Latest Breaking News

DavidDvorkin

(19,479 posts) Fri Mar 1, 2013, 12:16 PM Mar 2013

Web code weakness allows data dump on PCs

Source: BBC

Gigabytes of junk data could be dumped onto PCs via a loophole in web code, a developer has found.

The loophole exploits a feature of HTML 5 which defines how websites are made and what they can do.

Read more: http://www.bbc.co.uk/news/technology-21628622

Firefox is the only major browser that keeps this from happening.

16 replies

= new reply since forum marked as read

Highlight:

Web code weakness allows data dump on PCs (Original Post) DavidDvorkin Mar 2013 OP

I just had to delete mass junk because of IExploder that filled a friends hard drive. L0oniX Mar 2013 #1

This doesn't sound so bad Duer 157099 Mar 2013 #2

Paging salmonchantedevening, your 'virus' has escaped into the wild... AtheistCrusader Mar 2013 #3

LOL Duer 157099 Mar 2013 #5

Good thing it's just cats OnyxCollie Mar 2013 #15

Junk Data? WTF? Ain't that the crap Fox News (R) spews out endlessly? Berlum Mar 2013 #4

Just another reason to not use ExploDer. hobbit709 Mar 2013 #6

Sure, use Chrome instead. Oh wait, that has the same problem. AtheistCrusader Mar 2013 #7

The only browsers I use are Mozilla Firefox and Mozilla SeaMonkey. hobbit709 Mar 2013 #8

You won the lottery this time. :) AtheistCrusader Mar 2013 #9

Probably because Firefox is behind on HTML5 compatibility Renew Deal Mar 2013 #10

Firefox limits the amount of data that can be downloaded DavidDvorkin Mar 2013 #11

I think it has more to do with IExploder cache which builds up endlessly. n/t L0oniX Mar 2013 #12

Ironically, Internet Explorer is better than most when it comes to this. Xithras Mar 2013 #13

This will be fixed by all the major browsers fairly quickly. eggplant Mar 2013 #14

One of the adantages of a slower internet connection??? hunter Mar 2013 #16

L0oniX

(31,493 posts)

1. I just had to delete mass junk because of IExploder that filled a friends hard drive.

Reply to DavidDvorkin (Original post)

Fri Mar 1, 2013, 12:20 PM

Mar 2013

Windows is a virus.

Duer 157099

(17,742 posts)

2. This doesn't sound so bad

Reply to DavidDvorkin (Original post)

Fri Mar 1, 2013, 12:21 PM

Mar 2013

Developer Faross Aboukhadijeh found the bug and set up a demo page that fills visitors hard drives with pictures of cartoon cats.

Where do I go to get that??? Oh wait, nevermind, I know where

Edit: For those of you with browsers besides Firefox who need a hard drive full of cats, here ya go!! Enjoy! (proceed at your own risk!)

http://www.filldisk.com/

AtheistCrusader

(33,982 posts)

3. Paging salmonchantedevening, your 'virus' has escaped into the wild...

Reply to Duer 157099 (Reply #2)

Fri Mar 1, 2013, 12:25 PM

Mar 2013

Duer 157099

(17,742 posts)

5. LOL

Reply to AtheistCrusader (Reply #3)

Fri Mar 1, 2013, 12:25 PM

Mar 2013

OnyxCollie

(9,958 posts)

15. Good thing it's just cats

Reply to Duer 157099 (Reply #2)

Sat Mar 2, 2013, 01:59 AM

Mar 2013

and not kiddie porn.

Berlum

(7,044 posts)

4. Junk Data? WTF? Ain't that the crap Fox News (R) spews out endlessly?

Reply to DavidDvorkin (Original post)

Fri Mar 1, 2013, 12:25 PM

Mar 2013

I am totally uninterested in knowing anything whatsoever about the freaking degenerately flaccid junk of Fox (R).

hobbit709

(41,694 posts)

6. Just another reason to not use ExploDer.

Reply to DavidDvorkin (Original post)

Fri Mar 1, 2013, 12:30 PM

Mar 2013

AtheistCrusader

(33,982 posts)

7. Sure, use Chrome instead. Oh wait, that has the same problem.

Reply to hobbit709 (Reply #6)

Fri Mar 1, 2013, 12:34 PM

Mar 2013

Hang on, let me install Safari.... wait. Nope.
Opera? Nope.

hobbit709

(41,694 posts)

8. The only browsers I use are Mozilla Firefox and Mozilla SeaMonkey.

Reply to AtheistCrusader (Reply #7)

Fri Mar 1, 2013, 12:35 PM

Mar 2013

AtheistCrusader

(33,982 posts)

9. You won the lottery this time. :)

Reply to hobbit709 (Reply #8)

Fri Mar 1, 2013, 12:37 PM

Mar 2013

I'm surprised to see Chrome vulnerable.

Renew Deal

(81,861 posts)

10. Probably because Firefox is behind on HTML5 compatibility

Reply to DavidDvorkin (Original post)

Fri Mar 1, 2013, 12:37 PM

Mar 2013

DavidDvorkin

(19,479 posts)

11. Firefox limits the amount of data that can be downloaded

Reply to Renew Deal (Reply #10)

Fri Mar 1, 2013, 12:39 PM

Mar 2013

According to the article, that's why it's not vulnerable to this exploit.

L0oniX

(31,493 posts)

12. I think it has more to do with IExploder cache which builds up endlessly. n/t

Reply to Renew Deal (Reply #10)

Fri Mar 1, 2013, 12:40 PM

Mar 2013

Xithras

(16,191 posts)

13. Ironically, Internet Explorer is better than most when it comes to this.

Reply to L0oniX (Reply #12)

Fri Mar 1, 2013, 01:17 PM

Mar 2013

In Chrome, Apple Safari, and other browsers (all WebKit browsers) HTML5 local storage is either a separate beast, or is stored as part of the caching system which dynamically scales the disk space to meet current demands. IE is the only major browser that bundles local storage with cookies and cache, and ships with a hard cache limit enabled at 250mb. While the attack may permit the sites to work around the per-site datalimits, the local storage itself should still be subject to that 250mb overall limit. Firefox is the only other major browser that I'm aware of that also makes a maximum data limit available, but it's disabled by default. Browsers like Chrome are capable of having a limit enabled, but it has to be activated using command line switches (!)

Of course, I'm a bit puzzled as to how this works on IE anyway. The HTML5 spec says that localstorage is supposed to be limited per-domain, but Microsoft already went off-spec and made their limit per-origin. This was supposed to limit not only the amount of space each site could have, but also the overall amount of space that can be written by any individual requestor. The OP article makes it sound like Firefox is the only browser that addressed this. Microsoft actually DID address this issue as well, but it sounds like their off-spec "fix" didn't work.

I'm going to have to fire up a VM and test this out. The test in the video was done using Chrome, so I'm really curious to see how IE reacts to it.

On Edit:

Yep, just tried this on a clean Win7/IE9 VM. IE disk usage blew up to the default 250mb overall maximum and stopped dead.