Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

371–380 of 467 posts

Re: I use zip bombs to protect my server

#371

Post by [deleted] »

jpsouth wrote: post #326
kazinator wrote: post #121

Earlier quoted context omitted.

I currently cannot tell without making a little configuration change, because as soon as an IP address is logged as having visited the trap URL (honeypot, or zipbomb or whatever), a log monitoring script bans that client. Secondly, I know that most of these bots do not come back. The attacks do not reuse addresses against the same server in order to evade almost any conceivable filter rule that is predicated on a pri…

I may be asking a really silly question here, but > as soon as an IP address is logged as having visited the trap URL (honeypot, or zipbomb or whatever), a log monitoring script bans that client. Is this not why they aren’t getting the full file?

[deleted]

Re: I use zip bombs to protect my server

#372

Post by cratermoon »

toast0 wrote: post #24
wiredfool wrote: post #17

Earlier quoted context omitted.

Amazon's scraper has been sending multiple requests per second to my servers for 6+ weeks, and every request has been returned 429. Amazon's scraper doesn't back off. Meta, google, most of the others with identifiable user agents back off, Amazon doesn't.

If it's easy, sleep 30 before returning 429. Or tcpdrop the connections and don't even send a response or a tcp reset.

That's a good way to self-DOS

Re: I use zip bombs to protect my server

#373

Post by echoangle »

seqizz wrote: post #367
echoangle wrote: post #304

Earlier quoted context omitted.

The law might stop you from sending specific responses if the only goal is to sabotage the requesting computer. I’m not 100% familiar with US law but I think intentionally sabotaging a computer system would be illegal.

I'm also not a lawyer, but wouldn't they dismiss this as a sabotage if the requester is not legally forced to request it in the first place?

No, why would they? If I voluntarily request your website, you can’t just reply with a virus that wipes my harddrive. Even though I had the option to not send the request. I didn’t know that you were going to sabotage me before I made the request.

Re: I use zip bombs to protect my server

#375

Post by aaronbaugher »

shakna wrote: post #284
donnachangstein wrote: post #93

Earlier quoted context omitted.

> Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that 25 years ago we used Microsoft Frontpage for that, with the web root mapped to a file share that the non-technical secretary could write to and edit it as if it were a word processor. Someh…

Part of that is Frontpage needing a Windows server, and all that entails. The other part is clients freaking out after Frontpage had a series of dangerous CVEs all in a row. And then finally every time a part of Frontpage got popular, MS would deprecate the API and replace it with a new one. Wordpress was in the right place at the right time.

Yeah, getting Frontpage working on a Linux/Apache system and supporting it back then wasn't exactly a treat. Good idea, maybe, but bad implementation.

Re: I use zip bombs to protect my server

#376

Post by jcynix »

As I don't use PHP in my server, but get a lot of requests for various PHP related stuff, I added a rule to serve a Linux kernel encrypted with a "passphrase" derived from /dev/urandom as a reply for these requests. A zip bomb might be a worse reply ...

For all those "eagerly" fishing for content AI bots I ponder if I should set up a Markov chain to generate semi-legible text in the style of the classic https://en.wikipedia.org/wiki/Mark_V._Shaney ...

Re: I use zip bombs to protect my server

#377

Post by ozim »

malfist wrote: post #162
lillecarl wrote: post #103

Earlier quoted context omitted.

Manual banning is about the same since you just book /56 or bigger, entire providers or countries. Automated banning is harder, you'd probably want a heuristic system and look up info on IPs. IPv4 with NAT means you can "overban" too.

Why wouldn't something like fail2ban not work here? That's what it's built for and has been around for eons.

Fun part was that fail2ban had RCE vulnerability. So you were more secure not running it now it should be fixed but can you be sure?

Re: I use zip bombs to protect my server

#378

Post by kazinator »

jpsouth wrote: post #326
kazinator wrote: post #121

Earlier quoted context omitted.

I currently cannot tell without making a little configuration change, because as soon as an IP address is logged as having visited the trap URL (honeypot, or zipbomb or whatever), a log monitoring script bans that client. Secondly, I know that most of these bots do not come back. The attacks do not reuse addresses against the same server in order to evade almost any conceivable filter rule that is predicated on a pri…

I may be asking a really silly question here, but > as soon as an IP address is logged as having visited the trap URL (honeypot, or zipbomb or whatever), a log monitoring script bans that client. Is this not why they aren’t getting the full file?

I believe Apache is logging complete requests. For instance, in the case of clients sent to a honeypot, I see a log entry appear when I pick a honeypot script from the process listing and kill it. That could be hours after the client connected. The timestamps logged are connection time not completion time. E.g. here is a pair of consecutive logs:

  124.243.178.242 - - [29/Apr/2025:00:16:52 -0700] "GET /cgit/[...]
  94.74.94.113 - - [29/Apr/2025:00:07:01 -0700] "GET /honeypot/[...]
Notice the second timestamp is almost ten minutes earlier.

Re: I use zip bombs to protect my server

#379

Post by ChoGGi »

hdjrudni wrote: post #216
bugfix wrote: post #178

Earlier quoted context omitted.

IrfanView was able to load it in about 8 seconds (Ryzen 7 5800x) using 2.8GB of RAM, but zooming/panning is quite slow (~500ms per action)

IrfanView on my PC is very fast. Zoomed to 100% I can pan around no problem. Is it using CPU or GPU? I've got an 11900K CPU and RTX 3090.

There's fast and slow resample viewing options in Irfanview, he may have slow turned on for higher quality.

Re: I use zip bombs to protect my server

#380

Post by dredmorbius »

stavros wrote: post #170
sgc wrote: post #31

Earlier quoted context omitted.

The idea is to trickle it very slowly, like keeping a cat occupied with a ball of fluff in the corner.

Yes but you still need to keep a connection open to them. This is a sort of reverse SlowLoris attack, though.

You've got the option of abandoning the connection at any time should resources be needed elsewhere.

(Or rather, the tarpit should be programmed to do this, whether by having a maximum resource allocation or monitoring free system resources.)

Post reply on HN