MSDN Magazine - November 2008 - (Page 49)

Bug #10 (Silverlight CLR C#) bool verifyCode(string discountCode) { // We store the hash of the secret code instead of // the plaintext of the secret code. // Hash the incoming value and compare it against // the stored hash. SHA1Managed hashFunction = new SHA1Managed(); byte[] codeHash = hashFunction.ComputeHash( System.Text.Encoding.Unicode.GetBytes(discountCode)); byte[] secretCode = new byte[] { 116, 46, 130, 122, 36, 234, 158, 125, 163, 122, 157, 186, 64, 142, 51, 153, 113, 79, 1, 42 }; if (codeHash.Length != secretCode.Length) { // The hash lengths don't match, so the strings don't // match this should never happen, but we check anyway return false; } // perform an element-by-element comparison of the arrays for (int i = 0; i < codeHash.Length; i++) { if (codeHash[i] != secretCode[i]) return false; // the hashes don't match } // all the elements match, so the strings match // the discount code is valid, inform the server WebServiceSoapClient client = new WebServiceSoapClient(); client.ApplyDiscountCode(); } return true; Any code that runs on the client can be manipulated by an attacker. Period. who responds to us with the plaintext secret code.) Give yourself a point if you caught the unsalted hash. However, the biggest problem with this code is the fact that it’s being executed on the client machine at all! Remember we stated at the beginning that this is Silverlight CLR code that runs in the user’s browser. Any code that runs on the client can be manipulated by an attacker. Period. Nothing prevents a determined user from attaching a debugger to the browser instance running the Silverlight code and stepping through the code as it executes. He could set the codeHash variable to be equal to the secretCode hash so that the comparison logic would always succeed. Or he could skip over the validation logic completely and just jump the current instruction to the Web service call that applies the discount code. Easiest of all, he could avoid the debugger entirely and just call the Web service method ApplyDiscountCode directly! It’s important to realize that even though you may be using C# or Visual Basic to create Silverlight applications just like you would for ASP.NET Web Forms, Silverlight code runs on the client’s machine, and Web Forms code runs on the server. Code that runs on the client can be viewed and changed by an attacker. Never embed secrets into client-side code or allow client-side code to make privileged decisions (such as whether a discount code is valid or whether a user is authorized to perform a certain action). If you caught this bug, give yourself a point.  Answer The developer made a wise decision not to embed the secret code in plaintext in the code. If you only need to test whether a user knows a secret (such as a discount code or a password), it’s always better to store a hash of that secret and compare hashes rather than storing the plaintext and comparing strings directly. Unfortunately, the developer chose to use the SHA-1 hash algorithm, which is showing serious signs of weakness and has been subsequently banned by the SDL. A much better choice would have been to use the SHA256Managed class that implements the SDL-approved and recommended SHA-256 hash algorithm. If you caught this, you get a point. Even worse than choosing SHA-1 over SHA-256 is the fact that the developer neglected to salt the hash value. Unsalted hashes are much more vulnerable to cracking via precomputed hash tables (often called rainbow tables). It would probably take an attacker a short time to determine the original plaintext secret code from the unsalted hash value. (The authors will post congratulations in the SDL blog at blogs.msdn.com/sdl to acknowledge the first person TAlly your PoinTs Bug #1 Bug #2 Bug #3 Bug #4 Bug #5 Bug #6 Bug #7 Bug #8 Bug #9 Bug #10 TOTAL So How Do You Rate? Points 15+ 11-14 7-10 4-6 0-3 Comment We’re hiring. Not bad, not bad at all. Now apply your talents to all that code your buddies wrote. Hmmm. OK. You clearly have a lot to learn, but you’re probably better than 50% of the developers out there writing Web apps today. You have a LOT to learn. Go to your favorite book store and buy all the books written by both authors of this article. Step away from the editor and compiler, and no one will get hurt. November 2008 49 msdnmagazine.com http://blogs.msdn.com/sdl http://www.msdnmagazine.com

Table of Contents Feed for the Digital Edition of MSDN Magazine - November 2008

Contents MSDN Magazine - November 2008 Toolbox CLR Inside Out Data Points Cutting Edge Security Briefs Test Your Security IQ Agile SDL Access Control Utility Spotlight RIA Test Run Wicked Code Foundations Team System End Bracket

MSDN Magazine - November 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.