Random Thoughts and Hints on Software Development : Security

Honey, where are my keys???

EldarM — Tue, 11 Dec 2007 13:07:00 GMT

No, really? Suppose, you’ve got a certificate from some certificate authority, installed it in the localmachine store, and then your application cannot see it!!! What happened? Is it a bug? Is it a virus? Did somebody stole you precious key??? Not quite…

Let’s see what’s happening when you install the certificate. The certificate itself is stored in the registry, and it includes the public key. However, the private key is stored separately in a special folder. That’s “%system drive%\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys”, or whatever it is in a localized version.

This folder is quite special. First of all, a normal consumer Windows does not have much to keep there. Sometimes, it’s just empty. Unfortunately, this is important to our story. Read on!

So, you install the certificate, and the file with the private key is created in this folder. Where does it gets its permissions? Right, from the folder. That’s quite logical, isn’t it?

Step 2, and that a smart thing, maybe a too smart thing, happens. Crypto layer, which created this file, removes the permissions for Everyone (WD) identity on this file. Which is also quite logical, you cannot have a private key that everybody can read, can you?

Now, what does it mean if Everyone was the only one having access to this folder? Right, nobody can get your key. Not even Admin or SYSTEM – semi-divine identity in Windows used to run system processes.

That’s not fun, but wait, here is more! If for some reason at some moment in the history of the machine this folder gets empty, it may – I repeat, it may – be deleted by the same code that created file for private key and maintained it so far. Then, some other application starts and tried to import a private key. Guess, what happens? The folder is magically recreated. Sounds good? Wait a bit for a small detail. It’s recreated under the current user. Ouch, ouch, ouch!

What does it mean for you? It means that on any well used Windows system you don’t have a predictable state of this folder and your private keys. And if you install certificates under one user, it may not work under another user.

So, the generic word of wisdom is: take care of ACLs on your private keys, if you install them, or it may be the last time you’ve seen them!

Ghosts and ghouls in your server: 0x80004015 -- NT Service out-of-body experience

EldarM — Wed, 14 Mar 2007 23:41:00 GMT

Authors in the New Age genre like to quote so called out-of-body-experience like memories of people who survivedd clinical death, tunnel with the light in the end and so on. Today I found that this is not a purely human phenomena...

Suppose you wrote an NT service and implemented a COM object inside. Sure thing, you have to call CoRegisterClassObject to register the class factory. Then you quickly start and stop your service and CoRegisterClassObject returns 0x80004015, which means that identity to run COM object and identity of the process don't match. EXCUSE ME? BUT HOW? The only way to do so is to set RunAs property on AppId registry key for your class CLSID, and you did not do that!!!

Well, the secret is easy. Your initialization got a little late and your process already got shutdown event and even killed most of the threads. While it prepares itself for the better world and observes the light in the end of the tunnel, it's idenity SYSTEM evaporates and it transgresses into a new, sort of semi-divine entity that exists mostly as a memory inside the OS core... The problem is that what's allowed to SYSTEM, is not allowed to Jupiter, including registering a class with a different identity. Amazing, isn't it?

And the fix is easy. It only happens if your service already shuts down, so you can just ignore this specific code. Well, not always -- it can also mean that your registry is bad -- but in this specific case that's just it. One-line fix, a whole day of investigation!...

I am Annoyed with Spam …and I don’t get it, why is it still a problem.

EldarM — Mon, 11 Sep 2006 17:27:00 GMT

...Frankly, when I think of spam fighting today, it reminds me the fight for communism in the former Soviet Union. It takes a lot of time, it creates jobs, and it does not bring tangible results......(read more)

Impersonation and authentication with ASP.Net

EldarM — Mon, 12 Jun 2006 22:34:00 GMT

The task: make a web user authenticated (either with him directly providing user ID or password or through domain, if he is already logged in) and run ASP.Net code under his/her ID.

Frankly, that’s very easy, but I noticed that sometimes even very good developers don’t know how to do that. In short, impersonation element in web.config does the trick. If you know the rest, that’s it, you don't need the rest of this post.

Otherwise, let’s just go through the process. First, go to your IIS folder, usually C:\Inetpub\wwwroot, and create a folder for your application/webservice, say C:\Inetpub\wwwroot\Hello. You can do that in Windows Explorer. I will show an example with webservice,

In this folder you will need two files: web.config and Hello.asmx (assuming you want to call your webservice Hello).

Simple web.config looks like that:

<?xml version="1.0"?>

<system.web>

</system.web>

</configuration>

I have added debugging and set default language to C#, but that’s optional. Hello.asmx file is very simple:

<%@ WebService Language="C#" CodeBehind="~/App_Code/Hello.cs" Class="Hello" %>

Now, create a folder App_Code (C:\Inetpub\wwwroot\Hello\App_Code), that’s where the actual code traditionally lives, and create Hello.cs file, already referenced in Hello.asmx:

using System;

using System.Web;

using System.Web.Services;

using System.Web.Services.Protocols;

[WebService(Namespace = "http://hellomedear.org/test/namespace/")]

[WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]

public class Hello : System.Web.Services.WebService

{

public Hello () {

}

[WebMethod]

public string HelloMeDear()

{

return "Hello, " + System.Security.Principal.WindowsIdentity.GetCurrent().Name.ToString() + "!";

}

This way it will return back the name of the current user, so we can track our progress. So, are we ready? Let’s try. Enter address http://yourmachine/hellome/hello.asmx in the browser. Oops... Error:

Server Error in '/' Application.

