Favicon bug

https://github.com/benjamingr/favicon-bug

by inglor • 11 years ago

310 93 11 years ago

inglor10• 11 years ago

I'm the author of the GH repo and I just want to give full credit for figuring out Chrome does this to this guy: https://twitter.com/a_de_pasquale

All I did was think "if it works for 65mb why not more?" and write a quick proof of concept. Gets to 10gb on my 4gig laptop and then crashes. (MBA, OSX 10.10).

0x0• 11 years ago

Wow, the twitter replies suggesting this was an accidental "tar cvf * backup.tar" sound right on the mark. Especially considering favicon.ico is probably the first file in a wp install, alphabetically.

s_kilk• 11 years ago

This is my new favorite bug/mistake. It's just exquisite.

aw3c23• 11 years ago

For everyone struggling with tar, please be aware that you can use long-form arguments. So instead of "tar cvf filename files" you use "tar --create --verbose --file file.tar files" or maybe another order like ""tar --create --file file.tar --verbose files"-

It is much more sensible and intuitive.

inglor10• 11 years ago

Wow, deeply impressed with Firefox who rolled a fix in 3 hours. Mad props.

gtk40• 11 years ago

How do other browsers behave?

inglor10• 11 years ago

Firefox doesn't behave too well either. Gets to 23169 in the counter http://i.imgur.com/3zkPKD7.png

moskie• 11 years ago

So why single out Chrome in this repository and post? Feels like a hit piece on Chrome this way.

yincrash• 11 years ago

What prevents someone from doing this with a 1 px junk image that is many GB large?

edit: to clarify, i'm talking about in the page itself rather than the favicon.

smhenderson2• 11 years ago

Just a couple of off the cuff thoughts on that. Nothing out of the box prevents what you describe as far as I know but one of the points made in the article is that favicon is downloaded without any update to or indication from the status bar. An image on the page will at least throw up a "waiting for evil.com" in the status bar giving a user some indication that something being downloaded is causing a major slow down.

Typically an ad-blocker or script blocker can be used to prevent the image from downloading. But I don't know of a blocker add-on that worries about favicon.

Overall while annoying and a bit strange that this wasn't anticipated and fixed long ago I'd say this is probably a non-issue. As another poster said I don't see a payoff here so I doubt it will be actively exploited in some "internet screeching to a halt" kind of way.

stock_toaster2• 11 years ago

  > Overall while annoying and a bit strange that this wasn't anticipated and fixed long ago I'd say this is probably a non-issue. As another poster said I don't see a payoff here so I doubt it will be actively exploited in some "internet screeching to a halt" kind of way.

favicons can also be inserted dynamically. http://stackoverflow.com/questions/260857/changing-website-f...

If some site has a js injection bug, or there is someone doing MiTM like the Great Firewall, I suppose they could inject a favicon link that referenced some location on another site, with the intent towards DoS.

gprasanth• 11 years ago

my guess is if no favicon is specified browsers request for the default favicon path after page load (possibly) in a non render thread. that's definitely an issue, right?

also, interesting discussion from wayback:

https://bugzilla.mozilla.org/show_bug.cgi?id=260500

InclinedPlane• 11 years ago

Different behavior. It'll cause the tab to load forever, but it won't cause the whole browser to crash or become unresponsive.

tomswartz072• 11 years ago

This seems like an active exploit, as pointed out in the OP's inspiration Twitter post.

`tar` up an entire WordPress install, save it as `favicon.ico` and then easily pull the files from the server.

This would be a good idea to get fixed very soon, I would assume.

EDIT: I stand corrected in terms of exploit-ability, but I still assert that crashing a browser and chewing tons of bandwidth are pretty big issues.

Someone12343• 11 years ago

Whatever that website is, has an issue, since that backup.tar may contain their database credentials.

The favicon thing is just an annoying browser crashing bug. You could call that an "exploit" but up until fairly recently you were able to crash many browsers by generating too many message boxes (e.g. alert()) asynchronously.

So while, yes, it would be nice to fix it I don't really see it as being a high priority or one which will be actively exploited (since there is no "payoff" to either prankers or bad guys to this exploit).

inglor10• 11 years ago

Eating users' bandwidth has its uses as well as filling up a network with communication. This works with JavaScript disabled too but yeah I agree it's not a huge priority.

desbo• 11 years ago

`tar` up an entire WordPress install, save it as `favicon.ico` and then easily pull the files from the server.

assuming I have access to the server to create the tar and save it, what's the difference between downloading the archive as favicon.ico or any other name?

emidln• 11 years ago

If you don't have control over the logging (for a number of reasons) you can disguise your xf in the access logs. I'd be willing to bet that a lot of logging config files for access logs even ignore favicon.ico.

