Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cookie Bomb or Let's Break the Internet

homakov.blogspot.com

Post reply on HN
Print view View original

11–20 of 82 posts

Re: Cookie Bomb or Let's Break the Internet

#11

Post by mavhc »

jffry wrote: post #8
lynxaegon wrote: post #6

It's really interesting. The problem is that i don't see any fix for it. The only way would be to update the browsers, or maybe use a plugin to block such attacks.

Or serve the untrusted content from a sub-subdomain, e.g. "foo.bar.CDN_HOST.com", so that you could only bomb bar.CND_HOST.com and not the entire domain

You'd think a higher level domain should be able to specify whether a subdomain can set cookies for it or not.

Re: Cookie Bomb or Let's Break the Internet

#12

Post by etcet »

rubbingalcohol wrote: post #2

Pretty clever. This appears to be in the same vein as that trick where you could use popups to spawn more popups, and by the time the user realized what was going on their computer was completely unresponsive. (fixed with popup blocking in any browser in the last decade.) Also, Fill my Disk: http://www.filldisk.com/ (local storage bomb) Implementing limits on the number of cookies would seem to be the natural solutio…

> This appears to be in the same vein as that trick where you could use popups to spawn more popups, and by the time the user realized what was going on their computer was completely unresponsive. (fixed with popup blocking in any browser in the last decade.)

I recently visited a site that did something similar but was still effective. It opened up mailto: URI's in a loop and since I had Thunderbird set up to handle the links, it practically killed my X session.

Re: Cookie Bomb or Let's Break the Internet

#14

Post by jffry »

mavhc wrote: post #11
jffry wrote: post #8

Earlier quoted context omitted.

Or serve the untrusted content from a sub-subdomain, e.g. "foo.bar.CDN_HOST.com", so that you could only bomb bar.CND_HOST.com and not the entire domain

You'd think a higher level domain should be able to specify whether a subdomain can set cookies for it or not.

That would be nice, but it would have a lot of ramifications. Before setting the cookie, the browser would need to know if it's allowed, so presumably it would have to load some file. Perhaps this could be done in a manner similar to CORS requests

Re: Cookie Bomb or Let's Break the Internet

#17

Post by tcgv »

asmithmd1 wrote: post #7

How do you set a cookie on a domain you do not control? Won't the browser only send cookies to a server on the domain you are trying to browse to? EDIT: found it - not any, arbitrary site can be DOS "Who can be cookie-bombed? Blogging/hosting/website/homepage platforms: Wordpress, Blogspot, Tumblr, Heroku, etc."

- "If you're able to execute your own JS on SUB1.example.com it can cookie-bomb not only your SUB1 but the entire *.example.com network, including example.com"

So you've got to be able to execute JS in a subdomain to plant a cookie bomb that will affect the entire domain.

Post reply on HN