Cookie Bomb or Let's Break the Internet
homakov.blogspot.com
Cookie Bomb or Let's Break the Internet
1–10 of 82 posts
Re: Cookie Bomb or Let's Break the Internet
#2Pretty clever. This appears to be in the same vein as that trick where you could use popups to spawn more popups, and by the time the user realized what was going on their computer was completely unresponsive. (fixed with popup blocking in any browser in the last decade.)
Also, Fill my Disk: http://www.filldisk.com/ (local storage bomb)
Implementing limits on the number of cookies would seem to be the natural solution to the problem in the OP, although I doubt this problem is "worth" solving in practice since most people seem to be using cookies to do what they were meant to do.
Re: Cookie Bomb or Let's Break the Internet
#3Terry Davis scares me.
Re: Cookie Bomb or Let's Break the Internet
#4Pretty clever. This appears to be in the same vein as that trick where you could use popups to spawn more popups, and by the time the user realized what was going on their computer was completely unresponsive. (fixed with popup blocking in any browser in the last decade.) Also, Fill my Disk: http://www.filldisk.com/ (local storage bomb) Implementing limits on the number of cookies would seem to be the natural solutio…
not amount, but total Length of the Cookie header. Otherwise number of cookies will be ~5.
Yes I recall filldisk.com, but that one doesn't seem harmful to user (he knows where it comes from & exploit is quite slow).
Cookie bomb can "bomb" some exact path, so the trick has many uses. E.g. you can "block" /dont_like_this_post on blogspot entirely, while the rest of Blogger will work.
Re: Cookie Bomb or Let's Break the Internet
#5Pretty clever. This appears to be in the same vein as that trick where you could use popups to spawn more popups, and by the time the user realized what was going on their computer was completely unresponsive. (fixed with popup blocking in any browser in the last decade.) Also, Fill my Disk: http://www.filldisk.com/ (local storage bomb) Implementing limits on the number of cookies would seem to be the natural solutio…
The extra level of subdomain as proposed by Homakov, seems like a much more worthwhile fix.
Re: Cookie Bomb or Let's Break the Internet
#6It's really interesting. The problem is that i don't see any fix for it. The only way would be to update the browsers, or maybe use a plugin to block such attacks.
Re: Cookie Bomb or Let's Break the Internet
#7How do you set a cookie on a domain you do not control? Won't the browser only send cookies to a server on the domain you are trying to browse to?
EDIT: found it - not any, arbitrary site can be DOS
"Who can be cookie-bombed? Blogging/hosting/website/homepage platforms: Wordpress, Blogspot, Tumblr, Heroku, etc."
Re: Cookie Bomb or Let's Break the Internet
#8It's really interesting. The problem is that i don't see any fix for it. The only way would be to update the browsers, or maybe use a plugin to block such attacks.
Or serve the untrusted content from a sub-subdomain, e.g. "foo.bar.CDN_HOST.com", so that you could only bomb bar.CND_HOST.com and not the entire domain
Re: Cookie Bomb or Let's Break the Internet
#9How do you set a cookie on a domain you do not control? Won't the browser only send cookies to a server on the domain you are trying to browse to? EDIT: found it - not any, arbitrary site can be DOS "Who can be cookie-bombed? Blogging/hosting/website/homepage platforms: Wordpress, Blogspot, Tumblr, Heroku, etc."
This is for domains that serve user-provided Javascript, such a blog hosts and GitHub.
Re: Cookie Bomb or Let's Break the Internet
#10Possible detection method (server side)?
If the request is too long due to cookie length, then look at the last URL the client IP hit. That should be the URL creating the long cookies. Remove the offending URL / resource.