ansaurus

Question

Why did Scott Guthrie suggest us to use a random, small sleep delay in a Error.aspx?

Answer 1

+6 A:

This is to prevent people constantly triggering your error page and exploiting the recent ASP.NET vulnerability. They need a large number of failures to take advantage of this exploit.

The sleep delay will not 'prevent' access to your page. Think of it as being analogous to brute forcing a password; if you have to wait 5 seconds between guesses instead of 5ms, you will take a little more time to find the pw.

Alex 2010-09-28 02:10:13

Why don't just set the delay to a reasonable constant value?

xport 2010-09-28 02:16:52

different kinds of errors could potentially be determined depending on the time it takes to receive the error page, so a random delay would confuse this

davidsleeps 2010-09-28 02:23:55

As David said it's more about detecting the type of error from the time it takes to crash/redirect to the YSOD rather than anything to do with increasing the time between retries - because after all you can issue multiple requests in parallel.

blowdart 2010-10-19 16:58:50

Answer 2

+4 A:

In simple terms the vunerability is about guessing a really long password. (which is the key used to encrypt your session state, amongst other things?)

Imagine you wrote a routine to check a password:

   bool checkPassword(string userInput)
   {
      for(int index = 0; index < password.length; index++)
      {
        if(userInput[index] != password[index]) {
             return false;
        }
      }

      return true;
   }

This would allow a timing attack on the password algorithm, because you can check a character a time, because it takes longer the more correct your password is. ie. Imagine the password is 'carrots'

calling checkPassword('ca') will take longer than checkPassword('aa'), so you can iterate through the character at a time.

Because somewhere in the asp.net stack there is a bad implementation like this, adding a random sleep helps throw out the timing attack... (but it is not perfect I imagine)

For more information see:

http://en.wikipedia.org/wiki/Timing_attack

icedtoast 2010-09-28 02:27:06

Answer 3

A:

Does the patch solve the problem, or do we need to install the patch and use this trick?

muek 2010-10-19 22:29:50

The patch solves it.

blowdart 2010-10-19 22:33:48

ansaurus

tags:

views:

answers:

Why did Scott Guthrie suggest us to use a random, small sleep delay in a Error.aspx?

related questions