An HTML5 Exploit Can Fill Your Entire Hard Drive Quick

0pTicaL · 08 Mar 2013

A 22-year-old Web developer from Stanford, Feross Aboukhadijeh, has discovered that a slip-up in the implementation of HTML5 in Chrome, Internet Explorer and Safari (Opera has been ruled out) can be exploited to fill a viewer's entire hard drive. He even offers a proof-of-concept of the exploit, and a demonstration page backing up his discovery.

For those who want to see their hard drive load up with data through a web browser, check out FillDisk.com.

Source

Source code

If clicking on the "Stop the madness" button fails to give back your disk space, you can reclaim it manually (in Chrome) by going to Preferences > Show advanced settings... > Content settings > All cookies and site data... > search for "filldisk" > Remove all.

This exploit doesn't seem to work in Incognito mode. Can anyone else confirm?

nommy the first · 10 Mar 2013

The hack works on Chromium. I just watched my hard drive being filled up. Both normal and incognito are affected.
Side note: The "stop this madness" button on FillDisk doesn't work, so now I have 1GB of cat pictures somewhere on my hard drive

0pTicaL · 10 Mar 2013

They're in your cookies.

To reclaim used space, in your Chrome browser go to Settings -> Advanced Settings -> Content Settings, under Cookies click on "All cookies and site data". Then type "filldisk" in the Search cookies bar and delete all the cookies associated with filldisk.

Are you sure it's working in Incognito mode as well? When I'm in Incognito mode Resource Monitor shows no space being used up.

nommy the first · 10 Mar 2013

I already found them yea, thanks anyway!

And yes, it works in incognito (I use Comodo Dragon as browser, which is Chromium based). I had the page open, and my computer tab next to it, and I could see my free space drop like a brick.

0pTicaL · 10 Mar 2013

Hmmm, maybe there's something different with the way Comodo implements Incognito vs Chrome.

Resource Monitor shows me my disk's remaining space in real time. In normal mode I can see the exploit eating away disk space and it crashes the browser around ~965MB, in Incognito mode the browser crashes around ~1935MB but no space is consumed.