Security researchers 'destroy' Microsoft ASP.NET security

Re:Security researchers 'destroy' Microsoft ASP.NET security by tptacek on Friday September 17, 2010 @05:18PM (#1702877)

You have their deck or their paper? URL? I'm a casual acquaintance of both Juliano and Thai, and friends with other Netifera people, and so all I have to go on is what they've told me. I'd be interested in reading the actual material.

You have it, right? You sound like you do. Otherwise, how would you know how serious the issue is?

[ Parent | on HN ]

Re:Security researchers 'destroy' Microsoft ASP.NET security by ergo98 on Friday September 17, 2010 @06:41PM (#1703074)

That's a nice shtick (the defensive bit was my favourite addition). It's also facile.

They specifically detailed that it's an AES cookie encryption attack, yet you're acting like I'm going on a limb saying that?

[ Parent | on HN ]

Re:Security researchers 'destroy' Microsoft ASP.NET security by wglb on Friday September 17, 2010 @10:55PM (#1703585)

So it isn't exactly an AES Cookie Encryption Attack, it is actually worse: http://www.ekoparty.org/juliano-rizzo-2010.php

The most significant new discovery is an universal Padding Oracle affecting every ASP.NET web application. In short, you can decrypt cookies, view states, form authentication tickets, membership password, user data, and anything else encrypted using the framework's API!

[ Parent | on HN ]

Re:Security researchers 'destroy' Microsoft ASP.NET security by wglb on Friday September 17, 2010 @07:39PM (#1703211)

Where did they specifically detail that it is an AES cookie encryption attack?

[ Parent | on HN ]

Re:Security researchers 'destroy' Microsoft ASP.NET security by tptacek on Friday September 17, 2010 @07:57PM (#1703255)

They didn't; this commenter has decided that he can easily infer the details of a presentation he hasn't seen from how it's reported in the trade press.

[ Parent | on HN ]