Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

141–150 of 467 posts

Re: I use zip bombs to protect my server

#141

Post by AndrewStephens »

sidewndr46 wrote: post #36
gchamonlive wrote: post #33

Earlier quoted context omitted.

https://github.com/uint128-t/ZIPBOMB 2048 yottabyte Zip Bomb This zip bomb uses overlapping files and recursion to achieve 7 layers with 256 files each, with the last being a 32GB file. It is only 266 KB on disk. When you realise it's a zip bomb it's already too late. Looking at the file size doesn't betray its contents. Maybe applying some heuristics with ClamAV? But even then it's not guaranteed. I think a small pa…

What are you talking about? You get a compressed file. You start decompressing it. When the amount of bytes you've written exceeds some threshold (say 5 megabytes) just stop decompressing, discard the output so far & delete the original file. That is it.

I worked on a commercial HTTP proxy that scanned compressed files. Back then we would start to decompress a file but keep track of the compression ratio. I forget what the cutoff was but as soon as we saw a ratio over a certain threshold we would just mark the file as malicious and block it.

Re: I use zip bombs to protect my server

#142

Post by djxfade »

aaronbaugher wrote: post #89
carlosjobim wrote: post #78

Earlier quoted context omitted.

There's a lot of essential functionality missing from WordPress, meaning you have to install plugins. Depending on what you need to do. But it's such a bad platform that there really isn't any reason for anybody to use WordPress for anything. No matter your use case, there will be a better alternative to WordPress.

Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past f…

Statamic https://statamic.com/

Re: I use zip bombs to protect my server

#143

Post by pettycashstash2 »

socalgal2 wrote: post #111
willyt wrote: post #94

Earlier quoted context omitted.

Static site with Jekyll?

Jekyll and other static site generators do not repo Wordpress any more than notepad repos MSWord In one, multiple users can login, edit WYSIWYG, preview, add images, etc, all from one UI. You can access it from any browser including smart phones and tablets. In the other, you get to instruct users on git, how to deal with merge conflicts, code review (two people can't easily work on a post like they can in wordpress)…

what are your favorite static site generators? I googled it and cloudflare article came up with Jekyll,Gatsby,Hugo,Next.js, Eleventy. But would like to avoid doing research if can be helped on pros/cons of each.

Re: I use zip bombs to protect my server

#144

Post by tom_ »

fracus wrote: post #114

I'm curious why a 10GB file of all zeroes would compress only to 10MB. I mean theoretically you could compress it to one byte. I suppose the compression happens on a stream of data instead of analyzing the whole, but I'd assume it would still do better than 10MB.

It has to cater for any possible input. Even with special case handling for this particular (generally uncommon) case of vast runs of the same value: the compressed data will probably be packetized somehow, and each packet can reproduce only so many repeats, so you'll need to repeat each packet enough times to reproduce the output. With 10 GB, it mounts up.

I tried this on my computer with a couple of other tools, after creating a file full of 0s as per the article.

gzip -9 turns it into 10,436,266 bytes in approx 1 minute.

xz -9 turns it into 1,568,052 bytes in approx 4 minutes.

bzip2 -9 turns it into 7,506 (!) bytes in approx 5 minutes.

I think OP should consider getting bzip2 on the case. 2 TBytes of 0s should compress nicely. And I'm long overdue an upgrade to my laptop... you probably won't be waiting long for the result on anything modern.

Re: I use zip bombs to protect my server

#145

Post by xena »

deathanatos wrote: post #57
xena wrote: post #7

Earlier quoted context omitted.

I did actually try zip bombs at first. They didn't work due to the architecture of how Amazon's scraper works. It just made the requests get retried.

So first, let me prefix this by saying I generally don't accept cookies from websites I don't explicitly first allow, my reasoning being "why am I granting disk read/write access to [mostly] shady actors to allow them to track me?" (I don't think your blog qualifies as shady … but you're not in my allowlist, either.) So if I visit https://anubis.techaro.lol/ (from the "Anubis" link), I get an infinite anime cat girl…

You're seeing an experiment in progress. It seems to be working, but I have yet to get enough data to know if it's ultimately successful or not.

Re: I use zip bombs to protect my server

#146

Post by kevin_thibedeau »

jeroenhd wrote: post #113

These days, almost all browsers accept zstd and brotli, so these bombs can be even more effective today! [This]( https://news.ycombinator.com/item?id=23496794 ) old comment showed an impressive 1.2M:1 compression ratio and [zstd seems to be doing even better]( https://github.com/netty/netty/issues/14004 ). Though, bots may not support modern compression standards. Then again, that may be a good way to block bots: eve…

If you nest the gzip inside another gzip it gets even smaller since the blocks of compressed '0' data are themselves low entropy in the first generation gzip. Nested zst reduces the 10G file to 99 bytes.

Re: I use zip bombs to protect my server

#147

Post by kam »

kulahan wrote: post #125
sidewndr46 wrote: post #36

Earlier quoted context omitted.

What are you talking about? You get a compressed file. You start decompressing it. When the amount of bytes you've written exceeds some threshold (say 5 megabytes) just stop decompressing, discard the output so far & delete the original file. That is it.

Isn’t this basically a question about the halting problem? Whatever arbitrary cutoff you chose might not work for all.

No, compression formats are not Turing-complete. You control the code interpreting the compressed stream and allocating the memory, writing the output, etc. based on what it sees there and can simply choose to return an error after writing N bytes.

Re: I use zip bombs to protect my server

#148

Post by Rohansi »

kulahan wrote: post #125
sidewndr46 wrote: post #36

Earlier quoted context omitted.

What are you talking about? You get a compressed file. You start decompressing it. When the amount of bytes you've written exceeds some threshold (say 5 megabytes) just stop decompressing, discard the output so far & delete the original file. That is it.

Isn’t this basically a question about the halting problem? Whatever arbitrary cutoff you chose might not work for all.

Not really. It's easy to abort after exceeding a number of uncompressed bytes or files written. The problem is the typical software for handling these files does not implement restrictions to prevent this.

Re: I use zip bombs to protect my server

#149

Post by [deleted] »

aaronbaugher wrote: post #89
carlosjobim wrote: post #78

Earlier quoted context omitted.

There's a lot of essential functionality missing from WordPress, meaning you have to install plugins. Depending on what you need to do. But it's such a bad platform that there really isn't any reason for anybody to use WordPress for anything. No matter your use case, there will be a better alternative to WordPress.

Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past f…

[deleted]

Re: I use zip bombs to protect my server

#150

Post by protocolture »

bilekas wrote: post #62

> At my old employer, a bot discovered a wordpress vulnerability and inserted a malicious script into our server I know it's slightly off topic, but it's just so amusing (edit: reassuring) to know I'm not the only one who, after 1 hour of setting up Wordpress there's a PHP shell magically deployed on my server.

>Take over a wordpress site for a customer

>Oh look 3 separate php shells with random strings as a name

Never less than 3, but always guaranteed.

Post reply on HN