'Padding Oracle' Crypto Attack Affects Millions of ASP.NET Apps

Dennis Fisher writes on ThreatPost:

A pair of security researchers have implemented an attack that exploits the way that ASP.NET Web applications handle encrypted session cookies, a weakness that could enable an attacker to hijack users' online banking sessions and cause other severe problems in vulnerable applications. Experts say that the bug, which will be discussed in detail at the Ekoparty conference in Argentina this week, affects millions of Web applications.

The problem lies in the way that ASP.NET, Microsoft's popular Web framework, implements the AES encryption algorithm to protect the integrity of the cookies these applications generate to store information during user sessions. A common mistake is to assume that encryption protects the cookies from tampering so that if any data in the cookie is modified, the cookie will not decrypt correctly. However, there are a lot of ways to make mistakes in crypto implementations, and when crypto breaks, it usually breaks badly.

"We knew ASP.NET was vulnerable to our attack several months ago, but we didn't know how serious it is until a couple of weeks ago. It turns out that the vulnerability in ASP.NET is the most critical amongst other frameworks. In short, it totally destroys ASP.NET security," said Thai Duong, who along with Juliano Rizzo, developed the attack against ASP.NET.

More here.

Morgan Webb very hot gallery

Morgan Webb

morgan webb 08 Scifi Hottie

Morgan Webb

to feature Morgan Webb.

Morgan Webb

Biography Morgan Webb

We are family…

The official bollywood remake of Stepmom brings to Karan Johar’s fans a heart wrenching tale in an NRI setup, yet again – after all, that is the limit to which Johar can “indianize” Hollywood for us :D. And, as usual, I don’t mind that a wee bit!

A disclaimer: When you go for the movie, forget the original. Comparisons never help, do they?

To give We are family its due credit, it brings to Hindi cinema a refreshingly new perspective to the concept of the other woman rather than the stereotyped and clichéd wicked witch she is made out to be in every soap and movie! Never once are you made to hate the stepmom, never once does the stepmom show any traces of evil in her. And full marks to the director and producer for that.

While most would be tempted to dismiss this offering as a typical tearjerker, a genre I dare not defend, I would still go on to say that there were numerous aspects of the movie that tugged my heart so many a times.

Kudos to the story tellers for making the movie crisp and to the point - no sympathy arousing tale of the before love and the reasons for separation of the divorced couple, no confused commitments – a modern day nuclear family saga that borders on realism.

Another saving grace was that the oft-repeated track of “it’s all about loving your parents”, and “our Indian culture and roots are our saviors” was downplayed for once!

A special mention to the kids – they were damn cute. I loved one particular scene where Arjun Rampal is empathizing with his son for having been confined to the company of complicated women and the tongue in cheek response to that “Tell me about it, And you have got one more! (referring to the step mom ofcourse)”

However, don’t forget this is a bollywood movie – to the core. The elaborate medical ordeal of Kajol (she is a wonderful actor) and the love triangle between the kids and the two moms interlace the movie with heavy emotions, which sets it drastically different from the more light-hearted and effervescent Kal Ho Na Ho. While both movies try to end on a positive note, We are family leaves you with a feeling of loss and a tear-stained face!

‘Humesha and forever’ is destiny’s greatest lie. Sigh.

My recommendation: go ahead and watch the movie. A good cry once in a while helps not just the eyes :)!

And here’s my favorite song from the movie…

rehm o karam hojaey dobara

rehm o karam ho jaane do ishara

rehm o karam hojaey dobara

rehm o karam hojaane do Khudara

Anti-U.S. Hacker Takes Credit for 'Here You Have' Worm

Robert McMillan writes on PC World:

A hacker who claims he was behind a fast-spreading e-mail worm that crippled corporate networks last week said that the worm was designed, in part, as a propaganda tool.

The hacker, known as Iraq Resistance, responded to inquiries sent to an e-mail address associated with the "Here you have" worm, which during a brief period early Thursday accounted for about 10 percent of the spam on the Internet. He (or she) revealed no details about his identity, but said, "The creation of this is just a tool to reach my voice to people maybe... or maybe other things."

He said he had not expected the worm to spread as broadly as it had, and noted that he could have done much more damage to victims. "I could smash all those infected but I wouldn't," said the hacker. "I hope all people understand that I am not negative person!" In other parts of the message, he was critical of the U.S. war in Iraq.

More here.

Using Microsoft, Russia Suppresses Dissent

Clifford J. Levy writes on The New York Times:

It was late one afternoon in January when a squad of plainclothes police officers arrived at the headquarters of a prominent environmental group here. They brushed past the staff with barely a word and instead set upon the computers before carting them away. Taken were files that chronicled a generation’s worth of efforts to protect the Siberian wilderness.

The group, Baikal Environmental Wave, was organizing protests against Prime Minister Vladimir V. Putin’s decision to reopen a paper factory that had polluted nearby Lake Baikal, a natural wonder that by some estimates holds 20 percent of the world’s fresh water.

Instead, the group fell victim to one of the authorities’ newest tactics for quelling dissent: confiscating computers under the pretext of searching for pirated Microsoft software.

Across Russia, the security services have carried out dozens of similar raids against outspoken advocacy groups or opposition newspapers in recent years. Security officials say the inquiries reflect their concern about software piracy, which is rampant in Russia. Yet they rarely if ever carry out raids against advocacy groups or news organizations that back the government.

More here.

Mark Fiore: Clever

More Mark Fiore brilliance.

Via The San Francisco Chronicle.

- ferg

Cyber Jihad Group Linked to 'Here you have' Worm

Robert McMillan writes on ComputerWorld:

A fast-spreading e-mail worm that crashed systems Thursday may be linked to a cyber jihad organization called Tariq ibn Ziyad, according to security vendor SecureWorks.

The "Here you have" worm spread like wildfire through some computer networks, bringing e-mail servers down and reportedly disrupting large U.S. organizations including Disney, Proctor and Gamble, Wells Fargo, and NASA (National Aeronautics and Space Administration). It's known as "Here you have" because that is sometimes the subject line of the messages used to spread the malware.

Much of the worm's code is identical to an earlier piece of malware that was released last month, and both worms refer to a Libyan hacker who uses the name Iraq Resistance, who has been trying to form a hacking group called Brigades of Tariq ibn Ziyad, said Joe Stewart, director of malware research with SecureWorks.

"Either this person is involved with this virus, or somebody wants to make it seem like this person's group is involved in this virus," Stewart said. "There are a lot of pointers to that group."

More here.