Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

181–190 of 467 posts

Re: I use zip bombs to protect my server

#181

Post by beeslol »

opan wrote: post #166
bobmcnamara wrote: post #158

Earlier quoted context omitted.

I made a 64kx64k JPEG once by feeding the encoder the same line of macro blocks until it produce the entire image. Years later I was finally able to open it.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd foc…

For what it's worth, this loaded (slowly) in Firefox on Windows for me (but zooming was blurry), and the default Photos viewer opened it no problem with smooth zooming and panning.

Re: I use zip bombs to protect my server

#182

Post by suid »

fracus wrote: post #114

I'm curious why a 10GB file of all zeroes would compress only to 10MB. I mean theoretically you could compress it to one byte. I suppose the compression happens on a stream of data instead of analyzing the whole, but I'd assume it would still do better than 10MB.

Good question. The "ultimate zip bomb" looks something like https://github.com/iamtraction/ZOD - this produces the infamous "42.zip" file, which is about 42KiB, but expands to 3.99 PiB (!).

There's literally no machine on Earth today that can deal with that (as a single file, I mean).

Re: I use zip bombs to protect my server

#183

Post by ack_complete »

bobmcnamara wrote: post #158
layer8 wrote: post #53

Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them. Later on, browsers started to check for actual content I think, and would abort such requests.

I made a 64kx64k JPEG once by feeding the encoder the same line of macro blocks until it produce the entire image. Years later I was finally able to open it.

I once encoded an entire TV OP into a multi-megabyte animated cursor (.ani) file.

Surprisingly, Windows 95 didn't die trying to load it, but quite a lot of operations in the system took noticeably longer than they normally did.

Re: I use zip bombs to protect my server

#184

Post by grishka »

ChuckMcM wrote: post #21

I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of script kiddies ddosing my poor little server. I switched to just identifying 'bad actors' who are clearly trying to do bad things and just banning their IP with firewall rules. That's becoming more challenging with IPV6 though. Edit: And for folks who write t…

> you can always create zip bombs that are links on a web page that don't show up for humans

I did a version of this with my form for requesting an account on my fediverse server. The problem I was having is that there exist these very unsophisticated bots that crawl the web and submit their very unsophisticated spam into every form they see that looks like it might publish it somewhere.

First I added a simple captcha with distorted characters. This did stop many of the bots, but not all of them. Then, after reading the server log, I noticed that they only make three requests in a rapid succession: the page that contains the form, the captcha image, and then the POST request with the form data. They don't load neither the CSS nor the JS.

So I added several more fields to the form and hid them with CSS. Submitting anything in these fields will fail the request and ban your session. I also modified the captcha, I made the image itself a CSS background, and made the src point to a transparent image instead.

And just like that, spam has completely stopped, while real users noticed nothing.

Re: I use zip bombs to protect my server

#185

Post by LordGrignard »

secfirstmd wrote: post #102
marcusb wrote: post #85

Zip bombs are fun. I discovered a vulnerability in a security product once where it wouldn’t properly scan a file for malware if the file was or contained a zip archive greater than a certain size. The practical effect of this was you could place a zip bomb in an office xml document and this product would pass the ooxml file through even if it contained easily identifiable malware.

Eh I got news for ya. The file size problem is still an issue for many big name EDRs.

is that endpoint detection and response?

Re: I use zip bombs to protect my server

#186

Post by kccqzy »

warkdarrior wrote: post #56
wewewedxfgdf wrote: post #18

I protected uploads on one of my applications by creating fixed size temporary disk partitions of like 10MB each and unzipping to those contains the fallout if someone uploads something too big.

`unzip -p | head -c 10MB`

Doesn't deal with multi-file ZIP archives. And before you think you can just reject user uploads with multi-file ZIP archives, remember that macOS ZIP files contain the __MACOSX folder with ._ files.

Re: I use zip bombs to protect my server

#187

Post by rpmisms »

djxfade wrote: post #142
aaronbaugher wrote: post #89

Earlier quoted context omitted.

Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past f…

Statamic https://statamic.com/

Seconded. It's absolutely phenomenal as a headful or headless CMS.

Re: I use zip bombs to protect my server

#188

Post by virtue3 »

opan wrote: post #166
bobmcnamara wrote: post #158

Earlier quoted context omitted.

I made a 64kx64k JPEG once by feeding the encoder the same line of macro blocks until it produce the entire image. Years later I was finally able to open it.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd foc…

I use honey view for reading comics etc. It can handle this.

Old school acdsee would have been fine too.

I think it's all the pixel processing on the modern image viewers (or they're just using system web views that isn't 100% just a straight render).

I suspect that the more native renderers are doing some extra magic here. Or just being significantly more OK with using up all your ram.

Re: I use zip bombs to protect my server

#189

Post by glial »

opan wrote: post #166
bobmcnamara wrote: post #158

Earlier quoted context omitted.

I made a 64kx64k JPEG once by feeding the encoder the same line of macro blocks until it produce the entire image. Years later I was finally able to open it.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd foc…

It loads in about 10 seconds in Safari on an M1 Air. I think I am spoiled.

Re: I use zip bombs to protect my server

#190

Post by nophunphil »

carlosjobim wrote: post #108
wincy wrote: post #90

Earlier quoted context omitted.

I do custom web dev so am way out of the website hosting game. What are good frameworks now if I want to say, light touch help someone who is slightly technical set up a website? Not full react SPA with an API.

By the sound of your question I will guess you want to make a website for a small or medium sized organization? jQuery is probably the only "framework" you should need. If they are selling anything on their website, it's probably going to be through a cloud hosted third party service and then it's just an embedded iframe on their website. If you're making an entire web shop for a very large enterprise or something of…

jQuery hasn’t been necessary for many years. Vanilla JS equivalents of jQuery code are well-supported.

https://youmightnotneedjquery.com/

Post reply on HN