Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to defend your website with ZIP bombs (2017)

blog.haschek.at

Post reply on HN
Print view View original

41–50 of 79 posts

Re: How to defend your website with ZIP bombs (2017)

#41

Post by kxrm »

13of40 wrote: post #37

It reminds me of someone I read about from the early web who defended their website against email address harvesting crawlers by adding a dynamic page that threw up some random emails and links, where the links just led back to the dynamic page under a new path on the same host. The crawlers would get stuck downloading millions of fake email addresses until they eventually broke.

Guilty, I did this on my first project site back in the early 00s. It only worked for a small time before scanners got more sophisticated. It was a fun diversion but people who do this quickly adapt.

Re: How to defend your website with ZIP bombs (2017)

#42

Post by mcqueenjordan »

This reminds me of the chat bot tool that was deployed to reply to scam emails and waste maximal time of the scammers by seeming like a vulnerable, gullible target. The chat bot would drag out the interaction slowly, wasting as much time as possible for the scammer, all the while posing as a real human.

There are a lot of comments here decrying this as a method to defend your website, but in some senses it's a very smart tactical weapon, especially if deployed widely. There's an often quoted phrase in making secure password hashes that you're not making it impossible to crack, only prohibitively expensive to do so such that the benefits don't outweigh the costs. The same principle applies here -- if the good guys collectively make scanning a very expensive endeavor, the juice is no longer worth the squeeze for the bad guys. Just blocking an IP is cheap for them. Make them bleed a little.

Re: How to defend your website with ZIP bombs (2017)

#43

Post by [deleted] »

hannob wrote: post #16

People have been coming up with ideas like that regularly. I'm not a fan. The title says that you can "defend" your webpage, but it is not clear how it "defends" against anything. The only thing you possibly achieve is that every now and then, someone with an automated scanner (which may be an attacker, or may be a security researcher or service) will see his tool crash or consume large amounts of resources. You're s…

[deleted]

Re: How to defend your website with ZIP bombs (2017)

#44

Post by mcqueenjordan »

mcqueenjordan wrote: post #42

This reminds me of the chat bot tool that was deployed to reply to scam emails and waste maximal time of the scammers by seeming like a vulnerable, gullible target. The chat bot would drag out the interaction slowly, wasting as much time as possible for the scammer, all the while posing as a real human. There are a lot of comments here decrying this as a method to defend your website, but in some senses it's a very s…

Another possible tactic is to trickle your packets back slowly, say trickle 1 TCP packet back to them per second. Sure, they probably have client-side timeouts, but again, if everyone did this, wouldn't it be a pain to scan for vulns? Every endpoint you hit would last the duration of your timeout.

Re: How to defend your website with ZIP bombs (2017)

#45

Post by Freak_NL »

bayindirh wrote: post #21
hannob wrote: post #16

People have been coming up with ideas like that regularly. I'm not a fan. The title says that you can "defend" your webpage, but it is not clear how it "defends" against anything. The only thing you possibly achieve is that every now and then, someone with an automated scanner (which may be an attacker, or may be a security researcher or service) will see his tool crash or consume large amounts of resources. You're s…

> you probably should spend your time with something different than building zip bombs, and instead fix the security problems you have. Why not both? You can both create a well configured server to reduce its attack surface and add a booby-trap or two for really adamant scanners which hit very specific endpoints on your site. I don't have to welcome every scanner with open arms. Maybe I'm doing some research, PoC||GT…

> PoC||GTFO style

?

Re: How to defend your website with ZIP bombs (2017)

#46

Post by bayindirh »

Freak_NL wrote: post #45
bayindirh wrote: post #21

Earlier quoted context omitted.

> you probably should spend your time with something different than building zip bombs, and instead fix the security problems you have. Why not both? You can both create a well configured server to reduce its attack surface and add a booby-trap or two for really adamant scanners which hit very specific endpoints on your site. I don't have to welcome every scanner with open arms. Maybe I'm doing some research, PoC||GT…

> PoC||GTFO style ?

Oh. It's "International Journal of Proof-of-Concept or Get The Fuck Out (PoC||GTFO or PoC or GTFO)", available at https://www.alchemistowl.org/pocorgtfo/

Re: How to defend your website with ZIP bombs (2017)

#47

Post by Log_out_ »

kxrm wrote: post #41
13of40 wrote: post #37

It reminds me of someone I read about from the early web who defended their website against email address harvesting crawlers by adding a dynamic page that threw up some random emails and links, where the links just led back to the dynamic page under a new path on the same host. The crawlers would get stuck downloading millions of fake email addresses until they eventually broke.

Guilty, I did this on my first project site back in the early 00s. It only worked for a small time before scanners got more sophisticated. It was a fun diversion but people who do this quickly adapt.

What if the returned content is just chat gpt generated add hoc nonsense in the amount nonsense heuristics-1 ?

Re: How to defend your website with ZIP bombs (2017)

#49

Post by esdf »

hannob wrote: post #39
ivancho wrote: post #31

Earlier quoted context omitted.

No one is really worried, and no time is wasted when the outcome is occasional fun. There's no security holes to fix, there's just a bunch gnats poking at your server and you shoo them away, that's all.

If your goal is "fun" then I guess that's fine. But don't pitch it as "defending" your website.

It is fun to pitch it as defending a website. Now it’s fine
Post reply on HN