Someone12343• 11 years ago

Just doing some quick back of napkin maths, even assuming Apple's 128x128 app icons, and 48 bit colors (32 is more typical), we're still talking about a sub-100 kb max for a favicon.

So if Chrome set it even at 20 Mb that would still be orders of magnitude more than any favicon should be for at least the next five or so years (even assuming 256x256 became common for app icons).

miahi• 11 years ago

You can have animated favicons.

tomswartz072• 11 years ago

Even still, the animated favicons would be low framerate and fairly low resolution.

I don't think we're ready for 60 FPS .gifv favicons just yet. :)

logicallee• 11 years ago

ten gigabytes is a helluva favicon animation... I wonder if it would be measured in hours, days, or weeks...

vacri• 11 years ago

"The most memory anyone needs is 640k"...

ahoge• 11 years ago

Hard limits aren't much of an issue if updates are rolled out ever 6 weeks.

jfoster2• 11 years ago

That was said with a wide open scope. Bill was wrong because he hadn't imagined all the things people might do with PCs. In this discussion, the scope is very limited; favicons.

fao_• 11 years ago

In reply to both this and the original discovery[1], I wonder if this is a valid (albeit morally dubious) method of backing up (or at least ensuring the survival of) information that is at risk from government/<insert 'bad person' here> censorship/removal/other.

NB: Not that I condone this.

[1] https://twitter.com/a_de_pasquale/status/608997818913665024

TD-Linux• 11 years ago

Did you file bugs for either of these two browsers?

inglor10• 11 years ago

Good idea https://code.google.com/p/chromium/issues/detail?id=500639&t... https://bugzilla.mozilla.org/show_bug.cgi?id=1174811

groby_b• 11 years ago

Is this a Mac only bug, or have you only repro-ed it on Mac?

protomyth2• 11 years ago

So a screwed up favicon can eat a wireless user's whole bandwidth for the month with them knowing it. Great...

olalonde• 11 years ago

Not to minimise this issue but there are other ways for websites to silently waste user bandwidth. I think the real issue here is that it crashes Chrome and can render the computer unresponsive.

cma• 11 years ago

So can an ajax loop.

inglor10• 11 years ago

An ajax loop requires you to have JavaScript enabled and will show you a loader indicator.

l1ambda• 11 years ago

Or a big HTML file.

icefox• 11 years ago

Only if you mobile browser actually download them, ios for example from what it looks like doesn't.

protomyth2• 11 years ago

Some folks use cell (direct or tethered) on our laptops.

inglor10• 11 years ago

Check out the PRs on the repo - there is a PR demonstrating this exploit in iOS.

__z• 11 years ago

So can a screwed up iOS app

http://www.troyhunt.com/2014/10/find-crazy-stuff-in-mobile-a...

"Here’s a pop quiz for you: how much data do you reckon this iPad app downloads when it first runs? I don’t mean how big it is to download from the App Store (it’s 25MB), I mean after you download it then simply tap the icon to fire it up, how much data does it pull down if you don’t touch it again? ... Try 1.8 gigabytes. You heard me, that’s not a typo. You open up this 25MB app and it’ll pull down dozens of files of dozens of meg each when you run it. Won’t someone please think of the bandwidth!!!"

ceejayoz• 11 years ago

It'd be nice if downloading over X MB in a day was an extended permission just like access to contacts/photos/etc. is.

firlefans• 11 years ago

Way to ruin the fun for the rest of us ;)

hartator• 11 years ago

Just tested on Safari 8.0.6, doesn't seem to download the favicon at all. Weird, even after closing the tab, Chrome still keep downloading the favicon.

ubanholzer2• 11 years ago

Safari Version 8.0.6 (10600.6.3) on OS X 10.10.3 is downloading it: https://imgur.com/B2LeRy4

ubanholzer2• 11 years ago

it's also working on iOS 8.1.2. As soon as you tap on the share icon, the download starts: https://github.com/benjamingr/favicon-bug/pull/2

vezzy-fnord• 11 years ago

Interesting to see server-side JavaScript being used as an exploit language.

inglor10• 11 years ago

This is about as easy to do with every other language - I could have done it in C, or Python or PHP or Java or C# or whatever - node was just the lowest friction one for the PoC - all you ned is an HTTP server that lets you write dynamic requests - could have been bash even.

ghuntley• 11 years ago

    ln -s /dev/urandom /srv/wwwroot/favicon.ico

fugyk• 11 years ago

Why do browser people always forget about favicons? Most browser saved favicon on private browsing and then this.

frik• 11 years ago

...and used favicons for the bookmarks.

