Archive

Posts Tagged ‘web’

ASP.NET Session Cookie Crypto Attack Exploiting

September 20th, 2010 No comments

If the Linux CVE-2010-3081: 64bit Linux Kernel Root Exploit didn’t get you, then this little birdy might. It seems the implementation of the AES encryption algorithm which protects the integrity of the Session Cookies in ASP.NET has a weakness which could enable an attacker to hijack sessions – Which bank? The idea behind the use of AES is to ensure that the crypt’d data hasn’t been tampered with – and hence decryptable, but unfortunately the flawed implementation of the use of AES and how it handles errors gives out some much needed clues for an attacker to pursue.

From TheThreatPost article:

In this case, ASP.NET’s implementation of AES has a bug in the way that it deals with errors when the encrypted data in a cookie has been modified. If the ciphertext has been changed, the vulnerable application will generate an error, which will give an attacker some information about the way that the application’s decryption process works. More errors means more data. And looking at enough of those errors can give the attacker enough data to make the number of bytes that he needs to guess to find the encryption key small enough that it’s actually possible.

There is a Microsoft Security Advisory (2416728) which gives some workarounds until a proper fix is made available. What’s really concerning is this little tidbitt from Thai Duong about Using their tool the Padding Oracle Exploit Tool or POET:

“It’s worth noting that the attack is 100 [per cent] reliable, [that is], one can be sure that once they run the attack, they can exploit the target. It’s just a matter of time. If the attacker is lucky, then he can own any ASP.NET website in seconds. The average time for the attack to complete is 30 minutes. The longest time it ever takes is less than 50 minutes.”

What’s really interesting is seeing the video of the exploit in action on dotnetnuke (don’t close your eyes). ScottGu has blogged about this exploit which goes into far more detail than I can, but if you’re keen there’s a nice document on using the Padding Oracle exploit and includes discussions regarding the JSF View state, cracking CAPTCHA schemes as well as some juicy details on CBC-R.

{lang: 'en-GB'}
Share

Google shows the power of HTML 5, ports Quake II to run in browser!

April 3rd, 2010 No comments

The title says it all. Using the Jake2 port of Quake II (to Java) the bright sparks at Google have used GWT to bring Quake II to HTML 5.

We started with the existing Jake2 Java port of the Quake II engine, then used the Google Web Toolkit (along with WebGL, WebSockets, and a lot of refactoring) to cross-compile it into Javascript. You can see the results in the video above — we were honestly a bit surprised when we saw it pushing over 30 frames per second on our laptops (your mileage may vary)!

At first I thought it was an April fools joke, but as cruel as that may be, it wasn’t. Download the source and give it ago, I nearly fell of my chair.

At the moment you have to build from source and mess about a bit, but fear not, I followed the guide on OSNews by Kroc on our MacBook Pro and it worked quite well, yet to try it on Linux.

{lang: 'en-GB'}
Share

Chrome 4.0 is out with extensions support

January 26th, 2010 1 comment

Well finally Google has released Chrome 4.0 and with it extensions support amongst the many other features which finally brings some much needed juice to the browser. I’ve been running Firefox and Chrome simultaneously (Chrome for gmail & google apps, firefox for daily browsing) but I have a feeling I may change to using Chrome full time now.

Some cool extensions to try (most are from Firefox)

  • Xmarks Bookmarks Sync – I’ve been using FoxXmarks to sync my bookmarks for a while now, so its only natural I install this for Chrome. You can also stick with the standard Bookmark sync via Google which you’ll need a Google account for.
  • Google Mail Checker / Google Alerter – there’s also the One Number extension that brings more than just checking gmail.
  • AdBlock – probably the number one reason most people wanted extensions in Chrome!
  • Forecastfox Weather – My weather extension I use in Firefox.
  • FlashBlock – Can’t stand videos playing automatically when you load a gazillion tabs and wonder WHO THE EFF is talking?
  • Goo.gl URL Shortner – none others required.
  • Firebug Lite – Not as feature packed as Firebug, but then why would they call it Lite?
  • IETab – Sometimes you gotta.

Chromed. There’s lots more if you’re into Facebook, Twitter and all the other fancy things these days, even one for uTorrent! Download the latest build and give things a go!

PS. You don’t need to restart Chrome to install extensions either!

{lang: 'en-GB'}
Share

QuickFix: jQuery $.getJSON() fails in IE6 & IE7

October 27th, 2009 15 comments

Had a nasty issue with jQuery + jSON + IEx just now – still at work because of it!

This bit of code works perfectly fine on Firefox and Chrome:

function onUnitsModified() {
            $.getJSON("<%=Url.Action("GetTotalUnitCount", "ProjectReaper")%>", null, function(result) {
                if(result > 0)
                  // Do stuffs here
                }
            });
            return true;
}

But in IE we’ve come to realise that the first hit is successful, future json requests ones are not hitting the ASP.NET MVC actions (I put a breakpoint). You could append a time stamp to get rid of this annoying caching bug, but alternatively you can use the ajaxSetup options to disable caching.

function onUnitsModified() {
            $.ajaxSetup ({ cache: false}); 
            $.getJSON("<%=Url.Action("GetTotalUnitCount", "ProjectReaper")%>", null, function(result) {
                if(result > 0)
                  // Do stuffs here
                }
            });
            return true;
}

Darnit! Hope someone else doesn’t waste their time trying to fix this now 🙂

{lang: 'en-GB'}
Share

Opera 10 finally released!

