Hacked! And I didn’t like it - URLScan is Step Zero
My blog was down a few days ago. I’ve had downtime in the minutes over the last few years, but as far as I recall, it’s never been down for any significant time. Keyvan noticed that a bunch of us were attacked. Phil Haack was also, ahem, haacked.
Visual Studio 2008 SP1 Beta Readme
SQL Server Compact 3.5 SP1 Beta for Devices is not installed with Visual Studio 2008 SP1 Beta. It is available as a Web download …
Visual Studio 2008 SP1: Why not VS 2009? All about Microsoft …
Microsoft watcher Mary Jo Foley's blog covers the products, people and strategies that make Microsoft tick.
I host at ORCSWeb and have forever. We’re in the process of making a lot of chances to my blog. I’m on an x64 machine (I’ve blogged about DasBlog on x64 before), but running in 32-bit AppPool We’re cialis moving my blog to a dedicated server, switching to x64, and we also were upgrading to UrlScan 3.0 which just had a Beta Release in June.
Anyway, in this crazy process, there was window of time where I didn’t have UrlScan enabled on the machine. I mistakenly thought that the Ninjas wouldn’t be able to catch me if I was on fire. In fact, not so.
Visual Studio 2008 and .NET Framework 3.5 Service Pack 1 Beta …
Download details: Visual Studio 2008 Service Pack 1 Beta
May 12, 2008 … This download installs Visual Studio 2008 Service Pack 1 (SP1) Beta.
Visual Studio 2008 .NET 3.5 SP1 Beta « See Joel Program … Pingback from Elegant Code » Visual Studio 2008 Service Pack 1 - BETA …
Visual Studio 2008 and .NET Framework 3.5 Service Pack 1
Visual Studio 2008 and .NET Framework 3.5 SP1 addresses issues that were found through a combination of customer and partner feedback, as well as internal …
Brad Abrams : Visual Studio 2008 and .NET Framework 3.5 "SP1" Beta
VS2008 and .NET Framework 3.5 offer a ton of customer value from Linq to Ajax and much more. The service pack we have been working on to round out this …
acheter cialis

Speaking of Ninjas, Wade Hilmo is a ninja at Microsoft who writes UrlScan.
There’s a great IIS7 Request Filter for protecting against nasty attacks, but UrlScan Beta 3.0 still has the edge on the filter for the time being. Version 3.0 of UrlScan adds:
This release of UrlScan is a beta, but it’s config file is backward compatible and there’s a GoLive license. It’s working great for me. However, to quote Wade:
“While they are effective against the current wave of automated attacks, they cannot protect against more directed attacks against a specific server.”
This was a SQL Injection attack with URLs that looked like this (and some variations):
[08-11-2008 - 17:29:31] Client at 201.67.x.x: Query string length exceeded maximum allowed. Request will be rejected. Site Instance=’13′, QueryString= ‘guid=0b93befc-3543-4bfc-ba8e-6cd340b6d9d3;DECLARE%%20@S%%20VARCHAR(4000);SET%%20@S=CAST(0×4445434C4152452…(incrediblyLONGQueryString)…220%%20AS%%20VARCHAR(4000));EXEC(@S);–’, Raw URL=’/blog/CommentView.aspx’
In this example, it’s hitting CommentView.aspx and trying to add a bunch of T-SQL at the end, with the most evil part encoded inside a CAST() statement. It’s a distributed attack with a bunch of (likely innocent) drones reaching out to be mean. In a few hour period, there were thousands of attacks for over 250 different IP addresses.
Fortunately DasBlog doesn’t use a database at all, rather a bunch of XML files for storage. Unfortunately, the application was still trying to map these query strings to blog posts, and the result took my blog down.
There’s really two main things to think about when dealing with user input, remembering that the URL is an input point for your application!
We need to tighten up DasBlog to more quickly reject URLs that are surely not requests for blog posts, but a tool like UrlScan allows me to easily reject obvious attacks in an way that is more efficient than letting my application code do it.
I would encourage you to take a moment and do a threat analysis on your own websites, and make sure that you ARE constraining input appropriately.
One thing to note, you can and will likely break things for a while with UrlScan, as it does constrain input and you might have valid URLs you aren’t aware

Related posts: Frank w. dux, Denise richards heather, The hole, Daily motivator, Gmail lab