Well, my first TechEd experience, DEV001, is complete. Keith Brown from PluralSight was the presenter and it was time well spent. While I'm not even close to being an expert with C++ or C# I still took quite a bit away from this talk. I promised I would post some notes or information about the session up here but to err on the side of caution (CD from talk marked Confidential) I'll refrain from posting something I shouldn't. Maybe they don't care, but I'll just hold off.
Some highlights and items to keep in mind include:
- Filter and Sandbox user input, never trust it
- Buffer Overruns, Integer overflows and format string exploits
- Using the /GS compiler flag in .NET to use the built in stack check “cookie“ by the CLR
- Everyone's favorite SQL Injection
- Cross Site Scripting
- Fully and Partially trusted code, how you can bypass (read: disable) CLR security
- Strong Names, their drawbacks and how to spoof a SN assembly
- ASP.NET AppDomains and WS2003 AppPools vs. WS2000 (specifically IIS6 v IIS7 improvements)
- quite a bit more
I'll have the slide deck and DVD for the users group if anyone is interested later.
You can check out Keith's most recent book, The .NET Developer's Guide to Windows Security, online. You can access the book from his blog.
Tomorrow, keynote from Steve Ballmer bright and early. It's going to be a long but exciting week.
Tomorrow night I'm slated for the first round of the Mobilizer Madness contest. Follow the link to sign up however I do not know if any spots are left. I signed up on Friday night. You just can't pass up a chance to win a VX6600 Smart Phone so give it a shot. Also don't forget to pickup your Microsoft Windows XP Anywhere button for a chance to win a Tablet PC. Actually, forget to. It will better my odds. See you on the floor.