.NET Security (Radu Vunvulea)

@ITCAMPRO
.NET Security
Solution Architect , Microsoft Azure MVP
iQuest Technologies
@Radu Vunvulea

@ITCAMPRO
Agenda
17:45 - 18:00 - Registration (coffee and beverages)
18:00 - 19:00 - .NET Security (Radu Vunvulea)
19:00 - 19:30 - Break (coffee and beverages)
19:30 - 20:30 - Actor based concurrency with Elixir (Adrian
Magdas)
20:30 - 21:00 - Networking (coffee and beverages)
Sponsors

@ITCAMPRO
WHAT IS THE FIRST THINK THAT COMES TO
YOUR MIND WHEN YOU SAY SECURITY?

@ITCAMPRO
Security
Connectivity
Transport
Communication
Payload
Data
Hardware
Security

@ITCAMPRO
Look at .NET security from
another perspective
- Framework and Packages-
Scope

@ITCAMPRO
• Error Logging Modules and Handlers
• Can be added to an application dynamically
• Logs unhandled exceptions
• Web page to see:
–All exceptions
–Details for each exception
–Review the yellow/blue screen of death even if you set
customsErrors == false
ELMAH

@ITCAMPRO
• Username
• Cookies
– Including authentication cookies
• Tokens and access keys
Sensitive information

@ITCAMPRO
• All:
https://www.google.ro/search?q=inurl:elmah.axd+AS
PXAUTH
• SQL Exception:
https://www.google.ro/search?q=inurl:elmah.axd+Sq
lException
• SQL SELECT:
• https://www.google.ro/search?q=inurl:elmah.axd+sel
ect+where+from
Bing on Google

@ITCAMPRO
• After Day 0, ELMAH announced that security
guidelines were updated to:
– Update web app configuration
– Custom handler for this location
Post Day 0

@ITCAMPRO
• More than 190.000 sites were still vulnerable
• Internal stack
• SQL Queries
• Access Tokens
• Server variable
After the update (January 2013)

@ITCAMPRO
Combine with…
Invalid URL

@ITCAMPRO
Layers
Communication Layer
Transport Layer
Session Layer
Application Layer
Data Layer

@ITCAMPRO
• Updates
• Security and Updates Procedures that ensures that
the vulnerabilities hotfixes are pushed to the
production environments with a near-time
What was missing on these sites

@ITCAMPRO
• Buffer overflow (Collections)
• External libraries
• Calling unmanaged code
• Old cryptographic mechanism
• Default, unsafe or shared keys for cryptography
• Ignoring security guidelines
Other vulnerabilities

@ITCAMPRO
• Security bulletin:
https://technet.microsoft.com/en-
us/library/security/ms14-059
• .NET Vulnerabilities
https://www.cvedetails.com/vulnerability-
list/vendor_id-26/product_id-2002/Microsoft-.net-
Framework.html
Known Vulnerabilities List

@ITCAMPRO
• Hands-on examples
https://www.owasp.org/index.php/.NET_Security_Chea
t_Sheet
• Security best-practices
https://msdn.microsoft.com/en-
us/library/fkytk30f(v=vs.110).aspx
Checklist

@ITCAMPRO
• Type-safe language
• Runs on top of .NET platform
• You can create a coding vulnerability only if
–> .NET platforms has a bug
–> External library has a bug
–> Execute code outside .NET platform
C# - Specific coding security

@ITCAMPRO
Scan
Prioritize
Assess
Report
Fix
Verify
Security Vulnerability Procedure
Create a list with what
software and packages
you are using
Telerik Example

@ITCAMPRO
Application
OS
.NET
Framework
NuGet
Packages
Dependenci
es
External Refs
Things that we shall update

@ITCAMPRO
• Active Injection
• Passive
Injection
XSS
Session
Hijacking • XSS
• Confused
Deputy
Cross Site
Request Forgery
Over-Posting
Over-
Redirection
Exploiting AP.NET MVC

@ITCAMPRO
Cross Site Scripting (XSS) - Active Injection

@ITCAMPRO
Cross Site Scripting (XSS) - Passive Injection
Runs on the screen
of another user

@ITCAMPRO
http://softpedia.com/account/?newpassword=MyPasswordIsSecret
• Posting on a public site (forum):
“Did you hear that someone is offering free
Uber rides using a special code”
• After a while another post comes:
“Just found the special code, link”
Cross Site Request Forgery

@ITCAMPRO
• Somebody can append in the form post
“PricePerItem = 1”
Over-posting

@ITCAMPRO
• Security is important
• You will never be bulletproof
• Try to assess and prioritize 1st
• Use OAWSP resources
Conclusion

@ITCAMPRO
{
“name” : “Radu Vunvulea,
“blog” : “vunvulearadu.blogspot.com”,
“email” : ”vunvulear@outlook.com”,
“socialMedia” :
{
“twitter” : “@RaduVunvulea”,
“fb” : “radu.vunvulea”
}
}

.NET Security (Radu Vunvulea)

More Related Content

What's hot

Similar to .NET Security (Radu Vunvulea)

Recently uploaded

.NET Security (Radu Vunvulea)

Editor's Notes