I saw a 2008 article about a certain vulnerability in WebKit which referred to "Carpet Bombing": https://www.cert.org/blogs/certcc/2008/09/carpet_bombing_and_directory_p.html (This vulnerability is now resolved using a blacklist - DLLs, JAR, and some other files are no longer downloaded without prompt)

What struck me was that the term "Carpet Bombing" seemed to exist nowhere else except for these Safari and Chrome items.

Was the term really coined just for this vulnerability in these browsers? Can you shed some light on why there is no Wikipedia article, or any other reference, except for this one particular case which I refer to?

  • 2
    I have answered, but I don't think this is on-topic. English.SE would probably say it is general reference so no point migrating it over there.
    – Rory Alsop
    Oct 15 '12 at 20:00

Carpet bombing is a military term - meant to indicate laying a carpet of explosives or incendiaries in order to kill/destroy anything within the target area.

Wikipedia says:

Carpet bombing is a large aerial bombing done in a progressive manner to inflict damage in every part of a selected area of land. The phrase evokes the image of explosions completely covering an area, in the same way that a carpet covers a floor.

This ZDNet article shows what your Windows desktop looks like after the Safari "carpet bombing" vulnerability has run. The image from the article is shown below.

enter image description here

I suspect that someone called this "carpet bombing" because your desktop looks like a carpet has been applied to your desktop as each of the malware files on your desktop appear like a carpet pattern. Each file could also be thought of as a "bomb" because when executed the malware will infect your machine.

Also, the vulnerability is "dropping" many copies of the malware indiscriminately onto the desktop in the hope that one will cause the malware to get executed. This is much like the carpet bombing performed during war as described in the Wikipedia article.

  • I like that screenshot - that shows it pretty well. Have moved the contents of my answer inline.
    – Rory Alsop
    Oct 16 '12 at 6:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.