YOUR CHANNEL IS LOADING
  • 1

    Morphing Microsoft

  • 2

    The Control Poll

  • 3

    Honeywords in SQL Server

  • 4

    The Challenger

  • 5

    The Platform Problem

The Voice of the DBA Data We Don't Want

MEVIOtoday

Mar 04, 2013 Data We Don't Want

Don't visit the FillDisk.com site, which I ran across a link to froman Arts Technica article that talks about a flaw in web browsers. It's possible a security flaw, possibly an availability flaw as well. Apparently the new HTML specification allows for sites to use the Web Storage Standard to keep data on your hard disk. There is a limit in most browsers for how much data you can store per domain, but the FillDisk site uses sub domains to put random junk on your drive. The author of the site built this as a proof of concept and was able to add 1GB of data to an SSD on a laptop every 16 seconds.

That's a denial of service type attack that I hadn't expected, but it is an interesting attack vector. I wouldn't expect this to impact servers, but if servers are consuming web services, and using controls based on browsers, there is the possibility this type of attack might affect them. I'd hope this were limited to web servers and not impact database servers, but it's certainly a concern if you have processes running on your database server that might retrieve data from a remote source.

 

Read the rest of "Data We Don't Want" at SQLServerCentral.