On Wed, Sep 29, 2010 at 12:56 PM, David Connors <[email protected]> wrote: > On 29 September 2010 12:52, silky <[email protected]> wrote: >> >> My guess from reading the PDF I sent through is that they gain access >> to the Web.config by manipulating WebResource somehow (they imply as >> much I think). > > Yeah, that is as much as I could glean from the comments on the post. > >> >> So, of course it also follows that you should *not* store anything of >> any importance in the web.config. This is not so hard. Just load the >> important stuff from a file that is not in the web root. I think this >> is even possible with one of the MS add-ins (configuration manager or >> something, I forget its name sorry). > > I agree in principle, but without knowing more about that part of the attack > there are other issues: > 1. What user is the thread running at at the time those files are read? The > AppPool identity or something else? > 2. Is there any opportunity for parent pathing out of the web root etc?
The main problem is having effectively web-accessible content in the web root. It's virtually a flat-out "don't ever do it". It so happens that, if I may say, .NET as encouraged bad practie with this. We should really all go back to basics and never do it, and if MS has some strategy to help everyone do this in a generic way, all the better. Of course, it's too much to have everyone "change", but it is technically the best approach, if possible. The other concerns - who loads it, who should have access to that folder, etc - are legitimate and should be handled appropriate defaulting to the "lowest possible". > -- > David Connors | [email protected] | www.codify.com > Software Engineer > Codify Pty Ltd > Phone: +61 (7) 3210 6268 | Facsimile: +61 (7) 3210 6269 | Mobile: +61 417 > 189 363 > V-Card: https://www.codify.com/cards/davidconnors > Address Info: https://www.codify.com/contact -- silky http://dnoondt.wordpress.com/ "Every morning when I wake up, I experience an exquisite joy — the joy of being this signature."
