Welcome to the MacNN Forums.

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

You are here: MacNN Forums > News > Tech News > HTML5 flaw lets browsers fill hard drives with junk data

HTML5 flaw lets browsers fill hard drives with junk data
Thread Tools
MacNN Staff
Join Date: Jul 2012
Status: Offline
Reply With Quote
Mar 4, 2013, 08:24 PM
 
On the heels of more problems with browser plug-ins such as Java and Flash, a newly-discovered flaw in HTML5 -- used throughout the web and a fundamental part of all modern browsers -- can be used maliciously to fill hard drives to capacity with junk data. The exploit can be demonstrated on a website set up to document the flaw, called Filldisk. All browsers are susceptible to it -- though Mozilla's Firefox features a hard cap of 5MB of such data and thus mitigates the effect, while some older 32-bit browsers may crash rather than fill up the drive.

A developer named Feross Aboukhadijeh discovered the problem, which concerns how HTML5 handles local data storage. Though all browsers have a data cap (usually set by the user), it can be bypassed by creating linked "temporary" websites that each get the same storage allotment as the primary site, all invisible to the visitor. The HTML5 specification actually already addresses this problem and says that "affiliate" sites should be limited to the cap assigned to the primary site, however most browsers (apart from Firefox) don't honor the guideline. The practical effect is that a malicious website could dump sufficient data onto a hard drive to fill it up after only a few minutes -- Aboukhadijeh was able to pump as much as 1GB of data every 16 seconds on some machines. He had already reported the flaw to all browser makers before creating the public website. No malicious use of the flaw has been seen in the wild so far. Visitors to the Filldisk site can see the effect in action, but can reclaim all the space by simply stopping the dumping of cat pictures (an arbitrary example of junk data).
     
   
Thread Tools
Forum Links
Forum Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Top
Privacy Policy
All times are GMT -4. The time now is 04:29 PM.
All contents of these forums © 1995-2014 MacNN. All rights reserved.
Branding + Design: www.gesamtbild.com
vBulletin v.3.8.8 © 2000-2014, Jelsoft Enterprises Ltd., Content Relevant URLs by vBSEO 3.3.2