Mass Infection of IIS/ASP Sites
blog.sucuri.net
Mass Infection of IIS/ASP Sites
1–10 of 42 posts
Re: Mass Infection of IIS/ASP Sites
#2More details:
http://isc.sans.edu/diary.html?storyid=8935
http://nsmjunkie.blogspot.com/2010/06/anatomy-of-latest-mass...
According to the articles, more than 100k sites hacked.
Re: Mass Infection of IIS/ASP Sites
#3Yawn. Sql injection again. Can happen on any platform.
Hint: Use SPs for all your data access and don't give your app direct access to the tables. Makes stuff like this infinitely less likely to work.
Re: Mass Infection of IIS/ASP Sites
#4Can anyone give me a technical reason to deploy on a IIS and ASP platform instead of Apache/Nginx and one of the dozens of open source solutions for deploying a web application? From where I'm sitting, it seems to me the reasoning is "I drank the Microsoft Kool-Aid". Surely there's a better reason than that.
Re: Mass Infection of IIS/ASP Sites
#5Can anyone give me a technical reason to deploy on a IIS and ASP platform instead of Apache/Nginx and one of the dozens of open source solutions for deploying a web application? From where I'm sitting, it seems to me the reasoning is "I drank the Microsoft Kool-Aid". Surely there's a better reason than that.
More like: "Management Drank the MS Kool-Aid"
If your boss says you must use IIS then not much you can do.
Re: Mass Infection of IIS/ASP Sites
#6Yawn. Sql injection again. Can happen on any platform. Hint: Use SPs for all your data access and don't give your app direct access to the tables. Makes stuff like this infinitely less likely to work.
You know...if it were that easy then this would be a solved problem. But it isn't that easy, especially in large, enterprise environments.
Re: Mass Infection of IIS/ASP Sites
#7Yawn. Sql injection again. Can happen on any platform. Hint: Use SPs for all your data access and don't give your app direct access to the tables. Makes stuff like this infinitely less likely to work.
By using SPs you more or less double the effort to port your application away from whatever database you are using.
Better to use an ORM.
Re: Mass Infection of IIS/ASP Sites
#8Yawn. Sql injection again. Can happen on any platform. Hint: Use SPs for all your data access and don't give your app direct access to the tables. Makes stuff like this infinitely less likely to work.
By using SPs you more or less double the effort to port your application away from whatever database you are using. Better to use an ORM.
You mean, except for the part where ORM-based applications are usually still injectable.
Re: Mass Infection of IIS/ASP Sites
#9Can anyone give me a technical reason to deploy on a IIS and ASP platform instead of Apache/Nginx and one of the dozens of open source solutions for deploying a web application? From where I'm sitting, it seems to me the reasoning is "I drank the Microsoft Kool-Aid". Surely there's a better reason than that.
More like: "Management Drank the MS Kool-Aid" If your boss says you must use IIS then not much you can do.
If management drinks the MS Kool-Aid, they're probably hiring people who drink the MS Kool-Aid.
Re: Mass Infection of IIS/ASP Sites
#10Can anyone give me a technical reason to deploy on a IIS and ASP platform instead of Apache/Nginx and one of the dozens of open source solutions for deploying a web application? From where I'm sitting, it seems to me the reasoning is "I drank the Microsoft Kool-Aid". Surely there's a better reason than that.
ASP.NET is an extremely full-featured, well-tested, and carefully designed enterprise web stack.
What you're really asking is, why would you deploy on an enterprise stack as opposed to a modern app framework. There's lots of reasons, none of which will be congenial to you:
* A much larger pool of available developers
* Better enterprise integration features (depending on your platform, J2EE or ASP.NET may be predetermined for you)
* Better security controls (single signon, LDAP integration, permissioning, etc)
* A preexisting deployment platform that new ASP or J2EE apps can be rolled out onto.
There is really no good reason to do a web startup on ASP.NET or J2EE. So the short answer to your question is, "no, none of us should be using it." But there are lots of valid reasons for businesses to use it.