4 ms·

What prevents someone from doing this with a 1 px junk image that is many GB large? edit: to clarify, i'm talking about in the page itself rather than the favi

What prevents someone from doing this with a 1 px junk image that is many GB large? edit: to clarify, i'm talking about in the page itself rather than the favicon.

smhenderson 11y ago
Just a couple of off the cuff thoughts on that. Nothing out of the box prevents what you describe as far as I know but one of the points made in the article is that favicon is downloaded without any update to or indication from the status bar. An image on the page will at least throw up a "waiting for evil.com" in the status bar giving a user some indication that something being downloaded is causing a major slow down. Typically an ad-blocker or script blocker can be used to prevent the image from downloading. But I don't know of a blocker add-on that worries about favicon. Overall while annoying and a bit strange that this wasn't anticipated and fixed long ago I'd say this is probably a non-issue. As another poster said I don't see a payoff here so I doubt it will be actively exploited in some "internet screeching to a halt" kind of way.
- stock_toaster 11y ago
  > Overall while annoying and a bit strange that this wasn't anticipated and fixed long ago I'd say this is probably a non-issue. As another poster said I don't see a payoff here so I doubt it will be actively exploited in some "internet screeching to a halt" kind of way. favicons can also be inserted dynamically. http://stackoverflow.com/questions/260857/changing-website-favicon-dynamically/260876#260876 http://stackoverflow.com/questions/260857/changing-website-f... If some site has a js injection bug, or there is someone doing MiTM like the Great Firewall, I suppose they could inject a favicon link that referenced some location on another site, with the intent towards DoS.
  - smhenderson 11y ago
    Well I don't disagree but on the other hand the article is focused on what it does to a client so I wasn't thinking it through the way you are. It also occurs to me that given the ability to insert yourself between the client and the server has to open up a number of possible attack vectors that are more worth while than crashing the client. I get (I think) the point about if censorship is the goal this is a way to make clients stay away from a particular server but if you're in a position to MITM them why not just return 404's and be done with it? Not trying to argue, :-) Just want to make sure I'm understanding your point correctly...
    - stock_toaster 11y ago
      I assume you can (untested) reference https endpoints with a favicon? If you can inject html though, a hidden image would probably would just as well. Although the behavior of chrome apparently still requesting the favicon file after the tab has closed, and possibly storing it in the history or bookmark file, may make this more or less appealing. Unsure. http://www.netresec.com/?page=Blog&month=2015-03&post=China%27s-Man-on-the-Side-Attack-on-GitHub http://www.netresec.com/?page=Blog&month=2015-03&post=China%...
gprasanth 11y ago
my guess is if no favicon is specified browsers request for the default favicon path after page load (possibly) in a non render thread. that's definitely an issue, right? also, interesting discussion from wayback: https://bugzilla.mozilla.org/show_bug.cgi?id=260500 https://bugzilla.mozilla.org/show_bug.cgi?id=260500
InclinedPlane 11y ago
Different behavior. It'll cause the tab to load forever, but it won't cause the whole browser to crash or become unresponsive.

What prevents someone from doing this with a 1 px junk image that is many GB large? edit: to clarify, i'm talking about in the page itself rather than the favicon.

smhenderson 11y ago

Just a couple of off the cuff thoughts on that. Nothing out of the box prevents what you describe as far as I know but one of the points made in the article is that favicon is downloaded without any update to or indication from the status bar. An image on the page will at least throw up a "waiting for evil.com" in the status bar giving a user some indication that something being downloaded is causing a major slow down. Typically an ad-blocker or script blocker can be used to prevent the image from downloading. But I don't know of a blocker add-on that worries about favicon. Overall while annoying and a bit strange that this wasn't anticipated and fixed long ago I'd say this is probably a non-issue. As another poster said I don't see a payoff here so I doubt it will be actively exploited in some "internet screeching to a halt" kind of way.

stock_toaster 11y ago
> Overall while annoying and a bit strange that this wasn't anticipated and fixed long ago I'd say this is probably a non-issue. As another poster said I don't see a payoff here so I doubt it will be actively exploited in some "internet screeching to a halt" kind of way. favicons can also be inserted dynamically. http://stackoverflow.com/questions/260857/changing-website-favicon-dynamically/260876#260876 http://stackoverflow.com/questions/260857/changing-website-f... If some site has a js injection bug, or there is someone doing MiTM like the Great Firewall, I suppose they could inject a favicon link that referenced some location on another site, with the intent towards DoS.
- smhenderson 11y ago
  Well I don't disagree but on the other hand the article is focused on what it does to a client so I wasn't thinking it through the way you are. It also occurs to me that given the ability to insert yourself between the client and the server has to open up a number of possible attack vectors that are more worth while than crashing the client. I get (I think) the point about if censorship is the goal this is a way to make clients stay away from a particular server but if you're in a position to MITM them why not just return 404's and be done with it? Not trying to argue, :-) Just want to make sure I'm understanding your point correctly...
  - stock_toaster 11y ago
    I assume you can (untested) reference https endpoints with a favicon? If you can inject html though, a hidden image would probably would just as well. Although the behavior of chrome apparently still requesting the favicon file after the tab has closed, and possibly storing it in the history or bookmark file, may make this more or less appealing. Unsure. http://www.netresec.com/?page=Blog&month=2015-03&post=China%27s-Man-on-the-Side-Attack-on-GitHub http://www.netresec.com/?page=Blog&month=2015-03&post=China%...

gprasanth 11y ago

my guess is if no favicon is specified browsers request for the default favicon path after page load (possibly) in a non render thread. that's definitely an issue, right? also, interesting discussion from wayback: https://bugzilla.mozilla.org/show_bug.cgi?id=260500 https://bugzilla.mozilla.org/show_bug.cgi?id=260500

InclinedPlane 11y ago

Different behavior. It'll cause the tab to load forever, but it won't cause the whole browser to crash or become unresponsive.