Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to defend your website with ZIP bombs (2017)

blog.haschek.at

Post reply on HN
Print view View original

51–60 of 79 posts

Re: How to defend your website with ZIP bombs (2017)

#51

Post by raverbashing »

noobermin wrote: post #26
hannob wrote: post #16

People have been coming up with ideas like that regularly. I'm not a fan. The title says that you can "defend" your webpage, but it is not clear how it "defends" against anything. The only thing you possibly achieve is that every now and then, someone with an automated scanner (which may be an attacker, or may be a security researcher or service) will see his tool crash or consume large amounts of resources. You're s…

It really is only in the world of IT security is this attitude so pervasive, where you constantly blame victims. While defense is a great offense it can't hurt to be an annoyance to bad actors.

For real

I definitely blame the "oh we should do nothing" approach to the current security situation

Yes, if you want to be the lame duck and get scanned leisurely by the bad actors and diligently serving 404s etc be my guest.

Then we wonder why email became useless outside of the big providers, and every site needs to behind a CDN, etc

Re: How to defend your website with ZIP bombs (2017)

#52

Post by KineticLensman »

lifthrasiir wrote: post #40
hannob wrote: post #38

Earlier quoted context omitted.

No, ignore. WAFs that "block" "attacks" that ultimately should just cause a 404 error are part of the same mindset: That you think you "have to do something" about an attack that you should probably just ignore. They're also part of the mindset that security should mean adding more complexity, which is the opposite of what you should do.

I would like to compare this to dealing with unsolicited robocalls. Most would just ignore them, and it's indeed an unwise choice to accept them. But some try to strategically waste the caller's time by only accepting and doing nothing else. I can't say whether it's beneficial or not, but I can say that it is easy enough to do without worrying too much.

Except that you are giving away your voice as training data

Re: How to defend your website with ZIP bombs (2017)

#53

Post by nico_h »

hannob wrote: post #38
foul wrote: post #29

Earlier quoted context omitted.

>You're spending time trying to annoy attackers that you should probably just ignore. s/ignore/block at firewall-level/ To me this article is of relevance nonetheless because It inspires me for messing with AI trainers by crafting an html page ZIP bomb full of ZIP-bomb-like embedded attachments (stylesheets, images, etc).

No, ignore. WAFs that "block" "attacks" that ultimately should just cause a 404 error are part of the same mindset: That you think you "have to do something" about an attack that you should probably just ignore. They're also part of the mindset that security should mean adding more complexity, which is the opposite of what you should do.

Sometimes you’ve been aggravated for so long that doing something might be worth it for your own sense of balance.

Re: How to defend your website with ZIP bombs (2017)

#54

Post by lifthrasiir »

KineticLensman wrote: post #52
lifthrasiir wrote: post #40

Earlier quoted context omitted.

I would like to compare this to dealing with unsolicited robocalls. Most would just ignore them, and it's indeed an unwise choice to accept them. But some try to strategically waste the caller's time by only accepting and doing nothing else. I can't say whether it's beneficial or not, but I can say that it is easy enough to do without worrying too much.

Except that you are giving away your voice as training data

Doing nothing includes not saying anything, of course.

Re: How to defend your website with ZIP bombs (2017)

#55

Post by foul »

hannob wrote: post #38
foul wrote: post #29

Earlier quoted context omitted.

>You're spending time trying to annoy attackers that you should probably just ignore. s/ignore/block at firewall-level/ To me this article is of relevance nonetheless because It inspires me for messing with AI trainers by crafting an html page ZIP bomb full of ZIP-bomb-like embedded attachments (stylesheets, images, etc).

No, ignore. WAFs that "block" "attacks" that ultimately should just cause a 404 error are part of the same mindset: That you think you "have to do something" about an attack that you should probably just ignore. They're also part of the mindset that security should mean adding more complexity, which is the opposite of what you should do.

No, block at firewall-level. I never implied you should have to "study", "scan" the attacker's request: drop it.

You don't owe net-neutrality to a botnet instance.

