Please define “Carpet Bombing”

Question

I saw a 2008 article about a certain vulnerability in WebKit which referred to "Carpet Bombing": https://www.cert.org/blogs/certcc/2008/09/carpet_bombing_and_directory_p.html (This vulnerability is now resolved using a blacklist - DLLs, JAR, and some other files are no longer downloaded without prompt)

What struck me was that the term "Carpet Bombing" seemed to exist nowhere else except for these Safari and Chrome items.

Was the term really coined just for this vulnerability in these browsers? Can you shed some light on why there is no Wikipedia article, or any other reference, except for this one particular case which I refer to?

Answer 1

Carpet bombing is a military term - meant to indicate laying a carpet of explosives or incendiaries in order to kill/destroy anything within the target area.

Wikipedia says:

Carpet bombing is a large aerial bombing done in a progressive manner to inflict damage in every part of a selected area of land. The phrase evokes the image of explosions completely covering an area, in the same way that a carpet covers a floor.

This ZDNet article shows what your Windows desktop looks like after the Safari "carpet bombing" vulnerability has run. The image from the article is shown below.

I suspect that someone called this "carpet bombing" because your desktop looks like a carpet has been applied to your desktop as each of the malware files on your desktop appear like a carpet pattern. Each file could also be thought of as a "bomb" because when executed the malware will infect your machine.

Also, the vulnerability is "dropping" many copies of the malware indiscriminately onto the desktop in the hope that one will cause the malware to get executed. This is much like the carpet bombing performed during war as described in the Wikipedia article.