Manu Cohen-Yashar's Blog

Convert SAML token to SWT token using ACS

In Claim based applications we use token to provide the application (Relying party) with details (a collection of claims) about the the authenticated identity. In ASP.net web sites and WCF SOAP services SAML tokens are used as a container for the claims. SAML is a standard that describe how token and claims are constructed and how they are cryptographically protected using digital signature and encryption. SAML tokens are powerful yet they are large. The size of the token is not a real issue in ASP...

ACS Academy Videos

I wrote a lot about claim based Identity and access control. One of the big challenges in claim based access control is the creation of the STS. Fortunately the Azure platform has an offering in this domain – ACS AppFabric ACS Access Control Service implements a full STS in the cloud. It is simple yet powerful. The team created great videos explaining ACS and their integration with WIF. Watch and start using ACS. Manu

Claim Based Identity Tutorial

Claim based identity is the future of identity management. It is simple, powerful and extensible but the most important reason to use it is the fact that it delegates identity management out of the application. WIF is Microsoft's infrastructure for using Claim Based Identity. (Similar to what is WCF for networking) Recently an excellent Training Kit was released about WIF and the integration of WIF with AppFabric Azure ACS. I strongly recommend to download read and learn. Manu

Asymmetric Encryption of Long Data

Few weeks ago a post about asymmetric encryption using RSACryptoServiceProvider . Asymmetric encryption is an expensive operation so it is not meant for very long data encryption. If you have an article or a book you should not encrypt it asymmetrically but what about a 200 byte long information? If you will try to encrypt 200 byte using RSACryptoServiceProvider you will get an exception. It seems that the longest data that can be encrypted using is RSACryptoServiceProvider is 80 bytes. I thinks...

Asymmetric Encryption with RSACryptoServiceProvider

Traditional symmetric cryptography is all about hiding a secret using an algorithm and a key. The same key is used for encryption and decryption. Asymmetric encryption does much more. In Asymmetric encryption there are two key: one is kept secret (private) and the other is distributed (public). Both keys are mathematically the same – What makes the public key public is the fact that it was distributed. To perform a full cycle both keys are required (i.e. encryption with one key and decryption with...

Practical Application Security

Application Security is a problematic subject. It is a non functional requirement so it cannot be presented to a customer and it is expensive. The management feels that money is being spent without tangible results and the developers feel that security is a pain so they will do anything to avoid it. When being asked "what is application security?" so many different answers are given … So how can application security be implemented? In this article I will show how the broad concept of application...

Create a certificate using certificate services of server 2003

I am very often being asked how to use the certificate services of server 2003 I would like to recommend the following post: http://www.msexchange.org/tutorials/SSL_Enabling_OWA_2003.html Manu

Claim Base Authorization - Next Generation Identity management

Claim Base Authorization - Next Generation Identity management Identity is one of the most popular challenges applications face today. Almost every application has to know who it is talking to and needs to do something about it. Unfortunately we know that identity is poorly handled as Identity theft is one of the world's greatest problems today. What is identity after all? After decades of working with Identity we finally understand that identity is nothing more that some information that describes...

Creating X.509 Certificates using makecert.exe

Creating x.509 certificates is a very common task. Unfortunately the knowledge how to do it is quite rare. If you want a certificate that the whole world would trust you need to buy one, but if you need it for your own use you can create it using a tool called MakeCert.exe After downloading the tool you have to perform the following procedure: Creating a Root Certificate Authority makecert.exe -n "CN=My Root CA,O=Organization,OU=Org Unit,L=San Diego,S=CA,C=US" -pe -ss my -sr LocalMachine...

Threat Modeling summary

Threat modeling is the heart of any application securuty design. I am often being asked about threat modeling so I wanted to write about it: Enjoy: Threat Modeling Goal: Describe what is threat modeling, and how it should be implemented. Terms: Attacker - Someone who could do harm to a system Threat - An attacker goal Vulnerability - A flaw in the system that could help an attacker realize a threat Mitigation - Something to do to protect against a threat. Attack - The process in which attackers takes...

Federated Authentication - Performance and One Time passwords

It is quite common for large distributed application to ask the questions: "Should all services perform user authentication?" "Can we afford this in terms of performance?" Well usually, we can not afford to repeatedly authenticate. Services are autonomous ! We all know that this is of the most important tenets of SOA. Business activities are rarely implemented in one service only. Business activities are composed of several services working together. The services are autonomous, they can "grow" and...

למה הבנקים בישראל מעודדים גניבת סיסמאות

למה הבנקים בישראל מעודדים Phishing ? או איך לגנוב סיסמאות . נניח שחפצה נפשך לראת פרטים בנקאיים כאלה או אחרים של לקוחות בנק מסויים... מה צריך לעשות ? וכן כל מה שאתה צריך זה גרפיקאי טוב שיעתיק עבורך את חזות אתר הבנק שאתה רוצה לתקוף. כעת יש לכתוב מייל שמציע מבצע הנחות לרגל החג הקרוב ובמסגרתו יוכל הלקוח לקבל פטור מעמלות לחודש אם ירשם למבצע. את המייל יש להפיץ בתפוצת NATO . (כמה שיותר כמו כל Phishing Attack ) מסתבר שאנשים סומכים על מה שהם רואים (יש מספיק מחקרים שמוכיחים זאת) ולכן אם האתר שלנו יהיה מספיק...

Membership, Roles and Tasks - Why don't people use membership provider

Membership, Roles and Tasks It is common knowledge that passwords should not be kept in a database. Too many Databases had been stolen and with them many usernames and passwords. In some countries it is against the low to save passwords in a database. Still a huge percentage of Identity systems still store passwords. Why ? Well, Some people just do not know that passwords should not be kept persistent. Some are just lazy, They do not have the time to implement a system that creates a good random...

Security Testing tools & links

Security Testing tools & links http://www.OWASP.org http://www.Webappsec.org Discovery: SamSpade : http://www.samspade.org/ Manual Testing: WebScrab : http://www.owasp.org/software/webscrab.html Fiddler: http://www.fiddlertool.com/Fiddler/ Paros: http://parosproxy.org/download.shtml Crackers: ObiWaN: http://www.phenoelit.de/obiwan/ Brutus: http://www.hoobie.net/brutus/ Crowbar: http://www.sensepost.com/research/crowbar/ Lcrack: http://www.nestonline.com/lcrack MD5 Online Crackers : http://gdataonline...

Buffer Overflow / Overrun examples

Buffer Overflow / Overrun examples Everybody knows the buffer overrun problem but many people asked me to see a real life example. So I bring here 5 examples of different kinds of buffer overrun. By the way these example do not work on vista as vista protects the stack. So Vista is a secure environment … Enjoy. Manu Classic Buffer Overrun Example. The classic problem: a buffer is copied in to a bigger buffer and override the stack and with it the return address. 1. Compile the code 2. Run the code...