Showing posts with label security. Show all posts
Showing posts with label security. Show all posts

Monday, April 13, 2009

Virus Sweeper

You shouldn't believe everything you read on the Internet. Most people simply just ignore that advice and that's how Virus Sweeper gets into computers. Virus Sweeper is advertised as a warning indicating that you should use it to disinfect your computer. When users do download and run it, that's when Virus Sweeper takes over.

They even have a very convincing user interface that makes Virus Sweeper seem like an actual anti-malware program:


You can find removal instructions and a utility here.

Source: 2-spyware.com

Monday, April 6, 2009

Manual Sliding Expiration

When using ASP.NET Forms Authentication, ASP.NET sets a timeout of 30 minutes by default for which a user is logged in. If the user does make a request within the 30 minutes, the authentication ticket is renewed for a another period. This normally happens behind the scenes and the developer is often not aware of this process, known as sliding expiration.

However, if you've got some pages on your web application that should be viewable by the user without the authentication ticket being renewed (such as a ticker to display new messages within an IFrame), you can disable slidingExpiration by making the following change in the web.config file:

<authentication mode="Forms">
<forms slidingExpiration="false"></forms>
</authentication>

You then have to programatically perform sliding expiration within your code, which can be done with the following code snippet posted at:
http://forums.asp.net/p/1083581/1607975.aspx

// Acquire Auth Ticket from the FormsIdentity object
FormsAuthenticationTicket objOrigTicket = ((FormsIdentity)Context.User.Identity).Ticket;

if (!Request.Url.AbsolutePath.ToLower().EndsWith(".ashx"))
{
// Manually slide the expiration
FormsAuthenticationTicket objNewTicket = FormsAuthentication.RenewTicketIfOld(objOrigTicket);

if (objNewTicket.Expiration > objOrigTicket.Expiration)
{
// Create the (encrypted) cookie.
HttpCookie objCookie = new HttpCookie(FormsAuthentication.FormsCookieName, FormsAuthentication.Encrypt(objNewTicket));
// Add the cookie to the list for outbound response.
Response.Cookies.Add(objCookie);
// Update original
objOrigTicket = objNewTicket;
}
}

In the code snippet above, you would have to change the condition within the IF statement that checks Request.Url to exclude the pages for which you do not want slidingExpiration to occur. The example above excludes all requests to ASP.NET Generic Handlers (files ending in .ashx).