Parser Error

Description: An error occurred during the parsing of a resource required to service this request. Please review the following specific parse error details and modify your source file appropriately.

Parser Error Message: Could not create type 'Hello'.

Source Error:

Line 1:  <%@ WebService Language="C#" CodeBehind="~/App_Code/Hello.cs" Class="Hello" %>

Source File: /hellome/hello.asmx Line: 1

Version Information: Microsoft .NET Framework Version:2.0.50727.42; ASP.NET Version:2.0.50727.42

Why? You forgot to tell IIS that there will be ASP.Net code in this folder. Go to Control Panel | Administrative Tools | Internet Information Services, then select default web site, open it and you’ll see your folder shown with a folder icon. Right-click on it, select Properties, and click on “Create” button near the grayed textbox Application name. The click OK, and the icon will become something mechanical. That’s what you want.

Try again. Now you should get the list of available methods, which in our case is simply HelloMeDear. Click on it, and if you do that from the same machine, you will see a button Invoke, which let’s you try the method.

Click on it. A new windows will open with the result:

<?xml version="1.0" encoding="utf-8" ?>

<string xmlns="http://hellomedear.org/test/namespace/">Hello, NT AUTHORITY\NETWORK SERVICE!</string>

That’s nice, but NT AUTHORITY\NETWORK SERVICE is not your ID. What happened?

Go again into properties of your folder in IIS management, pick Directory Security tab, and press Edit for Authentication and access control. See “Enable anonymous access” checked? That’s the problem. Even if you’ll get impersonation, it will be that automatic user marked in the textboxes next to it. Actually, let’s try it.

Go to your folder and open web.config file. First add

into <system.web> element. Try again:

<?xml version="1.0" encoding="utf-8" ?>

<string xmlns="http://hellomedear.org/test/namespace/">Hello, YOURMACHINE\IUSR_ YOURMACHINE!</string>

You’ve got that impersonated user. To avoid that, go again into IIS configuration for your folder, Directory Security, edit Authentication and access control, and uncheck Enable anonymous access, plus check checkbox Integrated Windows authentication. Try now:

<?xml version="1.0" encoding="utf-8" ?>

<string xmlns="http://hellomedear.org/test/namespace/">Hello, YOURMACHINE\yourID!</string>

You’ve got it! Actually, it’s nice to add also:

into your web.config file along with impersonation element. That’s it.

So, all steps in a short list:

Create IIS folder
Create web.config file (see below to get important element)
Create .asmx file (see above)
Create App_Code subfolder and create there .cs file (see above)
Go to Control Panel | Administrative Tools | Internet Information Services, open, select default website, select your folder under it, right click, Properties.
Create application (button on the left of Application name:)
Go to Directory Security tab, click on Edit for Authentication and access control
Uncheck Anonymous access, check Integrated Windows authentication
You are done. To try go to http://yourserver/hellome/hello.asmx

Turning OFF AutoPlay

EldarM — Thu, 09 Mar 2006 00:09:00 GMT

When you put a music CD in your computer, it starts to play. Is it cool? Probably, but not to everybody. Some people (including me) feel that it's annoying. You put you data CD-ROM into the disk, you are sure what you want to do about it, and Windows starts to suggest to show a picture gallery, just because there are few jpegs there. What's worse, it adds time to mount the drive, so if you have a dozen of disks and trying to find a single file on one of them, autoplay may be not the best idea. And last, but not the least, you may consider it a security problem. After all, after Sony BMG Music Entertainment put rootkit on their music CDs (see also here), that used autoplay to install DRM (Digital Rights Management) on user's computer, you may think twice before considering AutoPLay "cool". Where is the guarantee that a CD coming from your computer games magazine is free of such stuff? Or a CD with family photos burned by your aunt, who is notorius at catching up computer viruses? Or the memory stick, which you used in Internnet cafe? Makes think...

So, here is how to turn it off on Windows 2000, XP (except Home Edition) and Windows 2003 Server:

Start local policy editor (Start | Run, enter GPEDIT.MSC, press Enter)
Go to Computer Configuration | Administrative Templates | System, double-click on "Turn Off Autoplay"
Select "Enabled" -- I know, it's confusing. You are not enabling autoplay, you are enabling turning autoplay off. In the drop down box select either "All drives" or "CD ROM drives" If you select the second, your memory stick still may be a problem.
Click "Apply", "Ok", exit the editor, you are done.

Caveats:

Now that autoplay is off, Windows will get the list of files only when you clik on the drive. So, you will see a little pause, when you first look at the inserted drive in Windows Explorer. It's still much smaller delay than what Autoplay does.
Setup disks that are supposed to start automatically, when you insert the disk, will stop to do so. That was the point, right? You will need to go there in Explorer and double-click on the program to run. If in doubt, it's in autorun.inf file, which you can open with notepad. The line looks like:
open=Setup.exe
and the part after "open=" is the program to start.
This does not work on XP Home Edition, Windows ME, 98 and below.

Enjoy...