to login to an ASP.NET app as anyone they wanted.
[ Parent
| on HN ]
Re:Security researchers 'destroy' Microsoft ASP.NET security
by bradhe on Friday September 17, 2010 @01:27PM
(#1701980)
To decrypt it you need an exception message...so turn on custom errors and you're protected it seems. Assuming you don't do that, once you decrypt it you get what, a session ID? Then what?
Re:Security researchers 'destroy' Microsoft ASP.NET security
by storm on Friday September 17, 2010 @02:03PM
(#1702131)
You apparently don't need the exception message at all. This was all discussed on the thread 3 days ago: http://news.ycombinator.com/item?id=1687547
Re:Security researchers 'destroy' Microsoft ASP.NET security
by tptacek on Friday September 17, 2010 @04:12PM
(#1702651)
All they need is distinguishable errors when decrypts fail. The contents of the error are irrelevant. You can send a bare 500 with no content and still be trivially vulnerable to this attack.
Re:Security researchers 'destroy' Microsoft ASP.NET security
by bradhe on Friday September 17, 2010 @05:44PM
(#1702938)
Fair enough, I guess I didn't understand the attack thoroughly.
Re:Security researchers 'destroy' Microsoft ASP.NET security
by mrkurt on Friday September 17, 2010 @02:32PM
(#1702233)
Besides what storm said: decrypting isn't the problem, being able to encrypt a new cookie is. If I can "bradhe" as my username in my own cookie, the default ASP.NET forms auth will consider me logged in as you.