Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

201–210 of 467 posts

Re: I use zip bombs to protect my server

#201

Post by ChuckMcM »

grishka wrote: post #184
ChuckMcM wrote: post #21

I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of script kiddies ddosing my poor little server. I switched to just identifying 'bad actors' who are clearly trying to do bad things and just banning their IP with firewall rules. That's becoming more challenging with IPV6 though. Edit: And for folks who write t…

> you can always create zip bombs that are links on a web page that don't show up for humans I did a version of this with my form for requesting an account on my fediverse server. The problem I was having is that there exist these very unsophisticated bots that crawl the web and submit their very unsophisticated spam into every form they see that looks like it might publish it somewhere. First I added a simple captch…

Oh that is great.

Re: I use zip bombs to protect my server

#202

Post by gkbrk »

cantrecallmypwd wrote: post #169

Wouldn't it be cheaper to use Cloudflare than task a human to obsessively watch webserver logs on a box lacking proper filtering?

It's also cheaper to search Google Images for "Eiffel tower" than booking a flight to Paris and going there, but a lot of people enjoy doing the latter.

Re: I use zip bombs to protect my server

#203

Post by j16sdiz »

marcusb wrote: post #116
secfirstmd wrote: post #102

Earlier quoted context omitted.

Eh I got news for ya. The file size problem is still an issue for many big name EDRs.

Undoubtedly. If you go poking around most any security product (the product I was referring to was not in the EDR space,) you'll see these sorts of issues all over the place.

It have to be the way it is.

Scanning them are resources intensive. The choice are (1) skip scanning them; (2) treat them as malware; (3) scan them and be DoS'ed.

(deferring the decision to human iss effectively DoS'ing your IT support team)

Re: I use zip bombs to protect my server

#204

Post by radeeyate »

opan wrote: post #166
bobmcnamara wrote: post #158

Earlier quoted context omitted.

I made a 64kx64k JPEG once by feeding the encoder the same line of macro blocks until it produce the entire image. Years later I was finally able to open it.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd foc…

Interestingly enough, it loads in about 5 seconds on my Pixel 6a.

Re: I use zip bombs to protect my server

#205

Post by lgeek »

opan wrote: post #166
bobmcnamara wrote: post #158

Earlier quoted context omitted.

I made a 64kx64k JPEG once by feeding the encoder the same line of macro blocks until it produce the entire image. Years later I was finally able to open it.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd foc…

On Firefox on Android on my pretty old phone, a blurry preview rendered in about 10 seconds, and it was fully rendered in 20 something seconds. Smooth panning and zooming the entire time

Re: I use zip bombs to protect my server

#206

Post by flexagoon »

ChuckMcM wrote: post #21

I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of script kiddies ddosing my poor little server. I switched to just identifying 'bad actors' who are clearly trying to do bad things and just banning their IP with firewall rules. That's becoming more challenging with IPV6 though. Edit: And for folks who write t…

Automated systems like Cloudflare and stuff also have a list of bot IPs. I was recently setting up a selfhosted VPN and I had to change the IPv4 of the server like 20 times before I got an IP that wasn't banned on half the websites.

Re: I use zip bombs to protect my server

#207

Post by avidiax »

j16sdiz wrote: post #203
marcusb wrote: post #116

Earlier quoted context omitted.

Undoubtedly. If you go poking around most any security product (the product I was referring to was not in the EDR space,) you'll see these sorts of issues all over the place.

It have to be the way it is. Scanning them are resources intensive. The choice are (1) skip scanning them; (2) treat them as malware; (3) scan them and be DoS'ed. (deferring the decision to human iss effectively DoS'ing your IT support team)

Option #4, detect the zip bomb in its compressed form, and skip over that section of the file. Just like the malware ignores the zip bomb.

Re: I use zip bombs to protect my server

#208

Post by socalgal2 »

pettycashstash2 wrote: post #143
socalgal2 wrote: post #111

Earlier quoted context omitted.

Jekyll and other static site generators do not repo Wordpress any more than notepad repos MSWord In one, multiple users can login, edit WYSIWYG, preview, add images, etc, all from one UI. You can access it from any browser including smart phones and tablets. In the other, you get to instruct users on git, how to deal with merge conflicts, code review (two people can't easily work on a post like they can in wordpress)…

what are your favorite static site generators? I googled it and cloudflare article came up with Jekyll,Gatsby,Hugo,Next.js, Eleventy. But would like to avoid doing research if can be helped on pros/cons of each.

I looked recently when thinking of starting some new shared blog. My criteria was "based on tech I know". I don't know Ruby so Jekyll was out. I tried Eleventy and Hexo. I chose Hexo but then ultimately decided I wasn't going to do this new blog.

IIRC, Eleventy printed lots of out-of-date warnings when I installed it and/or the default style was broken in various ways which didn't give me much confidence.

My younger sister asked me to help her start a blog. I just pointed her to substack. Zero effort, easy for her.

Re: I use zip bombs to protect my server

#209

Post by est »

gchamonlive wrote: post #33
sidewndr46 wrote: post #26

Earlier quoted context omitted.

What? You partitioned a disk rather than just not decompressing some comically large file?

https://github.com/uint128-t/ZIPBOMB 2048 yottabyte Zip Bomb This zip bomb uses overlapping files and recursion to achieve 7 layers with 256 files each, with the last being a 32GB file. It is only 266 KB on disk. When you realise it's a zip bomb it's already too late. Looking at the file size doesn't betray its contents. Maybe applying some heuristics with ClamAV? But even then it's not guaranteed. I think a small pa…

damn, it broke the macOS archiver utility.

Re: I use zip bombs to protect my server

#210

Post by thehappypm »

david422 wrote: post #172
philsnow wrote: post #127

Earlier quoted context omitted.

A compressed file that is only one byte long can only represent maximally 256 different uncompressed files. Signed, a kid in the 90s who downloaded some "wavelet compression" program from a BBS because it promised to compress all his WaReZ even more so he could then fit moar on his disk. He ran the compressor and hey golly that 500MB ISO fit into only 10MB of disk now! He found out later (after a defrag) that the "co…

> He found out later (after a defrag) that the "compressor" was just hiding data in unused disk sectors and storing references to them So you could access the files until you wrote more data to disk?

Strange to think that is approach would actually work pretty damn well for most people because most people aren’t using therefore hard drive space
Post reply on HN