Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

101–110 of 467 posts

Re: I use zip bombs to protect my server

#101

Post by carlosjobim »

aaronbaugher wrote: post #89
carlosjobim wrote: post #78

Earlier quoted context omitted.

There's a lot of essential functionality missing from WordPress, meaning you have to install plugins. Depending on what you need to do. But it's such a bad platform that there really isn't any reason for anybody to use WordPress for anything. No matter your use case, there will be a better alternative to WordPress.

Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past f…

Yes I can. There's an excellent and stable solution called SurrealCMS, made by an indie developer. You connect it by FTP to any traditional web design (HTML+CSS+JS), and the users get a WYSIWYG editor where the published output looks exactly as it looked when editing. It's dirt cheap at $9 per month.

Edit: I actually feel a bit sorry for the SurrealCMS developer. He has a fantastic product that should be an industry standard, but it's fairly unknown.

Re: I use zip bombs to protect my server

#102

Post by secfirstmd »

marcusb wrote: post #85

Zip bombs are fun. I discovered a vulnerability in a security product once where it wouldn’t properly scan a file for malware if the file was or contained a zip archive greater than a certain size. The practical effect of this was you could place a zip bomb in an office xml document and this product would pass the ooxml file through even if it contained easily identifiable malware.

Eh I got news for ya.

The file size problem is still an issue for many big name EDRs.

Re: I use zip bombs to protect my server

#103

Post by lillecarl »

1970-01-01 wrote: post #37
ChuckMcM wrote: post #21

I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of script kiddies ddosing my poor little server. I switched to just identifying 'bad actors' who are clearly trying to do bad things and just banning their IP with firewall rules. That's becoming more challenging with IPV6 though. Edit: And for folks who write t…

Why is it harder to firewall them with IPv6? I seems this would be the easier of the two to firewall.

Manual banning is about the same since you just book /56 or bigger, entire providers or countries.

Automated banning is harder, you'd probably want a heuristic system and look up info on IPs.

IPv4 with NAT means you can "overban" too.

Re: I use zip bombs to protect my server

#104

Post by lillecarl »

CBLT wrote: post #100
firesteelrain wrote: post #67

Earlier quoted context omitted.

I think they are suggesting the range of IPs to block is too high?

Allow -> Tarpit -> Block should be done by ASN

You probably want to check how many ips/blocks a provider announces before blocking the entire thing.

It's also not a common metric you can filter on in open firewalls since you must lookup and maintain a cache of IP to ASN, which has to be evicted and updated as blocks still move around.

Re: I use zip bombs to protect my server

#105

Post by realityloop »

aaronbaugher wrote: post #89
carlosjobim wrote: post #78

Earlier quoted context omitted.

There's a lot of essential functionality missing from WordPress, meaning you have to install plugins. Depending on what you need to do. But it's such a bad platform that there really isn't any reason for anybody to use WordPress for anything. No matter your use case, there will be a better alternative to WordPress.

Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past f…

DrupalCMS is a new project that aims to radically simplify for end users https://new.drupal.org/drupal-cms

Re: I use zip bombs to protect my server

#106

Post by os2warpman »

cynicalsecurity wrote: post #70

This topic comes up from time to time and I'm surprised no one yet mentioned the usual fearmongering rhetoric of zip bombs being potentially illegal. I'm not a lawyer, but I'm yet to see a real life court case of a bot owner suing a company or an individual for responding to his malicious request with a zip bomb. The usual spiel goes like this: responding to his malicious request with a malicious response makes you a…

Anyone can sue anyone else for any reason.

This is what trips me up:

>On my server, I've added a middleware that checks if the current request is malicious or not.

There's a lot of trust placed in:

>if (ipIsBlackListed() || isMalicious()) {

Can someone assigned a previously blacklisted IP or someone who uses a tool to archive the website that mimics a bot be served malware? Is the middleware good enough or "good enough so far"?

Close enough to 100% of my internet traffic flows through a VPN. I have been blacklisted by various services upon connecting to a VPN or switching servers on multiple occasions.

Re: I use zip bombs to protect my server

#107

Post by jeroenhd »

sgc wrote: post #31
shishcat wrote: post #29

Earlier quoted context omitted.

This will waste your bandwidth and resources too

The idea is to trickle it very slowly, like keeping a cat occupied with a ball of fluff in the corner.

If the bot is connecting over IPv4, you only have a couple thousand connections before your server starts needing to mess with shared sockets and other annoying connectivity tricks.

I don't think it's a terrible problem to solve these days, especially if you use one of the tarpitting implementations that use nftables/iptables/eBPF, but if you have one of those annoying Chinese bot farms with thousands of IP addresses hitting your server in turn (Huawei likes to do this), you may need to think twice before deploying this solution.

Re: I use zip bombs to protect my server

#108

Post by carlosjobim »

wincy wrote: post #90
carlosjobim wrote: post #78

Earlier quoted context omitted.

There's a lot of essential functionality missing from WordPress, meaning you have to install plugins. Depending on what you need to do. But it's such a bad platform that there really isn't any reason for anybody to use WordPress for anything. No matter your use case, there will be a better alternative to WordPress.

I do custom web dev so am way out of the website hosting game. What are good frameworks now if I want to say, light touch help someone who is slightly technical set up a website? Not full react SPA with an API.

By the sound of your question I will guess you want to make a website for a small or medium sized organization? jQuery is probably the only "framework" you should need.

If they are selling anything on their website, it's probably going to be through a cloud hosted third party service and then it's just an embedded iframe on their website.

If you're making an entire web shop for a very large enterprise or something of similar magnitude, then you have to ask somebody else than me.

Re: I use zip bombs to protect my server

#109

Post by impulsivepuppet »

zdragnar wrote: post #25
chmod775 wrote: post #12

Earlier quoted context omitted.

Truly one my favorite thought-terminating proverbs. "Hurting people is wrong, so you should not defend yourself when attacked." "Imprisoning people is wrong, so we should not imprison thieves." Also the modern telling of Robin Hood seems to be pretty generally celebrated. Two wrongs may not make a right, but often enough a smaller wrong is the best recourse we have to avert a greater wrong. The spirit of the proverb…

> a smaller wrong is the best recourse we have to avert a greater wrong The logic of terrorists and war criminals everywhere.

I admire your deontological zealotry. That said, I think there is an implied virtuous aspect of "internet vigilantism" that feels ignored (i.e. disabling a malicious bot means it does not visit other sites) While I do not absolve anyone from taking full responsibility for their actions, I have a suspicion that terrorists do a bit more than just avert a greater wrong--otherwise, please sign me up!

Re: I use zip bombs to protect my server

#110

Post by crazygringo »

> For the most part, when they do, I never hear from them again. Why? Well, that's because they crash right after ingesting the file.

I would have figured the process/server would restart, and restart with your specific URL since that was the last one not completed.

What makes the bots avoid this site in the future? Are they really smart enough to hard-code a rule to check for crashes and avoid those sites in the future?

Post reply on HN