Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cookie Bomb or Let's Break the Internet

homakov.blogspot.com

Post reply on HN
Print view View original

21–30 of 82 posts

Re: Cookie Bomb or Let's Break the Internet

#21

Post by joosters »

jchung wrote: post #10

Possible detection method (server side)? If the request is too long due to cookie length, then look at the last URL the client IP hit. That should be the URL creating the long cookies. Remove the offending URL / resource.

That won't work, and could be easily abused by crafting your own requests to blame any arbitrary URL of your choosing.

Plus, servers drop huge requests because they are most likely malformed or DOS attempts. Attempting to do extra work (like tracking down previous visits by the client) will only make matters worse for the server.

Re: Cookie Bomb or Let's Break the Internet

#22

Post by homakov »

jffry wrote: post #14
mavhc wrote: post #11

Earlier quoted context omitted.

You'd think a higher level domain should be able to specify whether a subdomain can set cookies for it or not.

That would be nice, but it would have a lot of ramifications. Before setting the cookie, the browser would need to know if it's allowed, so presumably it would have to load some file. Perhaps this could be done in a manner similar to CORS requests

Content-Security-Policy: can-set-cookies: no!

BTW if JS is of we can use

Re: Cookie Bomb or Let's Break the Internet

#23

Post by JoshTriplett »

etcet wrote: post #12
rubbingalcohol wrote: post #2

Pretty clever. This appears to be in the same vein as that trick where you could use popups to spawn more popups, and by the time the user realized what was going on their computer was completely unresponsive. (fixed with popup blocking in any browser in the last decade.) Also, Fill my Disk: http://www.filldisk.com/ (local storage bomb) Implementing limits on the number of cookies would seem to be the natural solutio…

> This appears to be in the same vein as that trick where you could use popups to spawn more popups, and by the time the user realized what was going on their computer was completely unresponsive. (fixed with popup blocking in any browser in the last decade.) I recently visited a site that did something similar but was still effective. It opened up mailto: URI's in a loop and since I had Thunderbird set up to handle…

It shouldn't be possible to launch mailto links without an interactive prompt; if it is, please file a bug on the browser.

Re: Cookie Bomb or Let's Break the Internet

#26

Post by homakov »

tptacek wrote: post #25

This is something Zalewski has written about: http://lcamtuf.blogspot.com/2010/10/http-cookies-or-how-not-... --- if this kind of thing is interesting to you, his latest book, _The Tangled Web_, is excellent.

I read that post before, maybe I missed, but where he says about DoS possibilities of cookie tossing?

Re: Cookie Bomb or Let's Break the Internet

#27

Post by rcsorensen »

The impact on CDN providers is kinda scary.

To take an example we all know and love, a malicious *.cloudfront.net distribution could be setting cookies against cloudfront, breaking all your fancy static asset serving from cloudfront.

Is there a mitigation other than _always_ having to use a myappname-static.com domain name?

Thinking about this at a higher level -- there are some interesting similarities to "shared hosting" resource contention, but this time with domain names on CDNs. If somebody executes a forkbomb on your shared host, you're hosed. If somebody executes a cookiebomb on your CDN provider SLD, you're hosed.

Browser vendors could prevent this with good second level domain support. Register cloudfront, akamai, etc domain names as only hosting user-created content on third level domains. Pin large examples to the browser distribution, and allow TXT records in DNS specifying this at the top level.

Re: Cookie Bomb or Let's Break the Internet

#28

Post by aaren »

bernardom wrote: post #24
aaren wrote: post #18

Is this the reason I can't access any *.github.io right now? Is there an equivalent to status.github.com for github.io?

Have... you tried clearing your cookies? :-)

! I should actually read the content of articles. That's enough internet for today.

Re: Cookie Bomb or Let's Break the Internet

#30

Post by tptacek »

homakov wrote: post #26
tptacek wrote: post #25

This is something Zalewski has written about: http://lcamtuf.blogspot.com/2010/10/http-cookies-or-how-not-... --- if this kind of thing is interesting to you, his latest book, _The Tangled Web_, is excellent.

I read that post before, maybe I missed, but where he says about DoS possibilities of cookie tossing?

Search for "Does this matter from a security perspective".

Also: take a crack at the CTF we set up. I think (a) you'll do well at it and (b) it'll be fun to watch you. http://microcorruption.com.

Post reply on HN