The Code Behind The Vulnerability

on YouTube ↗58m

" summary

Covers four real Microsoft security bulletins and live demos: a 2011 hash collision DoS fixed by per-process randomized string hashing; a padding oracle against ScriptResource.axd that exposes web.config and machineKey leading to cookie forgery, fixed by HMAC signing; viewstate binary deserialization that deletes files and allows RCE, fixed by mandatory signatures; and catastrophic regex backtracking causing infinite CPU. Includes concrete fixes: use HMACs, unique IVs, avoid BinaryFormatter/unsafe JSON settings, set regex timeouts, treat encoding as context specific, and never publish signing keys.

AI-written summary · about

" chapters (6)

1. 0:00Start
2. 5:52Hash Dos (MS11-100) A Denial of Service caused by parsing FORM inputs. Caused by Hash Table and Dictionary using a predictable hash algorithm for string keys. Fixed by switching hash functions to one that is unpredictable or limiting dictionary size.
3. 12:00DIY Hash Dos Dictionary fix only applies to string keys. If you allow user input into a hash based collection which has a key which isn't string and your GetHashcode() algorithm for the key class is predictable then you are vulnerable...
4. 13:12Padding Oracle (MS10-070) Information disclosure via cryptographic attack An endocint was exposed which validated if a string was encrypted correctly The attacker could use the yes or no result to buid properly encrypted strings without knowing the key
5. 42:44Mass assignments MVC & WebApi use binders. Binders take input and map to object properties
6. 54:40In summary Sign your data, even when it's encrypted Don't use regular expressions Opt-in to new protections Don't opt out of protections Strictly limit your inputs

" related talks

• 45mThe Code Behind The VulnerabilityBarry Dorrans · Øredev 2018
• 01h 01mThe Code Behind The VulnerabilityBarry Dorrans · NDC Sydney 2018
• 43mHunting for Bugs, Catching DragonsNicolas Joly · Black Hat USA 2019
• 47mToolShell, Patch Bypass, and the AI That Might Have Seen It ComingPedram Hayati, Soroush Dalili · NDC Manchester 2025
• 51mWindows 10 Mitigation ImprovementsDavid Weston, Matt Miller · Black Hat USA 2016
• 50mDefensive Programming - A Look at how to Break your Web AppNiall Merrigan · GOTO Aarhus 2013
• 49mDeserialization vulns: past, present, and futureMykhayl Shcherbakov · DotNext 2019 Piter
• 41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon WaysBrian Gorenc, Jasiel Spelman · Black Hat USA 2014