All About Assert Part I: What Assert Actually Does

All About Assert Part II: What Assert Is Good For

.Net Security Blog — Tue, 24 Aug 2004 23:35:00 GMT

All About Assert Part II: What's Assert Good For

.Net Security Blog — Tue, 24 Aug 2004 23:35:00 GMT

All About Assert Part III: Dispelling the Myths

.Net Security Blog — Wed, 25 Aug 2004 23:22:00 GMT

re: All About Assert Part I: What Assert Actually Does

Eric Newton — Thu, 26 Aug 2004 06:05:00 GMT

So, if I'm a hacker... just call Assert with FullTrust then I can do anything?

There goes CAS?

Am I missing something here?

All About Assert Part III: Dispelling the Myths

.Net Security Blog — Thu, 26 Aug 2004 22:07:00 GMT

re: All About Assert Part I: What Assert Actually Does

Shawn — Thu, 26 Aug 2004 19:09:00 GMT

Hi Eric,

Actually, that's assert myth #3 (http://blogs.msdn.com/shawnfa/archive/2004/08/25/220458.aspx#myth3) .... while the call to Assert will "succeed" in that it will return to you without an causing an exception (assuming you have Assertion permission), it will actually have no effect unless you also have the permissions that you are Asserting.

So the only way for your scenario to work would be if the hacker was executing under FullTrust already, in which case, this is no longer an interesting form of attack (it doesn't buy the hacker anything).

-Shawn

All About Assert Part IV: When Assert Won't Help

.Net Security Blog — Thu, 26 Aug 2004 23:31:00 GMT

re: All About Assert Part I: What Assert Actually Does

Novice — Thu, 26 Aug 2004 22:19:00 GMT

When you say the following is untrue:
Assert stops all stack walks from proceeding further up the call chain

You mean that the use of Assert for a particular permission will not stop stack walks from proceeding up the call stack for other permissions, correct?

Thanks,
Novice

re: All About Assert Part I: What Assert Actually Does

Shawn — Thu, 26 Aug 2004 22:58:00 GMT

That's correct. Check out Myth #6 for more details on this. (http://blogs.msdn.com/shawnfa/archive/2004/08/25/220458.aspx#myth6)

-Shawn

When is ReflectionPermission Needed?

.Net Security Blog — Tue, 08 Mar 2005 23:36:00 GMT

All About Assert Part I: What Assert Actually Does

dotnetkicks.com — Thu, 02 Mar 2006 03:23:14 GMT

Trackback from dotnetkicks.com