September 1st, 2009 No comments

Today marks the release of Opera 10.

Amongst the highlights:

– Revamped user interface
– Boosted speed from the new Opera Presto 2.2 engine, giving it a 40% increase from the previous version when running web applications (such as Gmail)
– Opera Mail has seen various improvements
– Opera Turbo, designed to increase browsing speed for those on slower Internet connections
– An inline spell checker, to help catch mistakes when typing in entry forms
– Thumbnail tabs which are resizable
– Speed Dial has been given personalization features

Download a copy or read up on the new features in this release, the site’s being hammered right now by the looks of it? I still remember starting out with Opera 5 back in 2001, a close friend designated Opera as his ‘porn browser’, purely because of the tabbing and speed (not to mention lightweightness ) of the browser.

{lang: 'en-GB'}
Share

Foxy ladies: Mozilla releases Firefox 3.5!

July 1st, 2009 No comments

The moment we’ve all been waiting for, Mozilla has released the final version of Firefox 3.5 (which was originally slated to be 3.1). Amongst the highlights include the new Gecko 1.9.1 rendering engine and (from their release notes):

  • Available in more than 70 languages. (Get your local version!)
  • Support for the HTML5 <video> and <audio> elements including native support for Ogg Theora encoded video and Vorbis encoded audio. (Try it here!)
  • Improved tools for controlling your private data, including a Private Browsing Mode.
  • Better web application performance using the new TraceMonkey JavaScript engine.
  • The ability to share your location with websites using Location Aware Browsing. (Try it here!)
  • Support for native JSON, and web worker threads.
  • Improvements to the Gecko layout engine, including speculative parsing for faster content rendering.
  • Support for new web technologies such as: downloadable fonts, CSS media queries, new transformations and properties, JavaScript query selectors, HTML5 local storage and offline application storage, <canvas> text, ICC profiles, and SVG transforms.

For the developers, the Mozilla developer centre details the changes in this release. But the most exciting is the support for <video> and <audio> elements from the HTML 5 draft and the inclusion of the TraceMonkey JavaScript engine.

Download it now!

{lang: 'en-GB'}
Share

Bing Bing Bing Bing Bing: Microsoft launches Bing.

May 30th, 2009 1 comment

A few weeks ago saw the launch of Wolfram Research Alpha, a natural search engine which could do some funky things. Now Microsoft have stepped up from their previous attempts – Ms Dewey (Janina Gavankar, who’s quite a hottie! reminds me of Tiffany) and now we have the final release of Bing (aka codenamed Kumo) which is going to be a behemoth search engine.

Learn all about the new bling at DiscoverBing or learn the void that Bing will attempt to address, or see the video here.

Wonder why they decided on Bing?

Ding ding ding == bing bing bing?

“Just Bing It.”

“Dewd, just Bing the bastard”?

Bing is Not Google”?

Cashing in on the Lara Bingle’s ‘where the bloody hell are you?’ campaign, which btw was one of our clients at Vividas last year.

In either case, its an interesting take on the ‘aging’ way we search for what we want and seems to go onto the concepts that came with the Wolfram Alpha. When it actually comes out – still shows as coming soon for me, we’ll have to see.

{lang: 'en-GB'}
Share

Wolfram Alpha Launches!

May 19th, 2009 No comments

Steven Wolfram of Mathematica fame (and pure genius) has launched Wolfram Alpha, its a ‘computational knowledge engine’ and quite a cool tool too! Taking on the big giants Google and Yahoo, Live etc, this bit of kit allows you to search using natural language.

Let me demonstrate, suppose you want to know who the prime minister of Bulgaria is, it will not only give you the answer but also some background information on the person.

Not only can you ask formal questions, but you can even give it some mathematical problems to solve.

tan(x^2+sin(x))

Try some of the examples on the right hand menu.

Some cool things to try,

Ok I could waste a day on this, so instead I’ll let you do it for me.

{lang: 'en-GB'}
Share

COOL: wotnews.com.au, Search, scrape and analyses news for you!

April 21st, 2009 2 comments
wotnews Logo

wotnews Logo

Got told by a co-worker about this today, a news site that searches, scrapes and analyses news items for you. wotnews.com.au, even has a Google Alerts style notification system to get told when interesting news items trickle through. Whats really impressive about this little beauty is that its written by a very small team and is packed with functionality.

Say we want to know more about the Sun being acquired by Oracle item from yesterday, query it. You’ll get a bunch of highlights for the month regarding the two keywords, and the latest articles aggregated over the internet. It even has Twitter integration to findout the latest goss.

While it seems to be still in its infancy, this web-application (and the AI behind it) will surely improve over time bringing some very interesting utilities for gathering news. Who needs Digg.com now apart from the memes and references to PedoBear?

The web framework behind it I was told is Django (which I’ve toyed around with) and the front-end makes heavy use of CSS Sprites as seen on this graphic.

Learn about CSS Sprites

You can learn more about CSS Sprites via these links:

Funky!

{lang: 'en-GB'}
Share

Windows Server 2008 R2 Beta Download

January 11th, 2009 1 comment

Now that the road to downloading Windows 7 Beta 1 and finding a key for Windows 7 Beta 1 have been travelled by most, its time to look towards Windows Server 2008 R2 Beta.

This release contains some significant updates to the virtualisation hypervisor in Windows Server (Hyper-Vwiki) and will only be offered as a 64-bit release sporting 256 processors (with 32 processors in VMs).

{lang: 'en-GB'}
Share