Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

281–290 of 467 posts

Re: I use zip bombs to protect my server

#281

Post by arc-in-space »

opan wrote: post #166
bobmcnamara wrote: post #158

Earlier quoted context omitted.

I made a 64kx64k JPEG once by feeding the encoder the same line of macro blocks until it produce the entire image. Years later I was finally able to open it.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd foc…

Oh hey it's the thing that ruins an otherwise okay rhythm game.

Re: I use zip bombs to protect my server

#282

Post by ninalanyon »

opan wrote: post #166
bobmcnamara wrote: post #158

Earlier quoted context omitted.

I made a 64kx64k JPEG once by feeding the encoder the same line of macro blocks until it produce the entire image. Years later I was finally able to open it.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd foc…

Opens fine in Firefox 138.

Re: I use zip bombs to protect my server

#283

Post by M95D »

layer8 wrote: post #53

Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them. Later on, browsers started to check for actual content I think, and would abort such requests.

I wonder if I could create a 500TB html file with proper headers on a squashfs, an endless ... with no closing tags, and if I could instruct the server to not report file size before download.

Any ideeas?

Re: I use zip bombs to protect my server

#284

Post by shakna »

donnachangstein wrote: post #93
aaronbaugher wrote: post #89

Earlier quoted context omitted.

Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past f…

> Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that 25 years ago we used Microsoft Frontpage for that, with the web root mapped to a file share that the non-technical secretary could write to and edit it as if it were a word processor. Someh…

Part of that is Frontpage needing a Windows server, and all that entails.

The other part is clients freaking out after Frontpage had a series of dangerous CVEs all in a row.

And then finally every time a part of Frontpage got popular, MS would deprecate the API and replace it with a new one.

Wordpress was in the right place at the right time.

Re: I use zip bombs to protect my server

#285

Post by dspearson »

cobbaut wrote: post #272
mkwarman wrote: post #232

Earlier quoted context omitted.

I enjoyed reading this, thank you for sharing. When you say you tried to contact the admin of the box and that this was common back then, how would you typically find the contact info for an arbitrary client's admin?

Back then things like postmaster@theirdomain and webmaster@theirdomain were read by actual people. Also the whois command often worked.

I work for one of the largest Swiss ISPs, and these mailboxes are still to this day read by actual people (me included), so it's sometimes worthwhile even today.

Re: I use zip bombs to protect my server

#286

Post by CobrastanJorji »

M95D wrote: post #283
layer8 wrote: post #53

Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them. Later on, browsers started to check for actual content I think, and would abort such requests.

I wonder if I could create a 500TB html file with proper headers on a squashfs, an endless ... with no closing tags, and if I could instruct the server to not report file size before download. Any ideeas?

Yes, servers can respond without specifying the size by using chunked encoding. And you can do the rest with a custom web server that just handles request by returning "" in a loop. I have no idea if browsers are vulnerable to such a thing.

Re: I use zip bombs to protect my server

#287

Post by maeln »

bilekas wrote: post #62

> At my old employer, a bot discovered a wordpress vulnerability and inserted a malicious script into our server I know it's slightly off topic, but it's just so amusing (edit: reassuring) to know I'm not the only one who, after 1 hour of setting up Wordpress there's a PHP shell magically deployed on my server.

I never hosted WP, but as soon as you have a HTTP server expose to the internet you will get request to /wp-login and such. It as become a good way to find bots also. If I see an IP requesting anything from a popular CMS, hop it goes in the iptables holes

Re: I use zip bombs to protect my server

#288

Post by NetOpWibby »

dspearson wrote: post #285
cobbaut wrote: post #272

Earlier quoted context omitted.

Back then things like postmaster@theirdomain and webmaster@theirdomain were read by actual people. Also the whois command often worked.

I work for one of the largest Swiss ISPs, and these mailboxes are still to this day read by actual people (me included), so it's sometimes worthwhile even today.

I setup a new mail server with Stalwart and have been getting automated mails to my postmaster address (security treat results mostly).

Pretty neat.

Re: I use zip bombs to protect my server

#289

Post by immibis »

vitus wrote: post #197
suid wrote: post #182

Earlier quoted context omitted.

Good question. The "ultimate zip bomb" looks something like https://github.com/iamtraction/ZOD - this produces the infamous "42.zip" file, which is about 42KiB, but expands to 3.99 PiB (!). There's literally no machine on Earth today that can deal with that (as a single file, I mean).

> There's literally no machine on Earth today that can deal with that (as a single file, I mean). Oh? Certainly not in RAM, but 4 PiB is about 125x 36TiB drives (or 188x 24TiB drives). (You can go bigger if you want to shell out tens of thousands per 100TB SSD, at which point you "only" need 45 of those drives.) These are numbers such that a purpose-built server with enough SAS expanders could easily fit that within…

I think you can rent a server with about 4.5 PiB from OVH - as a standard product offering, not even a special request. It costs a lot, obviously.

Re: I use zip bombs to protect my server

#290

Post by IamDaedalus »

opan wrote: post #166
bobmcnamara wrote: post #158

Earlier quoted context omitted.

I made a 64kx64k JPEG once by feeding the encoder the same line of macro blocks until it produce the entire image. Years later I was finally able to open it.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd foc…

on mobile Brave just displayed it as the placeholder broken link image but in Firefox it loaded in about 10s
Post reply on HN