Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

31–40 of 467 posts

Re: I use zip bombs to protect my server

#31

Post by sgc »

shishcat wrote: post #29
sgc wrote: post #27

I am ignorant as to how most bots work. Could you have a second line of defense for bots that avoid this bomb: Dynamically generate a file from /dev/random and trickle stream it to them, or would they just keep spawning parallel requests? They would never finish streaming it, and presumably give up at some point. The idea would be to make it more difficult for them to detect it was never going to be valid content.

This will waste your bandwidth and resources too

The idea is to trickle it very slowly, like keeping a cat occupied with a ball of fluff in the corner.

Re: I use zip bombs to protect my server

#32

Post by BlackFingolfin »

zdragnar wrote: post #25
chmod775 wrote: post #12

Earlier quoted context omitted.

Truly one my favorite thought-terminating proverbs. "Hurting people is wrong, so you should not defend yourself when attacked." "Imprisoning people is wrong, so we should not imprison thieves." Also the modern telling of Robin Hood seems to be pretty generally celebrated. Two wrongs may not make a right, but often enough a smaller wrong is the best recourse we have to avert a greater wrong. The spirit of the proverb…

> a smaller wrong is the best recourse we have to avert a greater wrong The logic of terrorists and war criminals everywhere.

And sometimes one man's terrorist is another's freedom fighter.... (Not to defend terrorism, but it's just not that simple)

Re: I use zip bombs to protect my server

#33

Post by gchamonlive »

sidewndr46 wrote: post #26
wewewedxfgdf wrote: post #18

I protected uploads on one of my applications by creating fixed size temporary disk partitions of like 10MB each and unzipping to those contains the fallout if someone uploads something too big.

What? You partitioned a disk rather than just not decompressing some comically large file?

https://github.com/uint128-t/ZIPBOMB

  2048 yottabyte Zip Bomb

  This zip bomb uses overlapping files and recursion to achieve 7 layers with 256 files each, with the last being a 32GB file.

  It is only 266 KB on disk.
When you realise it's a zip bomb it's already too late. Looking at the file size doesn't betray its contents. Maybe applying some heuristics with ClamAV? But even then it's not guaranteed. I think a small partition to isolate decompression is actually really smart. Wonder if we can achieve the same with overlays.

Re: I use zip bombs to protect my server

#35

Post by _Algernon_ »

zdragnar wrote: post #25
chmod775 wrote: post #12

Earlier quoted context omitted.

Truly one my favorite thought-terminating proverbs. "Hurting people is wrong, so you should not defend yourself when attacked." "Imprisoning people is wrong, so we should not imprison thieves." Also the modern telling of Robin Hood seems to be pretty generally celebrated. Two wrongs may not make a right, but often enough a smaller wrong is the best recourse we have to avert a greater wrong. The spirit of the proverb…

> a smaller wrong is the best recourse we have to avert a greater wrong The logic of terrorists and war criminals everywhere.

And also how fuctioning governments work: https://en.m.wikipedia.org/wiki/Monopoly_on_violence

Do you really want to live in a society were all use of punishment to discourage bad behaviour in others? That is a game theoretical disaster...

Re: I use zip bombs to protect my server

#36

Post by sidewndr46 »

gchamonlive wrote: post #33
sidewndr46 wrote: post #26

Earlier quoted context omitted.

What? You partitioned a disk rather than just not decompressing some comically large file?

https://github.com/uint128-t/ZIPBOMB 2048 yottabyte Zip Bomb This zip bomb uses overlapping files and recursion to achieve 7 layers with 256 files each, with the last being a 32GB file. It is only 266 KB on disk. When you realise it's a zip bomb it's already too late. Looking at the file size doesn't betray its contents. Maybe applying some heuristics with ClamAV? But even then it's not guaranteed. I think a small pa…

What are you talking about? You get a compressed file. You start decompressing it. When the amount of bytes you've written exceeds some threshold (say 5 megabytes) just stop decompressing, discard the output so far & delete the original file. That is it.

Re: I use zip bombs to protect my server

#37

Post by 1970-01-01 »

ChuckMcM wrote: post #21

I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of script kiddies ddosing my poor little server. I switched to just identifying 'bad actors' who are clearly trying to do bad things and just banning their IP with firewall rules. That's becoming more challenging with IPV6 though. Edit: And for folks who write t…

Why is it harder to firewall them with IPv6? I seems this would be the easier of the two to firewall.

Re: I use zip bombs to protect my server

#38

Post by uniqueuid »

sgc wrote: post #27

I am ignorant as to how most bots work. Could you have a second line of defense for bots that avoid this bomb: Dynamically generate a file from /dev/random and trickle stream it to them, or would they just keep spawning parallel requests? They would never finish streaming it, and presumably give up at some point. The idea would be to make it more difficult for them to detect it was never going to be valid content.

Practically all standard libraries have timeouts set for such requests, unless you are explicitly offering streams which they would skip.

Re: I use zip bombs to protect my server

#39

Post by jerf »

sgc wrote: post #27

I am ignorant as to how most bots work. Could you have a second line of defense for bots that avoid this bomb: Dynamically generate a file from /dev/random and trickle stream it to them, or would they just keep spawning parallel requests? They would never finish streaming it, and presumably give up at some point. The idea would be to make it more difficult for them to detect it was never going to be valid content.

You want to consider the ratio of your resource consumption to their resource consumption. If you trickle bytes from /dev/random, you are holding open a TCP connection with some minimal overhead, and that's about what they are doing too. Let's assume they are bright enough to use any of the many modern languages or frameworks that can easily handle 10K/100K connections or more on a modern system. They aren't all that bright but certainly some are. You're basically consuming your resources to their resources 1:1. That's not a winning scenario for you.

The gzip bomb means you serve 10MB but they try to consume vast quantities of RAM on their end and likely crash. Much better ratio.

Re: I use zip bombs to protect my server

#40

Post by uniqueuid »

sgc wrote: post #31
shishcat wrote: post #29

Earlier quoted context omitted.

This will waste your bandwidth and resources too

The idea is to trickle it very slowly, like keeping a cat occupied with a ball of fluff in the corner.

Cats also have timeouts set for balls of fluff. They usually get bored at some point and either go away or attack you :)
Post reply on HN