Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to defend your website with ZIP bombs (2017)

blog.haschek.at

Post reply on HN
Print view View original

71–79 of 79 posts

Re: How to defend your website with ZIP bombs (2017)

#71

Post by tlavoie »

berkes wrote: post #57
foul wrote: post #29

Earlier quoted context omitted.

>You're spending time trying to annoy attackers that you should probably just ignore. s/ignore/block at firewall-level/ To me this article is of relevance nonetheless because It inspires me for messing with AI trainers by crafting an html page ZIP bomb full of ZIP-bomb-like embedded attachments (stylesheets, images, etc).

I use fail2ban for this. I know what my servers run (and it's never PHP, Python microsoft/AD sharepoint etc, because I don't have services in these languages or systems) so I simply fail2ban everything that matches these broad items. Access "wp-admin"? Ban. Try "cron.php" ban. Looking for "phpmyadmin"? ban. It works reasonably well. These bots can switch to other IPs, or try again after the jailtime is lifted (20 min…

Fail2ban can also work on ModSecurity logs, banning IPs that trigger a bunch of rules there.

By the way, I have mine set to block for 12 hours, and some still come back. I suppose what I should look into is some sort of progressive extension to the delay.

Re: How to defend your website with ZIP bombs (2017)

#72

Post by c2lsZW50 »

serf wrote: post #64
ivancho wrote: post #60

Earlier quoted context omitted.

You are very insistent that people are doing "defending" wrong, and I can see how someone could read victim blaming into it, the industry does have a bad habit of loud hindsight bias. But it's also entirely beside the point, since no one here is claiming that this is real security, it's just a small nostalgic hack, and it comes off a bit grumpy to be so adamantly against it.

>You are very insistent that people are doing "defending" wrong, and I can see how someone could read victim blaming into it that's so absolutely ridiculous. "Hey bud, you're wearing your helmet backwards." "Oh, so it's MY fault when I run into something on my motorcycle, HUH?!" "Oh ok, well, have fun. I'll be safely over here . " a zip bomb will only serve to hinder teenage/kid 'hackers' -- next you're going to tell…

From the article: "This script obviously is not - as we say in Austria - the yellow of the egg, but it can defend from script kiddies I mentioned earlier who have no idea that all these tools have parameters to change the user agent.".

Perhaps consider reading the article thoroughly before you start claiming it to be more than what it is.

Re: How to defend your website with ZIP bombs (2017)

#73

Post by ivancho »

serf wrote: post #64
ivancho wrote: post #60

Earlier quoted context omitted.

You are very insistent that people are doing "defending" wrong, and I can see how someone could read victim blaming into it, the industry does have a bad habit of loud hindsight bias. But it's also entirely beside the point, since no one here is claiming that this is real security, it's just a small nostalgic hack, and it comes off a bit grumpy to be so adamantly against it.

>You are very insistent that people are doing "defending" wrong, and I can see how someone could read victim blaming into it that's so absolutely ridiculous. "Hey bud, you're wearing your helmet backwards." "Oh, so it's MY fault when I run into something on my motorcycle, HUH?!" "Oh ok, well, have fun. I'll be safely over here . " a zip bomb will only serve to hinder teenage/kid 'hackers' -- next you're going to tell…

> a zip bomb will only serve to hinder teenage/kid 'hackers'

And that is literally what the blog post says - it will mess with script kiddies who don't change their user agent. Author acknowledges that it is not an actual methodology to protect their server, so pointing out that it's a flawed methodology is a weird flex. I have not seen anyone suggest using zip bombs instead of hardening the server.

Re: How to defend your website with ZIP bombs (2017)

#74

Post by joshspankit »

iforgotpassword wrote: post #4

I've done this without compression but just sending infinite data. On some days I've sent a TB to a single IP address... Might be an idea to combine this. I'd assume the resulting gzip file here contains a repeating pattern that you can generate on the fly?

Back in the day if you had a faster modem and typed faster than the other person’s modem could receive, you could kick them offline.

The more things change, the more they stay the same?

Re: How to defend your website with ZIP bombs (2017)

#75

Post by joshspankit »

o-o- wrote: post #19

Another method that stuck with me: in the early days of bitcoin someone built an "ssh paywall" – i.e. you would pay to enable ssh remote authentication for a minute or two. In essence a hacker would have to pay before attempting to hack the ssh endpoint. Of course the admin would have to pay too but the money would end up on his/her wallet. Quite ingenious if you ask me.

Stuff like this is going to be wild when digital transaction fees for tiny amounts are basically free and transactions can be truly anonymous.

Re: How to defend your website with ZIP bombs (2017)

#76

Post by dns_snek »

waihtis wrote: post #69
dns_snek wrote: post #62

Earlier quoted context omitted.

Please elaborate, how are LLMs going to provide a "more sophisticated" class of automated attacks, and how are toy countermeasures like ZIP bombs going to defend against these "sophisticated" attacks? I could believe you if you said that ZIP bombs are perhaps mildly effective against script kiddies using ChatGPT to generate a naive, simplistic automated scanners that are susceptible to being "zip bombed". The other w…

I didn't say a zip bomb is effective against LLMs, I said active countermeasures in general

Do you mind elaborating, how are LLMs going to help with sophisticated attacks and what kind of countermeasures do you have in mind?

Re: How to defend your website with ZIP bombs (2017)

#77

Post by mcqueenjordan »

pixl97 wrote: post #67
mcqueenjordan wrote: post #44

Earlier quoted context omitted.

Another possible tactic is to trickle your packets back slowly, say trickle 1 TCP packet back to them per second. Sure, they probably have client-side timeouts, but again, if everyone did this, wouldn't it be a pain to scan for vulns? Every endpoint you hit would last the duration of your timeout.

Do modern bots deal with TARPITTING better? This was something that was pretty common years ago when dealing with bots.

This is a great reference. I hadn’t seen this before. Thanks. No idea about the effectiveness now vs then.

Re: How to defend your website with ZIP bombs (2017)

#78

Post by EasyMark »

pixl97 wrote: post #65
Log_out_ wrote: post #47

Earlier quoted context omitted.

What if the returned content is just chat gpt generated add hoc nonsense in the amount nonsense heuristics-1 ?

Heh, sounds like the stuff that's coming up on Googles front page for some results already.

Wait you mean that https://instalopter.com didn't give you accurate information on modern DOM parsing?

Re: How to defend your website with ZIP bombs (2017)

#79

Post by berkes »

tlavoie wrote: post #71
berkes wrote: post #57

Earlier quoted context omitted.

I use fail2ban for this. I know what my servers run (and it's never PHP, Python microsoft/AD sharepoint etc, because I don't have services in these languages or systems) so I simply fail2ban everything that matches these broad items. Access "wp-admin"? Ban. Try "cron.php" ban. Looking for "phpmyadmin"? ban. It works reasonably well. These bots can switch to other IPs, or try again after the jailtime is lifted (20 min…

Fail2ban can also work on ModSecurity logs, banning IPs that trigger a bunch of rules there. By the way, I have mine set to block for 12 hours, and some still come back. I suppose what I should look into is some sort of progressive extension to the delay.

A progressive jailtime is, indeed, a very good idea.
Post reply on HN