HTML5 flaw lets browsers fill hard drives with junk data

HTML5 logoOn the heels of more problems with browser plug-ins such as Java and Flash, a newly-discovered flaw in HTML5 -- used throughout the web and a fundamental part of all modern browsers -- can be used maliciously to fill hard drives to capacity with junk data. The exploit can be demonstrated on a website set up to document the flaw, called Filldisk. All browsers are susceptible to it -- though Mozilla's Firefox features a hard cap of 5MB of such data and thus mitigates the effect, while some older 32-bit browsers may crash rather than fill up the drive.

A developer named Feross Aboukhadijeh discovered the problem, which concerns how HTML5 handles local data storage. Though all browsers have a data cap (usually set by the user), it can be bypassed by creating linked "temporary" websites that each get the same storage allotment as the primary site, all invisible to the visitor. The HTML5 specification actually already addresses this problem and says that "affiliate" sites should be limited to the cap assigned to the primary site, however most browsers (apart from Firefox) don't honor the guideline.

The practical effect is that a malicious website could dump sufficient data onto a hard drive to fill it up after only a few minutes -- Aboukhadijeh was able to pump as much as 1GB of data every 16 seconds on some machines. He had already reported the flaw to all browser makers before creating the public website. No malicious use of the flaw has been seen in the wild so far. Visitors to the Filldisk site can see the effect in action, but can reclaim all the space by simply stopping the dumping of cat pictures (an arbitrary example of junk data).

Source: Electronista

Tags: browsers, Firefox

Comments
Add comment

Your name:
Sign in with:
or
Your comment:


Enter code:

E-mail (not required)
E-mail will not be disclosed to the third party


Last news

 
This restriction will extend to existing extensions over the remainder of the year
 
Apple would switch that end from USB-A over to USB-C
 
NVIDIA and AMD will soon have another graphics competitor
 
App Store Guidelines Apple is a ban on developers building their own databases with collected contact info
 
New update, new problems for iPhone owners
 
The social network will ban businesses with bad customer service and repeated negative reviews from advertising
 
Microsoft is hoping to define a new form factor as it once did with Surface Pro
 
Microsoft has not mentioned a specific date
The Samsung Galaxy A5 (2017) Review
The evolution of the successful smartphone, now with a waterproof body and USB Type-C
February 7, 2017 /
Samsung Galaxy TabPro S - a tablet with the Windows-keyboard
The first Windows-tablet with the 12-inch display Super AMOLED
June 7, 2016 /
Keyboards for iOS
Ten iOS keyboards review
July 18, 2015 /
Samsung E1200 Mobile Phone Review
A cheap phone with a good screen
March 8, 2015 / 4
Creative Sound Blaster Z sound card review
Good sound for those who are not satisfied with the onboard solution
September 25, 2014 / 2
Samsung Galaxy Gear: Smartwatch at High Price
The first smartwatch from Samsung - almost a smartphone with a small body
December 19, 2013 /
 
 

News Archive

 
 
SuMoTuWeThFrSa
     12
3456789
10111213141516
17181920212223
24252627282930




Poll

Do you use microSD card with your phone?
or leave your own version in comments (10)