4 ms·
It would be fun to execute this against a mobile device, where storage is expensive. 2GB might be all that is required to choke the device. A neat client-side
by AlexV 15y ago
It would be fun to execute this against a mobile device, where storage is expensive. 2GB might be all that is required to choke the device.
A neat client-side DDoS :)
- marshray 15y agoOr rack up an insane unexpected data bill.
- objclxt 15y agoiOS (and Android I think, but I primarily dev iOS so that's where my knowledge is) won't let a website exceed a 5MB local storage limit without explicit user consent...so I suppose still technically possible, but not without getting the user to agree to it first.
- njs12345 15y agoI wonder if you could still perform a DOS by doing the following: - register 1000 domains - when the browser navigates to the first domain, store 5Mb - once the store has finished, redirect to the next domain - repeat steps 2-3 ad infinitum Anybody know if this would work?
- fl3x 15y agoThat could probably work! The documentation at http://dev.w3.org/html5/spec/offline.html#disk-space http://dev.w3.org/html5/spec/offline.html#disk-space states that "care should be taken to ensure that the restrictions cannot be easily worked around using subdomains", so one would really have to use different domains as you write, which sounds a bit costly.
- AlexV 15y agoSub-domains should work also then. Just make a page with bunch of IFrames, each on a different, random sub-domain. Edit: Ooops; didn't see the comment above about sub-domains. Worth a try though!
- evan_ 15y agoA malicious actor might write a wordpress worm to assemble a domain botnet and cross-link them all to each other such that visiting one stores 5 megs of nonsense from every site on a visitor's client.
- evanm 15y agoI mean, theoretically. But would a user actually willingly wait out this process?
- Joeri 15y agoThey would if you do it in an iframe while letting them play a flash game. They might even attribute slowdowns to the flash game.
- joshfraser 15y agoit doesn't need to be downloaded. it can be populated with generated data using JavaScript.
- andrewaylett 15y agoAt least on Gingerbread, the browser has quite a low global limit -- I sometimes hit it just from using Twitter and Google Search.
- ef4 15y agolocalStorage and application cache are not the same thing. localStorage is the one that prompts the user for more than 5MB, but the author was using application, which I've never seen prompt.
- notatoad 15y agounless something's changed in the last couple months, localStorage prompts for any storage, and cuts you off completely at 5MB.
- Joeri 15y agoYou can store up to 50 mb in appcache (instead of localstorage) in mobile safari. You can also store 50 mb in the web sql storage, but i don't know if that shares the appcache storage or is counted separately. The 5 mb limit for localstorage is because that's what the spec recommends.
- cheald 15y agoIf you're talking bandwidth cap attacks, then you could just keep cleaning out local storage and downloading more from /dev/random perpetually.
- fl3x 15y agoI think Opera Mobile shouldn't have this cache problem either, similar to my comment about the desktop version. The default cache limit in Opera Mobile is ~2 MB. I _believe_ that both quotas can be increased after confirmation from the user, but I haven't made any tests.
- kijin 15y agoHeh, you could easily DoS a Canadian home internet user (not mobile) by transferring a massive amount of data behind their back. So many people here are stuck with 25GB/mo limits.