Oops, this last security breach is not limited to ASP.NET

It seems like ASP.NET is not the only platform vulnerable to Padding Oracle attack. Platforms like JSF and Ruby on Rails are also vulnerable,  but Juliano Rizzo is convinced that there are more platforms, applications and sites vulnerable to the same attack.

So why all the fuss about ASP.NET?

InfoQ: Why there has been so much commotion around ASP.NET lately and there is nothing related to JSF, Ruby on Rails, if they are vulnerable too?

JR: ASP.NET is more popular than JSF and Ruby on Rails, because approximately 25% of the internet sites use ASP.NET.

(In)security in your Access Points

Last week a friend of mine asked me to assess his AP’s security. I was shocked to find out his AP was just wide opened! The reason is a little embarrassing for him: the AP’s software (a NetGear) has a form that asks and stores a password for wireless security, and a group of radio buttons with the default choice: no security. A user interface trap for my 65 years old friend.

So I’ve decided to assess the neighborhood where I’ve been taking my summer holidays - being careful not to access any illegal information. Here are the results:

Security	#	%
WEP	8	21%
OPEN	11	29%
WPA/WPA2	19	50%
Total	38

Uau! I’ve 38 APs near me?!? This is madness, people don’t live here, these are weekend and holiday condoms!!! But wait, there’s more: only 50% of these are reasonably covered, the rest are wide open (ok, mostly FON Free Internet, a cool business model, nevertheless a risk if someone commits a crime using your hotspot?) or poorly defended WEP. WEP?! I wouldn’t expect so many of these running out there.

If I could get a neighbor to authorize an assessment I’d choose to attack the poorly defended WEP. Here’s what I would do:

1. Get a security distro already loaded with aircrack-ng – for instance, backtrack;
2. Follow the Simple WEP Crack Tutorial; my attack on my own AP took no more than 30s – provided I’ve forced an ARP query… probably the major obstacle on aircrack, as I am told.

You can also get you luck with dictionary attacks on WPA, or the next gen of security attacks, but that’s not the point. The point is: geeks like me – and you people that are reading this article – , although not safe from security attacks, are aware of these security risks and mitigations. The rest of non techies are calmly waiting to get their traffic and internet identity abused. But now that I’m thinking about it, they are sleeping like babies, I’m the one wake up at 01h30 in the morning worried about security… :)

The sky isn't falling

For those of you that were concerned with How to Impress Girls with Browser Memory Protection Bypasses  (hear about it at Vista's Security Rendered Completely Useless by New Exploit), rest assure, the sky isn't falling. As the article states:

These techniques are being seen as an advance that many in the security community say will have far-reaching implications not only for Microsoft, but also on how the entire technology industry thinks about attacks.

Ok, this is not absolutely related to Microsoft (being co-written by IBM and VMWare, Vista was the obvious choice), and some kind of user intervention is probably needed (or not?).

As ARSTechnica states, the fact is the problem seems to be related with where the DEP checking is made:

One of the key mechanisms used is the fact that the protections are not always applied. Internet Explorer 7 and Firefox 2 both opt out of DEP, and many third-party libraries such as the Flash plugin opt out of ASLR (and other protection mechanisms). Plugins can also do things that can deliberately defeat the OS's countermeasures; Java, for example, marks all of its memory as executable, meaning that a Java applet can place into memory executable code that's immune to DEP protection.

Ok, it seems like applications do have to much control over what is and isn't DEP verified, but still there is much Microsoft can do about it. Let's wait for their answer - and for the corresponding hungry answer from the users :)

Preventing Denial of Service (DOS) Attacks

Omar Al Zabir as posted this great article '10 ASP.NET Performance and Scalability Secrets'. The last of the tips caught my attention: Prevent Denial of Service (DOS) Attacks.

Omar offers us a simple and effective way to  deny DOSs. My question is: shouldn't we tackle this problem on an HttpModule level - better yet, shouldn't IIS take care of these problems for us?

