Re: C# Exceptions

Hi Tyler,

One question regarding man in the middle attack:

Since the communication happens over HTTPS, how effective would this
attack be. The encryption scheming 256 bit. I'm not sure but may be
the TCP/IP of the target machine might just reject the tampered data
as the checksums or other headers might not match.

Can someone put some more light on these possibilities?

THNKX

On 8/25/06, Krpata, Tyler <tkrpata@xxxxxxx> wrote:
It seems like you're saying that the application makes requests and
receives replies from a web service, and that you were able to crash the
application by sending invalid replies? In this case, maybe an attacker
that was able to launch a man in the middle attack could exploit the
application that way.

-----Original Message-----
From: 3 shool [mailto:3shool@xxxxxxxxx]
Sent: Friday, August 25, 2006 2:59 AM
To: pen-test@xxxxxxxxxxxxxxxxx
Subject: C# Exceptions

Hi,

I'm testing a C# desktop application. During my testing so far we have
found security issues that lead to application crash with following
type of errors:

1. Acess Violation Acception
2. Null Reference Acception
3. Invalid Object Acception
4. Application crash dump

Are these issues really a security threat for a desktop application?

We got these errors by sending junk data over the network replies that
this application gets from its web services. However I fail to
understand the security implication and risk of these exceptions.
Since this is a desktop application and not a web service or server
how would these issues impact the security of the desktop application.
The application doesn't open any port on the network for incoming
requests. What would be the best strategy to test such application?
What would be the points from where attacker could attack such a
aplication.

I'll really appreciate some enlightening thoughts on above queries.

Thanx in advance.

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------





------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------

Relevant Pages

  • Re: C# Exceptions
    ... What attack scenarios could be possible on such an application? ... > Are these issues really a security threat for a desktop application? ... > this application gets from its web services. ... > Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: OT: (D)DoS attack mitigation
    ... The attack, if that's what it is, is against Web service at port 80. ... my Web host said that the apache system account was making too many requests. ... I need to have port 80 open for ordinary Web service, plus one other port open for signing in as a domain-management client or as a server administrator. ...
    (Fedora)
  • [NT] DCE RPC Vulnerabilities New Attack Vectors Analysis
    ... Get your security news from a reliable source. ... These new attack methods were found while researching exploitation ... They might also apply to other vulnerabilities such as the DCE RPC DCOM ...
    (Securiteam)
  • << Small Biz Server news this week - June 18, 2004 >>>
    ... The monthly Executive Circle Security Webcast with Mike Nash, ... IP phones can create network security risk ... The biggest of the headaches was Tuesday's attack ... Akamai now says it was targeted by DDoS attack ...
    (microsoft.public.backoffice.smallbiz2000)
  • << Small Biz Server news this week - June 18, 2004 >>>
    ... The monthly Executive Circle Security Webcast with Mike Nash, ... IP phones can create network security risk ... The biggest of the headaches was Tuesday's attack ... Akamai now says it was targeted by DDoS attack ...
    (microsoft.public.windows.server.sbs)