Mass Infection of IIS/ASP Sites • Hacker News Board

Re: Mass Infection of IIS/ASP Sites

#21

Post by rbanffy » Wed, Jun 09, 2010, 6:42 PM UTC

thrdOriginal wrote: post #11

jgg wrote: post #4

Can anyone give me a technical reason to deploy on a IIS and ASP platform instead of Apache/Nginx and one of the dozens of open source solutions for deploying a web application? From where I'm sitting, it seems to me the reasoning is "I drank the Microsoft Kool-Aid". Surely there's a better reason than that.

Is this a real question or a silly jab at Microsoft? I think you're underestimating the number of existing businesses who have .NET at their core, in which case the question is what justifies moving off of .NET? In my experience .NET can be - while not as hip - a very solid framework.

> you're underestimating the number of existing businesses who have .NET at their core

So, in essence, they are compounding one silly mistake (having .NET at their core) with a second one (using IIS)

Yes. This was a somewhat silly jab, but I couldn't resist.

Re: Mass Infection of IIS/ASP Sites

#22

Post by tptacek » Wed, Jun 09, 2010, 6:43 PM UTC

teilo wrote: post #12

chrisbolt wrote: post #9

Earlier quoted context omitted.

If management drinks the MS Kool-Aid, they're probably hiring people who drink the MS Kool-Aid.

That's not necessarily true. Microsoft lobbyists specifically target middle and upper management, and using arguments from authority, convince them that they must stay on Windows/IIS because it has better ROI.

For most companies, IIS does have a better ROI than, say, Rails.

Re: Mass Infection of IIS/ASP Sites

#23

Post by bradleyland » Wed, Jun 09, 2010, 6:49 PM UTC

jgg wrote: post #4

Can anyone give me a technical reason to deploy on a IIS and ASP platform instead of Apache/Nginx and one of the dozens of open source solutions for deploying a web application? From where I'm sitting, it seems to me the reasoning is "I drank the Microsoft Kool-Aid". Surely there's a better reason than that.

If you're deploying an app in to an enterprise that is already running an AD environment with other Microsoft products like SharePoint, Exchange, Office, and Microsoft Dynamics, it makes a lot of sense. I'm a Mac user and our startup is a kool-aid drinkin' Ruby on Rails shop, but I have administered enough large networks to see the power and value of Microsoft in the enterprise. Like it or not, the integration between Windows clients, Windows servers, and Microsoft applications is pretty incredible.

Re: Mass Infection of IIS/ASP Sites

#24

Post by abp » Wed, Jun 09, 2010, 7:05 PM UTC

jgg wrote: post #4

Can anyone give me a technical reason to deploy on a IIS and ASP platform instead of Apache/Nginx and one of the dozens of open source solutions for deploying a web application? From where I'm sitting, it seems to me the reasoning is "I drank the Microsoft Kool-Aid". Surely there's a better reason than that.

Good ms office integration. Thats interesting for many customers. Many customers also have IIS-Servers because office integrates good into these.

Good ms product integration in gereral should also be a valid point.

Also if a company has gotten into the above some time back, when asp on iis servers was the only way(?) for enterprise office integration for large reporting systems, it's easier to let the asp developers learn asp.net and integrate the old enterpise systems with the new. When the old systems are rewritten, asp.net is the way to go, because the customer already has large parts of the infrastructure.

Re: Mass Infection of IIS/ASP Sites

#25

Post by ronnier » Wed, Jun 09, 2010, 7:19 PM UTC

kogir wrote: post #3

Yawn. Sql injection again. Can happen on any platform. Hint: Use SPs for all your data access and don't give your app direct access to the tables. Makes stuff like this infinitely less likely to work.

Stored procedures aren't even required. Just use parameterized queries.

Re: Mass Infection of IIS/ASP Sites

#26

Post by teilo » Wed, Jun 09, 2010, 7:22 PM UTC

tptacek wrote: post #22

teilo wrote: post #12

Earlier quoted context omitted.

That's not necessarily true. Microsoft lobbyists specifically target middle and upper management, and using arguments from authority, convince them that they must stay on Windows/IIS because it has better ROI.

For most companies, IIS does have a better ROI than, say, Rails.

Rails running on...?

If you pick and choose the other side of the comparison, you can may anything have a better ROI than anything else.

A better comparison would be Windows/IIS/.NET vs. Linux/Apache/

Re: Mass Infection of IIS/ASP Sites

#27

Post by poundy » Wed, Jun 09, 2010, 7:26 PM UTC

I got hacked similarly on my blog and it went undetected when my wordpress code files were changed. Now I can detect the website/server is hacked using this php code http://www.webdigi.co.uk/blog/2009/how-to-detect-if-your-web... (like tripwire)

This helped me a couple of times and once when a hack on my wordpress blog only showed different page links to the google bot!

Re: Mass Infection of IIS/ASP Sites

#28

Post by RyanMcGreal » Wed, Jun 09, 2010, 7:27 PM UTC

tptacek wrote: post #20

RyanMcGreal wrote: post #13

Earlier quoted context omitted.

Don't ORMs use parameterized queries by default?

Yes, but they don't parameterize the sort order on every sortable table, or the limits used in pagination, or the custom join expressions ORM developers inevitably write.

Thanks for clarifying. Every time I think I have a handle on website security, it turns out to be more complex and insidious than I thought.

Re: Mass Infection of IIS/ASP Sites

#29

Post by rbanffy » Wed, Jun 09, 2010, 7:30 PM UTC

tptacek wrote: post #20

RyanMcGreal wrote: post #13

Earlier quoted context omitted.

Don't ORMs use parameterized queries by default?

Yes, but they don't parameterize the sort order on every sortable table, or the limits used in pagination, or the custom join expressions ORM developers inevitably write.

I am quite sure Django's ORM (the one I use every day) would properly protect limits and pagination.

Re: Mass Infection of IIS/ASP Sites

#30

Post by tptacek » Wed, Jun 09, 2010, 7:58 PM UTC

teilo wrote: post #26

tptacek wrote: post #22

Earlier quoted context omitted.

For most companies, IIS does have a better ROI than, say, Rails.

Rails running on...? If you pick and choose the other side of the comparison, you can may anything have a better ROI than anything else. A better comparison would be Windows/IIS/.NET vs. Linux/Apache/

Substitute whatever you want for Rails, and ASP.NET will still have a better ROI for any given single application, and potentially (probably, in fact) for all their apps even if you artificially ignore switching costs.

We don't build apps in ASP.NET. We use Ruby. But we do a lot of security work for people with ASP.NET, are knee-deep in a lot of ASP.NET dev teams, and the things ASP.NET does for enterprise apps are not "kool-aid".