Security researchers have discovered a flaw in the encryption used for Microsoft’s ASP.NET web applications. The vulnerability can be successfully exploited to, for example, steal online banking data.
The issue lies in how Microsoft’s ASP.NET web framework implements AES encryption. That encryption is used to ensure the integrity of the cookies generated by web applications. The exploit that leverages this weakness in the AES implementation will be covered in depth at the Ekoparty conference in Argentina.
Security upended
Thai Duong and Juliano Rizzo are the researchers who discovered the issue. They have known about the weakness in ASP.NET for several months, but only realized a few weeks ago how serious their finding could potentially be. “It wipes out the entire security of ASP.NET in one stroke,” the researchers state.
The two security experts have also created a tool to carry out an attack via this flaw. The tool is called POET, which stands for Padding Oracle Exploit Tool and refers to the name of the vulnerability. To be clear, this has nothing to do with the software vendor Oracle.
Since 2002
The attack is a variation on a technique that has existed at least since 2002. The problem with the way ASP.NET implements AES encryption lies in its error handling. When the vulnerable application in question generates an error, it returns a snippet of information to the attacker.
That gives the attacker a peek behind the scenes of the encryption process. The more errors, the more data the hacker obtains. With enough of these errors, the attacker can then gather sufficient bytes to recover the encryption key through a process of elimination.
This allows the attacker to sniff cookies, which can contain sensitive information such as online banking data. This flaw is serious because an attacker who targets it has a 100% success rate in exploiting it. The only variable is that some attacks take longer than others.
On average 30 minutes
Recovering the encryption key can in the worst case already take just a few seconds. On average, it takes an attacker 30 minutes to crack a web application. At most, it takes 50 minutes. According to the discoverers, a hacker with average skills can execute this attack, despite its complexity.
The ASP.NET framework is widely used, making this a vulnerability to watch. Approximately 25% of all web applications are built with ASP.NET. In particular, banking applications are built on the ASP.NET framework.