Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

211–220 of 467 posts

Re: I use zip bombs to protect my server

#211

Post by rtkwe »

malfist wrote: post #163
rtkwe wrote: post #126

Earlier quoted context omitted.

It'd have to be more than one byte. There's the central directory, zip header, local header then the file itself you need to also tell it how many zeros to make when decompressing the actual file but most compression algorithms don't work like that because they're designed for actual files not essentially blank files so you get larger than the absolute minimum compression.

I mean, if I make a new compression algorithm that says a 10GB file of zeros is represented with a single specific byte, that would technically be compression. All depends on how much magic you want to shove into an "algorithm"

If it's not standard I count the extra program required to decompress it as part of the archive.

Re: I use zip bombs to protect my server

#212

Post by thehappypm »

sgc wrote: post #27

I am ignorant as to how most bots work. Could you have a second line of defense for bots that avoid this bomb: Dynamically generate a file from /dev/random and trickle stream it to them, or would they just keep spawning parallel requests? They would never finish streaming it, and presumably give up at some point. The idea would be to make it more difficult for them to detect it was never going to be valid content.

This would work, but at times bots pretend not to be bots, so you occasionally do this to a real user

Re: I use zip bombs to protect my server

#213

Post by dsp_person »

ChuckMcM wrote: post #21

I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of script kiddies ddosing my poor little server. I switched to just identifying 'bad actors' who are clearly trying to do bad things and just banning their IP with firewall rules. That's becoming more challenging with IPV6 though. Edit: And for folks who write t…

> you can always create zip bombs that are links on a web page that don't show up for humans (white text on white background with no highlight on hover/click anchors)

RIP screen reader users?

Re: I use zip bombs to protect my server

#214

Post by charcircuit »

gkbrk wrote: post #202
cantrecallmypwd wrote: post #169

Wouldn't it be cheaper to use Cloudflare than task a human to obsessively watch webserver logs on a box lacking proper filtering?

It's also cheaper to search Google Images for "Eiffel tower" than booking a flight to Paris and going there, but a lot of people enjoy doing the latter.

Many people would be better off sticking with the former than realizing what Paris actually is and being disappointed.

https://en.wikipedia.org/wiki/Paris_syndrome

Re: I use zip bombs to protect my server

#215

Post by im3w1l »

avidiax wrote: post #207
j16sdiz wrote: post #203

Earlier quoted context omitted.

It have to be the way it is. Scanning them are resources intensive. The choice are (1) skip scanning them; (2) treat them as malware; (3) scan them and be DoS'ed. (deferring the decision to human iss effectively DoS'ing your IT support team)

Option #4, detect the zip bomb in its compressed form, and skip over that section of the file. Just like the malware ignores the zip bomb.

Just the fact that it contains a zip bomb makes it malware by itself.

Re: I use zip bombs to protect my server

#216

Post by hdjrudni »

bugfix wrote: post #178
opan wrote: post #166

Earlier quoted context omitted.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd foc…

IrfanView was able to load it in about 8 seconds (Ryzen 7 5800x) using 2.8GB of RAM, but zooming/panning is quite slow (~500ms per action)

IrfanView on my PC is very fast. Zoomed to 100% I can pan around no problem. Is it using CPU or GPU? I've got an 11900K CPU and RTX 3090.

Re: I use zip bombs to protect my server

#217

Post by Moosdijk »

opan wrote: post #166
bobmcnamara wrote: post #158

Earlier quoted context omitted.

I made a 64kx64k JPEG once by feeding the encoder the same line of macro blocks until it produce the entire image. Years later I was finally able to open it.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd foc…

It loads in about 5 seconds on an iPhone 12 using safari.

It also pans and zooms swiftly

Re: I use zip bombs to protect my server

#218

Post by galangalalgol »

kevin_thibedeau wrote: post #146
jeroenhd wrote: post #113

These days, almost all browsers accept zstd and brotli, so these bombs can be even more effective today! [This]( https://news.ycombinator.com/item?id=23496794 ) old comment showed an impressive 1.2M:1 compression ratio and [zstd seems to be doing even better]( https://github.com/netty/netty/issues/14004 ). Though, bots may not support modern compression standards. Then again, that may be a good way to block bots: eve…

If you nest the gzip inside another gzip it gets even smaller since the blocks of compressed '0' data are themselves low entropy in the first generation gzip. Nested zst reduces the 10G file to 99 bytes.

Can you hand edit to create recursive file structures to make it infinite? I used to use debug in dos to make what appeared to be gigantic floppy discs by editing the fat

Re: I use zip bombs to protect my server

#219

Post by some-guy »

dsp_person wrote: post #213
ChuckMcM wrote: post #21

I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of script kiddies ddosing my poor little server. I switched to just identifying 'bad actors' who are clearly trying to do bad things and just banning their IP with firewall rules. That's becoming more challenging with IPV6 though. Edit: And for folks who write t…

> you can always create zip bombs that are links on a web page that don't show up for humans (white text on white background with no highlight on hover/click anchors) RIP screen reader users?

“aria-hidden” would spare those users, and possibly be ignored by the bots unless they are sophisticated.
Post reply on HN