That's just for when you should need to be clever, as in when you are tasked to be a sysadmin for, like, an hosting service or a corporate network, so you're not really aware of everything coming and going through.

If you're just a self-hoster you should not be clever, neither at ingress nor at egress: you "just" have to minimize attack surface because you probably know what you want to offer, e.g. for a blog you can publish with a SSG or serve HTML pages scraped from a dynamic CMS you'd like to use, like Wordpress, instead of serving the CMS' contents directly (and deal with comments using something else).

Re: How to defend your website with ZIP bombs (2017)

#56

Post by _V_ »

I have something similar - except I don't send them ZIP bombs, but I engage in something akin to a Slowloris attack. I keep the connection open and send random bytes with random delays in between.

To my surprise, I got few "champions" who spend >12h on a socket trying to get data that lead nowhere. And since there is ultimately a limit on number of sockets on a system, you can effectively DDoS that attacker.

Re: How to defend your website with ZIP bombs (2017)

#57

Post by berkes »

foul wrote: post #29
hannob wrote: post #16

People have been coming up with ideas like that regularly. I'm not a fan. The title says that you can "defend" your webpage, but it is not clear how it "defends" against anything. The only thing you possibly achieve is that every now and then, someone with an automated scanner (which may be an attacker, or may be a security researcher or service) will see his tool crash or consume large amounts of resources. You're s…

>You're spending time trying to annoy attackers that you should probably just ignore. s/ignore/block at firewall-level/ To me this article is of relevance nonetheless because It inspires me for messing with AI trainers by crafting an html page ZIP bomb full of ZIP-bomb-like embedded attachments (stylesheets, images, etc).

I use fail2ban for this. I know what my servers run (and it's never PHP, Python microsoft/AD sharepoint etc, because I don't have services in these languages or systems) so I simply fail2ban everything that matches these broad items.

Access "wp-admin"? Ban. Try "cron.php" ban. Looking for "phpmyadmin"? ban.

It works reasonably well. These bots can switch to other IPs, or try again after the jailtime is lifted (20 mins in my case). But instead of a bot attempting thousands of endpoints, I get only one attempt.

I initially configured this on a backend, that for reasons, had to handle every URL in the (Ruby, so heavy and slow) application layer: a bot trying common endpoints for popular CMSes and services, would put severe load on this application. Fail2ban was already there, blocking SSH, FTP, SMTP and whatnot, so I configured it to also handle these HTTP endpoints.

Re: How to defend your website with ZIP bombs (2017)

#59

Post by geek_at »

ehPReth wrote: post #7

https://42.zip served just that (after the 42.zip named on https://en.wikipedia.org/wiki/Zip_bomb ) until some ****hole reported it to Google/etc for.... phishing? Kinda sad, lol. One of the arguments I've seen is: 'what if your antivirus scans it' to which I think: if your antivirus blows up on a zip bomb in 2024, you need a new antivirus that isn't total garbage?

This could be the result of a google indexing error. Strangeley enough my blog (the one linked in this hn post) itself was de-listed from google justa few weeks ago.

The Blog is a static HTML page with no external dependencies and I didn't even update it in the time google thought there was phishing somewhere.

The Webmastertools showed the error but didn't link to any specific site (it even said null).

So i sent it in to re-evaluate and it was put back on google (without changing anything on the static files themselves). Very strange stuff

Re: How to defend your website with ZIP bombs (2017)

#60

Post by ivancho »

hannob wrote: post #36
noobermin wrote: post #26

Earlier quoted context omitted.

It really is only in the world of IT security is this attitude so pervasive, where you constantly blame victims. While defense is a great offense it can't hurt to be an annoyance to bad actors.

Can you tell me where in my words you read that I blamed victims? I think you're reading something into it that isn't there.

You are very insistent that people are doing "defending" wrong, and I can see how someone could read victim blaming into it, the industry does have a bad habit of loud hindsight bias. But it's also entirely beside the point, since no one here is claiming that this is real security, it's just a small nostalgic hack, and it comes off a bit grumpy to be so adamantly against it.
Post reply on HN