Demo of ASP.NET Padding Oracle Attack

http://threatpost.com/en_us/blogs/demo-aspnet-padding-oracle-attack-091710?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Todays+Most+Popular

by ronnier • 16 years ago

19 16 16 years ago

threatpost.com

patio11• 16 years ago

One comment on that page and already I want to cry: no, custom error pages do nothing to prevent this attack. Textually identical responses can be distinguished by side channel attacks, such as via timing. If you have distinct code paths depending on what kind of error you are throwing, you take different amounts of time to get through them, and even if that difference is tens of microseconds the magic of high school stats will let any computer capable of counting figure out which errors are the ones it is interested in.

Groxx5• 16 years ago

I've been seeing that kind of comment everywhere this attack pops up. Or people claiming this is because ASP.NET's AES implementation has a bug in it. Or damn near anything but what's actually going on in any kind of padding oracle attack.

alecco2• 16 years ago

Comments from uninformed fanboys are to be expected. What's appalling is MS's VP in charge of ASP.NET spreading misinformation and down-playing the vulnerability.

http://weblogs.asp.net/scottgu/archive/2010/09/18/important-... http://forums.asp.net/1233.aspx

SriniK2• 16 years ago

Obviously, it is possible to break unsigned cookies. However good luck with dictionary attack protection, session-id, ssl, most banking sites are mandated to have.

alecco2• 16 years ago

From my understanding, the attack guesses the key used by the server. And in most cases the same key is used for almost everything. So they can guess it with something trivial and then use it to make a fake cookie or encrypted form element to get access. SSL and session ids have nothing to do with the padding oracle attack itself.

stackthat• 16 years ago

Using timing attacks in this case is almost not possible any actual web user would know that, do you think you can accurately analyse that the application's choice of code brunch in 35000 requests successfully? (in a multi-threaded attack)

Unless you are sitting by the server physically or it's in your localhost (even than, not for sure) timing attack simply not feasible.

Groxx5• 16 years ago

You clearly do not understand the scale botnets can achieve. 35,000 won't do it, no. How about the same coming from several million IP addresses? How about millions coming from several million IP addresses?

ronnier• 16 years ago

Here's a direct link to the video: http://www.youtube.com/watch?v=yghiC_U2RaM

SriniK2• 16 years ago

Site seems to be down. Here are the googlecache links. Looks like half ass implementation without signing cookies.

http://bit.ly/aT8R3D - Demo of ASP.NET Padding Oracle Attack

http://bit.ly/b3FdoI - 'Padding Oracle' Crypto Attack Affects Millions of ASP.NET Apps - text version

Demo of ASP.NET Padding Oracle Attack

Related Stories