Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

71–80 of 467 posts

Re: I use zip bombs to protect my server

#71

Post by echoangle »

bilekas wrote: post #59
jawns wrote: post #54

Is there any legal exposure possible? Like, a legitimate crawler suing you and alleging that you broke something of theirs?

Please, just as a conversational piece, walk me through the potentials you might think there are ? I'll play the side of the defender and you can play the "bot"/bot deployer.

Well creating a bot is not per se illegal, so assuming the maliciousness-detector on the server isn’t perfect, it could serve the zip bomb to a legitimate bot. And I don’t think it’s crazy that serving zip bombs with the stated intent to sabotage the client would be illegal. But I’m not a lawyer, of course.

Re: I use zip bombs to protect my server

#72

Post by lcnPylGDnU4H9OF »

deathanatos wrote: post #57
xena wrote: post #7

Earlier quoted context omitted.

I did actually try zip bombs at first. They didn't work due to the architecture of how Amazon's scraper works. It just made the requests get retried.

So first, let me prefix this by saying I generally don't accept cookies from websites I don't explicitly first allow, my reasoning being "why am I granting disk read/write access to [mostly] shady actors to allow them to track me?" (I don't think your blog qualifies as shady … but you're not in my allowlist, either.) So if I visit https://anubis.techaro.lol/ (from the "Anubis" link), I get an infinite anime cat girl…

> Neither xeserv.us nor techaro.lol are in my allowlist. Curious that one seems to pass. IDK.

Is your browser passing a referrer?

Re: I use zip bombs to protect my server

#73

Post by ianlevesque »

bilekas wrote: post #62

> At my old employer, a bot discovered a wordpress vulnerability and inserted a malicious script into our server I know it's slightly off topic, but it's just so amusing (edit: reassuring) to know I'm not the only one who, after 1 hour of setting up Wordpress there's a PHP shell magically deployed on my server.

Yes, never self host Wordpress if you value your sanity. Even if it’s not the first hour it will eventually happen when you forget a patch.

Re: I use zip bombs to protect my server

#74

Post by charonn0 »

sgc wrote: post #27

I am ignorant as to how most bots work. Could you have a second line of defense for bots that avoid this bomb: Dynamically generate a file from /dev/random and trickle stream it to them, or would they just keep spawning parallel requests? They would never finish streaming it, and presumably give up at some point. The idea would be to make it more difficult for them to detect it was never going to be valid content.

For HTTP/1.1 you could send a "chunked" response. Chunked responses are intended to allow the server to start sending dynamically generated content immediately instead of waiting for the generation process to finish before sending. You could just continue to send chunks until the client gives up or crashes.

[0]: https://en.wikipedia.org/wiki/Chunked_transfer_encoding

Re: I use zip bombs to protect my server

#75

Post by thayne »

jawns wrote: post #54

Is there any legal exposure possible? Like, a legitimate crawler suing you and alleging that you broke something of theirs?

Disclosure: IANAL

The CFAA[1] prohibits:

> knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;

As far as I can tell (again, IANAL) there isn't an exception if you believe said computer is actively attempting to abuse your system[2]. I'm not sure if a zip bomb would constitute intentional damage, but it is at least close enough to the line that I wouldn't feel comfortable risking it.

[1]: https://www.law.cornell.edu/uscode/text/18/1030

[2]: And of course, you might make a mistake and incorrectly serve this to legitimate traffic.

Re: I use zip bombs to protect my server

#76

Post by sunaookami »

ianlevesque wrote: post #73
bilekas wrote: post #62

> At my old employer, a bot discovered a wordpress vulnerability and inserted a malicious script into our server I know it's slightly off topic, but it's just so amusing (edit: reassuring) to know I'm not the only one who, after 1 hour of setting up Wordpress there's a PHP shell magically deployed on my server.

Yes, never self host Wordpress if you value your sanity. Even if it’s not the first hour it will eventually happen when you forget a patch.

Hosting WordPress myself for 13 years now and have no problem :) Just follow standard security practices and don't install gazillion plugins.

Re: I use zip bombs to protect my server

#77

Post by lcnPylGDnU4H9OF »

echoangle wrote: post #68
bauruine wrote: post #60

Earlier quoted context omitted.

>User-agent: * >Disallow: /zipbomb.html Legitimate crawlers would skip it this way only scum ignores robots.txt

I’m not sure that’s enough, robots.txt isn’t really legally binding so if the zip bomb somehow would be illegal, guarding it behind a robots.txt rule probably wouldn’t make it fine.

Has any similar case been tried? I'd think that a judge learning the intent of robots.txt and disallow rules is fairly likely to be sympathetic. Seems like it could go either way, I mean. (Jury is probably more a crap-shoot.)

Re: I use zip bombs to protect my server

#78

Post by carlosjobim »

sunaookami wrote: post #76
ianlevesque wrote: post #73

Earlier quoted context omitted.

Yes, never self host Wordpress if you value your sanity. Even if it’s not the first hour it will eventually happen when you forget a patch.

Hosting WordPress myself for 13 years now and have no problem :) Just follow standard security practices and don't install gazillion plugins.

There's a lot of essential functionality missing from WordPress, meaning you have to install plugins. Depending on what you need to do.

But it's such a bad platform that there really isn't any reason for anybody to use WordPress for anything. No matter your use case, there will be a better alternative to WordPress.

Re: I use zip bombs to protect my server

#79

Post by MoonGhost »

kazinator wrote: post #65

I deployed this, instead of my usual honeypot script. It's not working very well. In the web server log, I can see that the bots are not downloading the whole ten megabyte poison pill. They are cutting off at various lengths. I haven't seen anything fetch more than around 1.5 Mb of it so far. Or is it working? Are they decoding it on the fly as a stream, and then crashing? E.g. if something is recorded as having read…

Try content labyrinth. I.e. infinitely generated content with a bunch of references to other generated pages. It may help against simple wget and till bots adapt.

PS: I'm on the bots side, but don't mind helping.

Re: I use zip bombs to protect my server

#80

Post by koolba »

layer8 wrote: post #53

Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them. Later on, browsers started to check for actual content I think, and would abort such requests.

I hope you weren’t paying for bandwidth by the KiB.
Post reply on HN