Do you mind sharing your specs of your digital ocean droplet? I'm trying to setup one with less cost.
I use zip bombs to protect my server
61–70 of 467 posts
Re: I use zip bombs to protect my server
#62> At my old employer, a bot discovered a wordpress vulnerability and inserted a malicious script into our server
I know it's slightly off topic, but it's just so amusing (edit: reassuring) to know I'm not the only one who, after 1 hour of setting up Wordpress there's a PHP shell magically deployed on my server.
Re: I use zip bombs to protect my server
#63Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them. Later on, browsers started to check for actual content I think, and would abort such requests.
[flagged]
Re: I use zip bombs to protect my server
#64Attacked Over Tor [2017]
https://www.hackerfactor.com/blog/index.php?/archives/762-At...
Re: I use zip bombs to protect my server
#65I deployed this, instead of my usual honeypot script.
It's not working very well.
In the web server log, I can see that the bots are not downloading the whole ten megabyte poison pill.
They are cutting off at various lengths. I haven't seen anything fetch more than around 1.5 Mb of it so far.
Or is it working? Are they decoding it on the fly as a stream, and then crashing? E.g. if something is recorded as having read 1.5 Mb, could it have decoded it to 1.5 Gb in RAM, on the fly, and crashed?
There is no way to tell.
Re: I use zip bombs to protect my server
#66I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of script kiddies ddosing my poor little server. I switched to just identifying 'bad actors' who are clearly trying to do bad things and just banning their IP with firewall rules. That's becoming more challenging with IPV6 though. Edit: And for folks who write t…
Why is it harder to firewall them with IPv6? I seems this would be the easier of the two to firewall.
Maybe it’s easier to circumvent because getting a new IPv6 address is easier than with IPv4?
Re: I use zip bombs to protect my server
#67I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of script kiddies ddosing my poor little server. I switched to just identifying 'bad actors' who are clearly trying to do bad things and just banning their IP with firewall rules. That's becoming more challenging with IPV6 though. Edit: And for folks who write t…
Why is it harder to firewall them with IPv6? I seems this would be the easier of the two to firewall.
I think they are suggesting the range of IPs to block is too high?
Re: I use zip bombs to protect my server
#68Is there any legal exposure possible? Like, a legitimate crawler suing you and alleging that you broke something of theirs?
>User-agent: * >Disallow: /zipbomb.html Legitimate crawlers would skip it this way only scum ignores robots.txt
I’m not sure that’s enough, robots.txt isn’t really legally binding so if the zip bomb somehow would be illegal, guarding it behind a robots.txt rule probably wouldn’t make it fine.
Re: I use zip bombs to protect my server
#69Earlier quoted context omitted.
Truly one my favorite thought-terminating proverbs. "Hurting people is wrong, so you should not defend yourself when attacked." "Imprisoning people is wrong, so we should not imprison thieves." Also the modern telling of Robin Hood seems to be pretty generally celebrated. Two wrongs may not make a right, but often enough a smaller wrong is the best recourse we have to avert a greater wrong. The spirit of the proverb…
> a smaller wrong is the best recourse we have to avert a greater wrong The logic of terrorists and war criminals everywhere.
Defense and Offense are not the same.
Crime and Justice are not the same.
If you cannot figure that out, you ARE a major part of the problem.
Keep thinking until you figure it out for good.
Re: I use zip bombs to protect my server
#70This topic comes up from time to time and I'm surprised no one yet mentioned the usual fearmongering rhetoric of zip bombs being potentially illegal.
I'm not a lawyer, but I'm yet to see a real life court case of a bot owner suing a company or an individual for responding to his malicious request with a zip bomb. The usual spiel goes like this: responding to his malicious request with a malicious response makes you a cybercriminal and allows him (the real cybercriminal) to sue you. Again, except of cheap talk I've never heard of a single court case like this. But I can easily imagine them trying to blackmail someone with such cheap threats.
I cannot imagine a big company like Microsoft or Apple using zip bombs, but I fail to see why zip bombs would be considered bad in any way. Anyone with an experience of dealing with malicious bots knows the frustration and the amount of time and money they steal from businesses or individuals.