A pair of security researchers have implemented an attack that exploits the way that ASP.NET Web applications handle encrypted session cookies, a weakness that could enable an attacker to hijack users’ online banking sessions and cause other severe problems in vulnerable applications. Experts say that the bug, which will be discussed in detail at the Ekoparty conference in Argentina this week, affects millions of Web applications.
The problem lies in the way that ASP.NET, Microsoft’s popular Web framework, implements the AES encryption algorithm to protect the integrity of the cookies these applications generate to store information during user sessions. A common mistake is to assume that encryption protects the cookies from tampering so that if any data in the cookie is modified, the cookie will not decrypt correctly. However, there are a lot of ways to make mistakes in crypto implementations, and when crypto breaks, it usually breaks badly.
“We knew ASP.NET was vulnerable to our attack several months ago, but we didn’t know how serious it is until a couple of weeks ago. It turns out that the vulnerability in ASP.NET is the most critical amongst other frameworks. In short, it totally destroys ASP.NET security,” said Thai Duong, who along with Juliano Rizzo, developed the attack against ASP.NET.
The pair have developed a tool specifically for use in this attack, called the Padding Oracle Exploit Tool. Their attack is an application of a technique that’s been known since at least 2002, when Serge Vaudenay presented a paper on the topic at Eurocrypt.
In this case, ASP.NET’s implementation of AES has a bug in the way that it deals with errors when the encrypted data in a cookie has been modified. If the ciphertext has been changed, the vulnerable application will generate an error, which will give an attacker some information about the way that the application’s decryption process works. More errors means more data. And looking at enough of those errors can give the attacker enough data to make the number of bytes that he needs to guess to find the encryption key small enough that it’s actually possible.
The attack allows someone to decrypt sniffed cookies, which could contain valuable data such as bank balances, Social Security numbers or crypto keys. The attacker may also be able to create authentication tickets for a vulnerable Web app and abuse other processes that use the application’s crypto API.
Rizzo and Duong did similar work earlier this year on JavaServer Faces and other Web frameworks that was presented at Black Hat Europe. They continued their research and found that ASP.NET was vulnerable to the same kind of attack. The type of attack is known as a padding oracle attack and it relies on the Web application using cipher-block chaining mode for its encryption, which many apps do.
Block ciphers need the messages they decrypt to be broken up into blocks that are some multiple of the specified block size, eight bytes for example. As messages don’t always fit into neat eight-byte sizes, they often require padding to reach the specified size. The attack that Rizzo and Duong have implemented against ASP.NET apps requires that the crypto implementation on the Web site have an oracle that, when sent ciphertext, will not only decrypt the text but give the sender a message about whether the padding in the ciphertext is valid.
If the padding is invalid, the error message that the sender gets will give him some information about the way that the site’s decryption process works. Rizzo and Duong said that the attack is reliable 100 percent of the time on ASP.NET applications, although the time to success can vary widely. The real limiting resources in this attack are the speed of the server and the bandwidth available.
In addition, an attacker could execute this technique without waiting for the error messages by using information gained through side-channel leakages.
“It’s worth noting that the attack is 100% reliable, i.e. one can be sure that once they run the attack, they can exploit the target. It’s just a matter of time. If the attacker is lucky, then he can own any ASP.NET website in seconds. The average time for the attack to complete is 30 minutes. The longest time it ever takes is less than 50 minutes,” Duong said.
ASP.NET is a hugely popular Web framework, and Rizzo and Duong estimated that 25 percent of the applications online are built using ASP.NET. However, that number is far higher in the corporate and financial services worlds, and apps such as online banking and e-commerce would obviously be prime targets for this attack.
Although crypto attacks can be quite complex, Rizzo said that this technique can be carried out by a moderately skilled attacker.
“The first stage of the attack takes a few thousand requests, but once it succeeds and the attacker gets the secret keys, it’s totally stealthy.The cryptographic knowledge required is very basic,” Rizzo said.
