HomeCalendarCertificationsColumnsFeaturesForumResourcesVitals
 
Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.
Lost Password?
No account yet? Register
Who's Online
We have 37 guests and 1 member online
 
Advertisement

You are here: Home arrow Resourcesarrow News from the Outside Worldarrow Demo of the ASP.NET Crypto Attack
EH-Net
May 22, 2013, 05:23:44 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
« previous next »
  Print  
Author Topic: Demo of the ASP.NET Crypto Attack  (Read 4971 times)
0 Members and 1 Guest are viewing this topic.
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« on: September 20, 2010, 10:02:15 PM »
Quote
In this video, researchers Juliano Rizzo and Thai Duong demonstrate the technique they developed for stealing cryptographic keys for ASP.NET Web applications, enabling them to compromise virtually any app built on ASP.NET.

http://threatpost.com/en_us/blogs/demo-aspnet-padding-oracle-attack-091710?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+Popular
Logged
~~~~~~~~~~~~~~
Ketchup
ajohnson
Recruiters
Hero Member
*
Offline Offline

Posts: 1057


aka dynamik


View Profile WWW
« Reply #1 on: September 20, 2010, 10:12:26 PM »
Good info! I'm working with a sensitive client that's been worried about this.

Here's the fix from MS too: http://threatpost.com/en_us/blogs/microsoft-publishes-new-fixit-tool-dll-bug-090110
Logged
WIP: GCFA | www.infosiege.net | @infosiege

The day you stop learning is the day you start becoming obsolete.
dante
Jr. Member
**
Offline Offline

Posts: 58



View Profile
« Reply #2 on: September 23, 2010, 01:11:46 PM »
Quote from: dynamik on September 20, 2010, 10:12:26 PM
Here's the fix from MS too: http://threatpost.com/en_us/blogs/microsoft-publishes-new-fixit-tool-dll-bug-090110

The link points to fixing dll hijacking vulnerability. The op is about ASP.Net Crypto vulnerability. I guess there is no fix right now. But there are mitigations..

http://www.troyhunt.com/2010/09/fear-uncertainty-and-and-padding-oracle.html
Logged
ajohnson
Recruiters
Hero Member
*
Offline Offline

Posts: 1057


aka dynamik


View Profile WWW
« Reply #3 on: September 23, 2010, 03:01:14 PM »
Oh whoops, wrong link (too many tabs open). I think I meant this one: http://blogs.technet.com/b/srd/
Logged
WIP: GCFA | www.infosiege.net | @infosiege

The day you stop learning is the day you start becoming obsolete.
H1t M0nk3y
Hero Member
*****
Offline Offline

Posts: 864



View Profile
« Reply #4 on: September 24, 2010, 07:19:42 AM »
Thanks Ketchup for sharing this with us.

Some guys are so clever, I just can't use to see smart attacks like this one!
Even the song is good...
Logged
OSCP, GPEN, GWAPT, GSEC, CEH, CISSP
Pages: [1]   Go Up
  Print  
« previous next »
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com 		Valid XHTML 1.0! Valid CSS!
Page created in 0.06 seconds with 22 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Free Business and Tech Magazines and eBooks

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.