Feeds

Browser makers open local storage hole in HTML5

Bad implementation of disk space limits

Combat fraud and increase customer satisfaction

A slip-up in the implementation of HTML5 on Chrome, Opera and Internet Explorer can be exploited to fill users’ hard drives, according to a 22-year-old Web developer from Stanford.

Feross Aboukhadijeh has posted a proof-of-concept of the exploit here and a demonstration page here.

He explains that HTML5 is designed to allow bigger cookies than its predecessor standards. Up to 10 MB of local storage is permitted by the standard, but the standard also recommends that browsers place limits on how much storage is used. Browsers also need to watch out for sites trying to use subdomains or “affiliated domains” to get around the storage limits.

While the browsers Aboukhadijeh identifies implement the per-domain limits – 2.5 MB in Chrome, 5 MB in Firefox and Opera, 10 MB in IE – they don’t properly block the use of storage by affiliated domains.

Filldisk example site

The FillDisk demonstration site

“Thus, cleverly coded websites, like FillDisk.com, have effectively unlimited storage space on visitor’s computers”, he writes. Only recent versions of Firefox are unaffected, he says, because it has a better implementation of local storage (it does, however, work on older versions of Firefox, according to this author’s test).

Aboukhadijeh claims the proof-of-concept code will fill 1 GB every 16 seconds on a Macbook Pro Retina’s solid state drive.

While it’s not the scariest bug in the world, he says users of affected browsers should join together in filing bug reports so their browser vendors fix the bug. ®

Update: A commenter says Opera is unaffected. To test, I installed Opera 12.14 on OSX. The disk-filler gets as far as claiming 76 MB of space, after which Opera asked if I wanted to raise the storage limit - so I agree that it appears to work properly. I have not tested Opera on any other OS or version. ®

SANS - Survey on application security programs

Whitepapers

Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.