Web code weakness allows data dump on PCs

[Mulreay]

Gigabytes of junk data could be dumped onto PCs via a loophole in web code, a developer has found.

The loophole exploits a feature of HTML 5 which defines how websites are made and what they can do.

Developer Feross Aboukhadijeh found the bug and set up a demo page that fills visitors hard drives with pictures of cartoon cats.

In one demo, Mr Aboukhadijeh managed to dump one gigabyte of data every 16 seconds onto a vulnerable Macbook.
Clever code

Most major browsers, Chrome, Internet Explorer, Opera and Safari, were found to be vulnerable to the bug, said Mr Aboukhadijeh.

While most websites are currently built using version 4 of the Hyper Text Markup Language (HTML), that code is gradually being superseded by the newer version 5.

One big change brought in with HTML 5 lets websites store more data locally on visitors' PCs. Safeguards built into the "local storage" specification should limit how much data can be stored. Different browsers allow different limits but all allow at least 2.5 megabytes to be stored.

However, Mr Aboukhadijeh found a way round this cap by creating lots of temporary websites linked to the one a person actually visited. He found that each one of these associated sites was allowed to store up to the limit of data because browser makers had not written code to stop this happening. By endlessly creating new, linked websites the bug can be used to siphon huge amounts of data onto target PCs.

Only Mozilla's Firefox capped storage at 5MB and was not vulnerable, he found.

Full Story: http://www.bbc.co.uk/news/technology-21628622

[Salmon Trout]

one gigabyte of data every 16 seconds

I wish I had an Internet connection that fast: using binary gigabytes, that's 537 megabits per second in round numbers. Even if my connection was that good it would have to be a bloody good server connection to dump that much that fast. I have a 60 Mbit/sec connection and there are not many internet resources that can max it out (my own ISP's Usenet server can)

[Mulreay]

I wish I had an Internet connection that fast: using binary gigabytes, that's 537 megabits per second in round numbers. Even if my connection was that good it would have to be a bloody good server connection to dump that much that fast. I have a 60 Mbit/sec connection and there are not many internet resources that can max it out (my own ISP's Usenet server can)

I think it's more about potential than actual speeds the average user would get. But if they can exploit 1 G/bit every 16 seconds then it could happen to everything under that but at a slower pace. I personally get 110mb/s download so could hurt me very bad.

[Salmon Trout]

I think it would be quite a worry for the owners of a web site affected in this way, it would be maxing out their bandwidth too, and could impact on their accessibility and maybe annoy the hosting company too. I am on Virginmedia and if something like that happened to me at certain times of the day I'd get "traffic managed".

[Mulreay]

I am on Virginmedia

Me too.

[TechnoGeek]

I got about 5 MB/sec saved, which I think is slightly faster than my normal internet speed. It's probably just spamming the same image enough times to fill one quota's worth of space before moving onto another one, which helps explain the 1GB in 16s -- I actually think it would take longer to write 2-5 MB of data to the hard drive than download a single 1KB (or even cached in the browser) image. That time difference adds up over many 'rounds' of this disk filling, but with an SSD the writing takes much less time.

Pretty cool trick actually, but because of the risks involved it'll have to go. I guess we get to see how long it takes this trick, seemingly reported at about the same time to all the major browsers, to get fixed in each of them

A very clever choice of music for his space filling site btw

[BC_Programmer]

Note: the data is not actually being downloaded at all. It is being written from the Client-Side Javascript. Once they are retrieved they will simply be copied from the cache. It will not really effect your connection speed- the only effect it could have is consuming temporary scratch space. Certainly should be prevented though.

[Salmon Trout]

Note: the data is not actually being downloaded at all.

That makes more sense. Thanks, BC_P