Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to defend your website with ZIP bombs (2017)

blog.haschek.at

Post reply on HN
Print view View original

21–30 of 79 posts

Re: How to defend your website with ZIP bombs (2017)

#21

Post by bayindirh »

hannob wrote: post #16

People have been coming up with ideas like that regularly. I'm not a fan. The title says that you can "defend" your webpage, but it is not clear how it "defends" against anything. The only thing you possibly achieve is that every now and then, someone with an automated scanner (which may be an attacker, or may be a security researcher or service) will see his tool crash or consume large amounts of resources. You're s…

> you probably should spend your time with something different than building zip bombs, and instead fix the security problems you have.

Why not both? You can both create a well configured server to reduce its attack surface and add a booby-trap or two for really adamant scanners which hit very specific endpoints on your site.

I don't have to welcome every scanner with open arms. Maybe I'm doing some research, PoC||GTFO style, and your scanner found my research. It's not my problem.

Re: How to defend your website with ZIP bombs (2017)

#22

Post by waihtis »

hannob wrote: post #16

People have been coming up with ideas like that regularly. I'm not a fan. The title says that you can "defend" your webpage, but it is not clear how it "defends" against anything. The only thing you possibly achieve is that every now and then, someone with an automated scanner (which may be an attacker, or may be a security researcher or service) will see his tool crash or consume large amounts of resources. You're s…

Perhaps used to be true, however I believe active countermeasures will grow in importance in the near future. We are on the cusp of seeing a lot more sophisticated class of automated attacks (once the malicious cyber actors get a grasp on how to use LLM's in their favour) and active disruption of these capabilities will be important, not just building more shields around yourself. Before that, we need to fast-track the normalization of using active countermeasures as most are in the same camp as you are.

Re: How to defend your website with ZIP bombs (2017)

#23

Post by lifthrasiir »

If the client supports Brotli, this attack can be made much more effective because the maximum compression ratio of Brotli is much higher than gzip. DEFLATE used by gzip has the maximum ratio of 1032:1 because each run can emit at most 258 bytes and need at least 2 bits, but Brotli allows zero bits per code when there is only one code possible. So Brotli's result only depends on the underlying metablock overhead, but sadly each metablock can contain at most 2^24 - 1 uncompressed bytes (because that uncompressed size is encoded per each metablock, while DEFLATE needs a separate end-of-block code). Still this translates to at least 1000000:1 ratio so it's worthwhile.

Re: How to defend your website with ZIP bombs (2017)

#24

Post by Avamander »

This can also be done with nginx's gzip_static/brotli_static, somewhat easier.

One similar technique against port scanners is to send ~50% rejects and do ~50% drops in the case of closed ports. Most of them will pollute their output or slow down tremendously assuming packet loss.

Re: How to defend your website with ZIP bombs (2017)

#25

Post by justsomehnguy »

> How to defend your website with ZIP bombs

.. or more like 'How to retaliate when you think too much of your [website] importance'.

While the ability to (maaaaybe) crash the crawler sounds nice it probably doesn't do what do you think. At best you just snapped off one head of Hydra, only more to come.

Also using PHP instead of the web-server's path actions...

Re: How to defend your website with ZIP bombs (2017)

#26

Post by noobermin »

hannob wrote: post #16

People have been coming up with ideas like that regularly. I'm not a fan. The title says that you can "defend" your webpage, but it is not clear how it "defends" against anything. The only thing you possibly achieve is that every now and then, someone with an automated scanner (which may be an attacker, or may be a security researcher or service) will see his tool crash or consume large amounts of resources. You're s…

It really is only in the world of IT security is this attitude so pervasive, where you constantly blame victims. While defense is a great offense it can't hurt to be an annoyance to bad actors.

Re: How to defend your website with ZIP bombs (2017)

#27

Post by lifthrasiir »

koito17 wrote: post #8

If I recall correctly, HTTP clients do not need to care about Content-Encoding at all and can choose to just not do anything with your ZIP bomb. To really hit them, you will want to do this at the Transfer-Encoding level.

If the client wants to parse HTML and do something accordingly, it at least has to honor some popular Content-Encoding.

Re: How to defend your website with ZIP bombs (2017)

#28

Post by [deleted] »

artiscode wrote: post #14
reaperman wrote: post #6

Is it legal to purposefully distribute a malicious payload as a booby trap?

Is it really malicious though? 10 gigs of zeros doesn’t seem that malicious to me. Microcontrollers often have a few megabytes of RAM if not less, does that make a few megabyte photo malicious? Edit: spelling. I’m old school and used to typing on my computer. It’s getting repaired and all I’ve got is my phone. /rant

[deleted]

Re: How to defend your website with ZIP bombs (2017)

#29

Post by foul »

hannob wrote: post #16

People have been coming up with ideas like that regularly. I'm not a fan. The title says that you can "defend" your webpage, but it is not clear how it "defends" against anything. The only thing you possibly achieve is that every now and then, someone with an automated scanner (which may be an attacker, or may be a security researcher or service) will see his tool crash or consume large amounts of resources. You're s…

>You're spending time trying to annoy attackers that you should probably just ignore.

s/ignore/block at firewall-level/

To me this article is of relevance nonetheless because It inspires me for messing with AI trainers by crafting an html page ZIP bomb full of ZIP-bomb-like embedded attachments (stylesheets, images, etc).

Post reply on HN