Microsoft ASP.NET Security Vulnerability: The 'Padding Oracle' Attack

Early this week, a couple of security researchers, Juliano Rizzo and Thai Duong, have implemented an attack that exploits the way ASP.NET applications handle encrypted session cookies (see more details here). They have discussed this in detail during the Ekoparty conference in Argentina. Their research paper is Practical Padding Oracle Attacks.

In the context of cryptography, an oracle is a system that provides hints as you ask it questions. And this attack explores a vulnerability in ASP.NET which acts as a padding oracle. This vulnerability is explained in details in Understanding the ASP.NET Vulnerability.

This vulnerability allows attackers to have access to decrypt the information stored in the ViewState object. If sensitive information is stored there, such as passwords or database connection strings, then this data is compromised. If an ASP.NET application is using ASP.NET 3.5 SP1 or above, the attacker could use this encryption vulnerability to request the contents of an arbitrary file which the worker process has access to, for example, the web.config file.

Microsoft has released a security advisory about the problem: Microsoft Security Advisory (2416728). If you or your clients have ASP.NET Web sites, then you must apply the necessary changes as described here: Scott Guthrie: ASP.NET Security Vulnerability

Update: Also take a look at Scott Guthrie's FAQ about AS.NET Security Vulnerability.

Microsoft SDL Threat Modeling Tool

Microsoft announced the new SDL Threat Modeling Tool during the Tech-Ed EMEA 2008. The Security Development Lifecycle (SDL) is a Microsoft methodology which consists of a series of best practices for software developers and architects to evaluate and consider security issues when designing a product.

The Microsoft SDL Threat Modeling Tool is part of the design phase of the SDL and allows software architects to identify and mitigate potential security issues early, when they are relatively easy and cost-effective to solve. With this tool, architects can communicate about the security design of their systems, analyze those designs for potential security issues and suggest and manage mitigations for security issues.

See a demo of the SDL Threat Modeling Tool v3 or download it from here.

Also, if you will be attending Edmonton Code Camp 2008 at the end of this month, David Woods will be doing a talk on Threat Modeling.

Testing your Security IQ

MSDN magazine published a new article about code security where you can take a code security quiz to test your security IQ:

http://msdn.microsoft.com/en-us/magazine/cc982154.aspx

For more information about .NET security, see:

• Michael Howard's Web Log
• The Security Development Lifecycle
• .NET Security
• Patterns & Practices: Security Engineering