Top 15 free SQL Injection Scanners

Found at slashdot: Top 15 free SQL Injection Scanners

The risks of obtaining and using pirated software

I found this article at bink.nu:

This white paper from international market-research firm IDC presents the results of an investigation by IDC into the prevalence of malicious code and unwanted software from Web sites offering counterfeit product keys, pirated software, key generators, or crack tools for Microsoft Windows XP and the Microsoft Office System.

The investigation also examined the presence of malicious code in key generators and crack tools that are available for download from various Web sites and peer-to-peer networks.

The intent of the research was to determine the security risks of obtaining and using pirated software.

Key findings

• 25 percent of the Web sites we accessed offering counterfeit product keys, pirated software, key generators or crack tools attempted to install either malicious software or potentially unwanted software. A significant number of these Web sites attempted to install malicious or unwanted code.

• 11 percent of the key generators and crack tools downloaded from Web sites contained either malicious or potentially unwanted software.

• 59 percent of the key generators and crack tools downloaded from peer-to-peer networks contained either malicious software or potentially unwanted software. A significant amount of malicious or unwanted code was present in the key generators and crack tools.

• The cost of recovering from an incident of malicious software on a single workstation could exceed one thousand dollars (USD). The cost of lost or compromised data could exceed tens of thousands of dollars (USD) per incident. Thus, the cost savings of using pirated software could be eradicated with a single security breach.

• The malicious and unwanted code found is indicative of the shift noted by security professionals in attackers' motivations. Attacks have evolved from hacking for fun to seeking confidential information assets and other malisiouc intent. By offering pirated software, crack tools, and key generators, attackers could lure potential victims.

• There are several methods for obtaining and using counterfeit software, including acquiring counterfeit product keys, obtaining "key generator" programs, and using crack tools to bypass licensing and activation mechanisms. IDC investigated the security risks of visiting the Web sites and peer-to-peer networks that use these methods to distribute counterfeit software.

• Simple Web searches often led to Web sites that offered pirated software, key generators, crack tools, and so on. Furthermore, it was easy to locate key generators and crack tools for Microsoft Windows and the Microsoft Office System.

Nothing new here. My advise to you: if you ever need to retrieve that serial that you lost when you threw away the CD case (it happened to me!), please use an isolated virtual machine and throw away the snapshot.

Interesting topology

Until finally surrendered to low energy router / firewall appliances, I used to have a linux box has my first layer of protection (Mandrake SNF, MNF, Astaro, or just the ordinary linux server with Shorewall). I'm talking about my home topology, and, needless to say, I have nothing to protect back home that justifies such heavy armoury, but this is the kind of things that distinguish business man from geeks, so I couldn't help it.

It was I Pentium I, running at 100MHz, with 32 MB of memory and 1.1 GB of disk. But man, was it noisy...

So one fine day, like 2 years ago, I asked my self: "Why isn't the firewall running inside a virtual machine?".

I didn't think twice:

1. Shutdown the firewall and a virtual machine host server.
2. Move both network cards from the first to the latter.
3. Installed a router firewall (IPCop, a simple to install firewall/router was all I needed for my proof-of-concept). I kept the original firewall configuration information, so that the change would be transparent.
   
4. Hooked my WAN cable to the external interface on the router / firewall.
   
5. Hooked a cross-cable between internal interface and the host network card.
6. Did some tweaking with the VMWare Network Configuration.

And that's all! I was running on a computer who's router/firewall was donated by his own virtual machine guest! Did some performance tests, and found no performance loss.

So I kept it running for a month or so, where it was finally replaced by the low energy appliance I'm using until today. The reason of the replacement was simple: I needed to recover memory on the virtual server host to create a new virtual machine...

It was an interesting proof-of-concept. From the security point of view, it was nearly just as secure as the solution it replaced. From ecological and maintenance view, it was by far a better solution.