Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

241–250 of 467 posts

Re: I use zip bombs to protect my server

#241

Post by moooo99 »

pdntspa wrote: post #229
suid wrote: post #182

Earlier quoted context omitted.

Good question. The "ultimate zip bomb" looks something like https://github.com/iamtraction/ZOD - this produces the infamous "42.zip" file, which is about 42KiB, but expands to 3.99 PiB (!). There's literally no machine on Earth today that can deal with that (as a single file, I mean).

Do must unzip programs work recursively by default?

No, at least not the ones I am aware of. iirc these kinds of attacks usually targeted content scanners (primarily antivirus). And an AV program would of course have to recursively de compress everything

Re: I use zip bombs to protect my server

#242

Post by kqr »

mkwarman wrote: post #232
seanhunter wrote: post #228

Once upon a time around 2001 or so I used to have a static line at home and host some stuff on my home linux box. A windows NT update had meant a lot of them had enabled this optimistic encryption thing where windows boxes would try to connect to a certain port and negotiate an s/wan before doing TCP traffic. I was used to seeing this traffic a lot on my firewall so no big deal. However there was one machine in parti…

I enjoyed reading this, thank you for sharing. When you say you tried to contact the admin of the box and that this was common back then, how would you typically find the contact info for an arbitrary client's admin?

You can also find out who owns a general group of IP addresses, and at the time they would often assist you in further pinpointing who is responsible for a particular address.

Re: I use zip bombs to protect my server

#243

Post by Twirrim »

palijer wrote: post #171
MoonGhost wrote: post #79

Earlier quoted context omitted.

Try content labyrinth. I.e. infinitely generated content with a bunch of references to other generated pages. It may help against simple wget and till bots adapt. PS: I'm on the bots side, but don't mind helping.

This doesn't work if you pay bandwidth and CPU usage for your servers though.

The labyrinth doesn't have to be fast, and things like iocaine (https://iocaine.madhouse-project.org/) don't use much CPU if you don't go and give them something like the Complete Works of Ahakespeare as input (Mine is using Moby Dick), and can easily be constrained with cgroups if you're concerned about resource usage.

I've noticed that LLM scrapers tend to be incredibly patient. They'll wait for minutes for even small amounts of text.

Re: I use zip bombs to protect my server

#244

Post by kqr »

fareesh wrote: post #238

Is there a list of popular attack vector urls located somewhere? I want to just auto-ban anyone sniffing for .env or ../../../../ etc. Rather not write it myself

It would be a fairly short Perl script to read the access logs and curl a HEAD request to all URLs accessed, printing only those with 200 OK responses.

Here's a start hacked together and tested on my phone:

    perl -lnE 'if (/GET ([^ ]+)/ and $p=$1) {
        $s=qx(curl -sI https://BASE_URL/$p | head -n 1);
        unless ($s =~ /200|302/) {
            say $p
        }
    }'

Re: I use zip bombs to protect my server

#245

Post by thayne »

jedberg wrote: post #231
thayne wrote: post #155

Earlier quoted context omitted.

Part B of the definition of "protected computer" says: > which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States Assuming the server is running in the states, I think that would apply unless the client is in the same state as the serve…

The word "accessed" is used multiple times throughout the law. A client accesses a server. A server does not access a client. It responds to a client. Also, the protected computer has to be involved in commerce. Unless they are accessing the website with the zip bomb using a computer that also is uses for interstate or foreign commerce, it won't qualify.

> The word "accessed" is used multiple times throughout the law.

So what? It isn't in the section I quoted above. I could be wrong, but my reading is that transmitting information that can cause damage with the intent of causing damage is a violation, regardless of if you "access" another system.

> Also, the protected computer has to be involved in commerce

Or communication.

Now, from an ethics standpoint, I don't think there is anything wrong with returning a zipbomb to malicious bots. But I'm not confident enough that doing so is legal that I would risk doing so.

Re: I use zip bombs to protect my server

#246

Post by jaeckel »

opan wrote: post #166
bobmcnamara wrote: post #158

Earlier quoted context omitted.

I made a 64kx64k JPEG once by feeding the encoder the same line of macro blocks until it produce the entire image. Years later I was finally able to open it.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd foc…

ImgurViewer from fdroid on an FP5 opened it blurry after around 5s and 5s later it was rendered completely.

Pan&zoom works instantly with a blurry preview and then takes another 5-10s to render completely.

Re: I use zip bombs to protect my server

#247

Post by gigatexal »

seanhunter wrote: post #228

Once upon a time around 2001 or so I used to have a static line at home and host some stuff on my home linux box. A windows NT update had meant a lot of them had enabled this optimistic encryption thing where windows boxes would try to connect to a certain port and negotiate an s/wan before doing TCP traffic. I was used to seeing this traffic a lot on my firewall so no big deal. However there was one machine in parti…

That’s awesome! Thank you for sharing.

Re: I use zip bombs to protect my server

#248

Post by eru »

kqr wrote: post #240
seanhunter wrote: post #228

Once upon a time around 2001 or so I used to have a static line at home and host some stuff on my home linux box. A windows NT update had meant a lot of them had enabled this optimistic encryption thing where windows boxes would try to connect to a certain port and negotiate an s/wan before doing TCP traffic. I was used to seeing this traffic a lot on my firewall so no big deal. However there was one machine in parti…

The lesson for any programmers reading this is to always set an upper limit for how much data you accept from someone else. Every request should have both a timeout and a limit on the amounts of data it will consume.

That doesn't necessarily need to be in the request itself.

You can also limit the wider process or system your request is part of.

Re: I use zip bombs to protect my server

#249

Post by pmontra »

socalgal2 wrote: post #208
pettycashstash2 wrote: post #143

Earlier quoted context omitted.

what are your favorite static site generators? I googled it and cloudflare article came up with Jekyll,Gatsby,Hugo,Next.js, Eleventy. But would like to avoid doing research if can be helped on pros/cons of each.

I looked recently when thinking of starting some new shared blog. My criteria was "based on tech I know". I don't know Ruby so Jekyll was out. I tried Eleventy and Hexo. I chose Hexo but then ultimately decided I wasn't going to do this new blog. IIRC, Eleventy printed lots of out-of-date warnings when I installed it and/or the default style was broken in various ways which didn't give me much confidence. My younger…

I work with Ruby but I never had to use Ruby to use Jekyll. I downloaded the docker image and run it. It checks a host directory for updates and generates the HTML files. It could be written in any other language I don't know.

Re: I use zip bombs to protect my server

#250

Post by vander_elst »

fareesh wrote: post #238

Is there a list of popular attack vector urls located somewhere? I want to just auto-ban anyone sniffing for .env or ../../../../ etc. Rather not write it myself

Also interested in this. For now I've left a server up for a couple of weeks, went through the logs and set up fail2ban for the most common offenders. Once a month or so I keep checking for offenders but the first iteration already blocked many of them.
Post reply on HN