Nadya• 11 years ago

Mind telling me why that is an issue?

My bookmark bar is entirely favicons. I remove the name and this allows me to fit more in quick-access without having to delve into folders.

terminado• 11 years ago

Because Microsoft.

rjcz• 11 years ago

I've noticed it several months ago by going through my server logs - hadn't included 'favicon.ico' in the HTML and yet, the browser - Chrom(e|ium) - tried downloading it every time.

Thanks for reminding me to report it ;^)

psychometry• 11 years ago

Most browsers have been doing that since favicons have existed. Older versions of IE used to check for /favicon.ico no matter what, even if you specify a different URL with a <link> tag. You really have no choice but to make the file available at the URL even today.

iDemonix2• 11 years ago

That's not a bug, it's a feature. Pretty much every modern browser will look in the default spot for a favicon if you don't specify it.

underwater• 11 years ago

You should try and use ServiceWorkers to generate the file -- then you can have the client DOS itself.

tiglionabbit• 11 years ago

This reminds me of a bug I found in an internal tool. We only had about 200 users, but somehow Apache would run out of workers because they were all busy serving some kind of request. Turns out our Apache configuration was wrong specifically in the case of serving the favicon. If you requested the favicon, it would get in a redirect loop, increasing the length of the url a little more each time until it hit the maximum url length and gave up. A new job like this would get kicked off every time any user visited a page, and it'd take several minutes before it finally gave up. So every user was unwittingly opening tons of long-running requests, with no indication that they were doing anything.

shawkinaw• 11 years ago

Yeah, I hit something sort of similar but on the client side: While clicking around a single-page webapp, Chrome would manage to use up all its outbound connections (10 or so) trying to download non-existent favicons, leaving none for real use. And those favicon requests somehow never timed out. Chrome's favicon handling is pretty bad.

drivingmenuts• 11 years ago

I pray once or twice a month that someone somewhere will just end the favicon.

Or at least make it's absence a non-logworthy event.

Or replace it with something sane, like a .png.

porges• 11 years ago

All major browsers support PNG favicons

Dylan168072• 11 years ago

Not only is there support in practice, but PNG files have been technically-valid .ico files for a decade.

Edit: Actually on further investigation they might be omitting a header, but they're still 99% valid.

frozenport• 11 years ago

Is storing data as bits insane? For a 32x32 image, jpg overhead becomes significant.

Dylan168072• 11 years ago

Why would you use JPG for something that should be pixel-art?

But it's not really that bad. Well under 200 bytes of overhead for 1000 pixels. PNG has under 50 bytes of overhead.

tomjepp2• 11 years ago

Even better - this works with compressed favicons.

Take http://pastie.org/10242118 and create yourself a favicon file:

dd if=/dev/zero of=favicon.png bs=1M count=4096

gzip -9 favicon.png

you can now crash lots of browsers with minimal bandwidth usage :)

demo: http://dev.tomjepp.uk/

tomjepp2• 11 years ago

This makes a 4GB file when decompressed and is plenty large enough to crash a 32-bit browser. You may need a larger file to reliably crash 64-bit browsers.

jfoster2• 11 years ago

Haven't tried it, but does it crash the browser or the tab? Under Chrome's architecture, a page should potentially be able to crash the tab, but not the browser. (or that's my understanding of it, anyway)

nodesocket• 11 years ago

Seems like an easy and logical fix for browsers.

   function fetchFavIcon() {
       if (favicon.fileSize > 1MB) { return false; }

       ...
   }

empyrical• 11 years ago

Should this have been done as a private disclosure to browser vendors first before going public, or is that more for security problems?

voltagex_• 11 years ago

Anyone tested Firefox/Chrome/Webview for Android?

jakeogh• 11 years ago

I like Surf's approach:

  if(g_str_has_suffix(uri, "/favicon.ico"))
      webkit_network_request_set_uri(req, "about:blank");

http://git.suckless.org/surf/tree/surf.c#n237

Favicon bug

Related Stories