Security Advisor

HTML 5 Hole Could Fill Hard Drive with Junk Data

Clicking on a Web site could cause your hard drive to be filled with unwanted and harmful data in a short period of time.

A security researcher revealed a discovered HTML 5 flaw last week that could allow attackers to perform data dumps by users of many popular Web browsers, including Internet Explorer, Google Chrome, Opera and Apple's Safari Web browser.

According to 22-year-old researcher Feross Aboukhadijeh, the vulnerability is due to the browsers mentioned not following the rules laid out by the World Wide Web Consortium (W3C) that states, " User agents should guard against sites storing data under the origins other affiliated sites, e.g. storing up to the limit in a1.example.com, a2.example.com, a3.example.com, etc, circumventing the main example.com storage limit."

"However, Chrome, Safari, and IE currently do not implement any such 'affiliated site' storage limit," said Aboukhadijeh in a blog post. "Thus, cleverly coded websites, like FillDisk.com, have effectively unlimited storage space on visitor's computers."

Aboukhadijeh has found a way to bypass the data limit by creating multiple temporary "affiliate" Web sites that can be used to inject a system with large amounts of data. In a proof-of-concept demo, he illustrated this by inserting a large amount of cat images on a system  (and, of course, due to it being the Internet, had to pair the cat images with the overused, yet still amusing Trololo song).

While Aboukhadijeh explained that due to the  HTML 5 data limit workaround, those using any of the affected Web browsers could eventually have their entire hard drive filled with unwanted data, he found the process takes much faster on a Macbook Pro Retina with a solid state drive (SSD) -- up to 1 GB of data can be injected every 16 seconds.

Due to how Mozilla caps data in its Firefox Web browser, it is immune to the flaw.

In true fashion that is the morally ambiguous life of a security researcher, Aboukhadijeh has both reported the flaw to the Web browser makers and has released the code for you and your friends to fill up others' hard drives with silly cat pictures (or it could be used for more nefarious purposes). Thankfully, so far there has been no word of the flaw being exploited in the wild.

About the Author

Chris Paoli is the site producer for Redmondmag.com and MCPmag.com.

Featured

  • AzCopy Preview Adds AWS S3 Data Transfer Improvements

    Microsoft announced this week that it has improved the preview version of its AzCopy tool to better handle Amazon Web Services (AWS) S3 data.

  • Microsoft Adding Google G Suite Migration in Exchange Admin Center

    Microsoft's Exchange Admin Center will be getting the ability to move Google G Suite calendar, contacts and e-mail data over to the Office 365 service "in the coming weeks."

  • Qualcomm Back in Datacenter Fray with AI Chip

    The chip maker joins a crowded field of vendors that are designing silicon for processing AI inference workloads in the datacenter.

  • Microsoft To Ship Surface Hub 2S Conference Device in June

    Microsoft on Wednesday announced a June U.S. ship date for one of its Surface Hub 2S conferencing room products, plus a couple of other product milestones.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.