Security Advisor

HTML 5 Hole Could Fill Hard Drive with Junk Data

Clicking on a Web site could cause your hard drive to be filled with unwanted and harmful data in a short period of time.

A security researcher revealed a discovered HTML 5 flaw last week that could allow attackers to perform data dumps by users of many popular Web browsers, including Internet Explorer, Google Chrome, Opera and Apple's Safari Web browser.

According to 22-year-old researcher Feross Aboukhadijeh, the vulnerability is due to the browsers mentioned not following the rules laid out by the World Wide Web Consortium (W3C) that states, " User agents should guard against sites storing data under the origins other affiliated sites, e.g. storing up to the limit in a1.example.com, a2.example.com, a3.example.com, etc, circumventing the main example.com storage limit."

"However, Chrome, Safari, and IE currently do not implement any such 'affiliated site' storage limit," said Aboukhadijeh in a blog post. "Thus, cleverly coded websites, like FillDisk.com, have effectively unlimited storage space on visitor's computers."

Aboukhadijeh has found a way to bypass the data limit by creating multiple temporary "affiliate" Web sites that can be used to inject a system with large amounts of data. In a proof-of-concept demo, he illustrated this by inserting a large amount of cat images on a system  (and, of course, due to it being the Internet, had to pair the cat images with the overused, yet still amusing Trololo song).

While Aboukhadijeh explained that due to the  HTML 5 data limit workaround, those using any of the affected Web browsers could eventually have their entire hard drive filled with unwanted data, he found the process takes much faster on a Macbook Pro Retina with a solid state drive (SSD) -- up to 1 GB of data can be injected every 16 seconds.

Due to how Mozilla caps data in its Firefox Web browser, it is immune to the flaw.

In true fashion that is the morally ambiguous life of a security researcher, Aboukhadijeh has both reported the flaw to the Web browser makers and has released the code for you and your friends to fill up others' hard drives with silly cat pictures (or it could be used for more nefarious purposes). Thankfully, so far there has been no word of the flaw being exploited in the wild.

About the Author

Chris Paoli is the site producer for Redmondmag.com and MCPmag.com.

Featured

  • Microsoft Bolsters Windows IoT with NXP and SQL Server Support

    Microsoft's Internet of Things (IoT) product line is continuing to grow, with a few new developments highlighted this week.

  • Tamper Protection Now Available to Microsoft Defender ATP Subscribers

    The Microsoft Defender Advanced Threat Protection (ATP) E5 subscription plan now has an optional "tamper protection" security feature, Microsoft announced on Monday.

  • Exploring OCR, a New Way To Get Data into Excel

    Microsoft recently added a new optical character recognition feature to Excel that lets users import data from a photograph taken from a smartphone. Here's how to use it.

  • Microsoft Authenticator App To Get Real-Time Phishing Protections

    Microsoft is working on adding capabilities to its Microsoft Authenticator app to help defeat security breaches enabled by advanced attack techniques, including phishing and man-in-the-middle methods.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.