Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

431–440 of 467 posts

Re: I use zip bombs to protect my server

#431

Post by quaddo »

mjmsmith wrote: post #411
seanhunter wrote: post #228

Once upon a time around 2001 or so I used to have a static line at home and host some stuff on my home linux box. A windows NT update had meant a lot of them had enabled this optimistic encryption thing where windows boxes would try to connect to a certain port and negotiate an s/wan before doing TCP traffic. I was used to seeing this traffic a lot on my firewall so no big deal. However there was one machine in parti…

Around the same time, or maybe even earlier, some random company sent me a junk fax every Friday. Multiple polite voicemails to their office number were ignored, so I made a 100-page PDF where every page was a large black rectangle, and used one of the new-fangled email-to-fax gateways to send it to them. Within the hour, I got an irate call. The faxes stopped.

Circa 1997 a coworker lamented that he had signed up for some email list, and attempts to unsubscribe weren’t working (more of a manual thing, IIRC). I made the suggestion to set up a cronjob to run hourly, to send an email request to be unsubscribed. It would source a text file containing the request to be unsubscribed. And with each iteration, it would duplicate the text from the file, effectively a geometric progression. The list owner responded about a week or so later, rather urgently requesting that my coworker cut it out, saying that he would remove him from the list. Apparently the list owner had been away on vacation the entire time.

Re: I use zip bombs to protect my server

#432

Post by JodieBenitez »

b2ccb2 wrote: post #404
JodieBenitez wrote: post #300

The same, for Caddy: https://www.dustri.org/b/serving-a-gzip-bomb-with-caddy.html 10T is probably overkill though.

Hilarious because the author, and the OP author, are literally zipping `/dev/null`. While they realize that it "doesn't take disk space nor ram", I feel like the coin didn't drop for them. Think about it: $ dd if=/dev/zero bs=1 count=10M | gzip -9 > 10M.gzip $ ls -sh 10M.gzip 12K 10M.gzip Other than that, why serve gzip anyway? I would not set the Content-Length Header and throttle the connection and set the MIME typ…

No, it's not about sending large files over the wire, it's about saturating the RAM of the script that reads the content. If the script is naive enough, a zip bomb will do. Example on my machine, such a snippet will cause the OS to close the python process:

    >>> from requests import get
    >>> r = get("https://acme.tld/trap/")
    >>> r.text
The server doesn't do much (serving a relatively small number of bytes) while the client basically crashes.

Re: I use zip bombs to protect my server

#433

Post by bornfreddy »

1oooqooq wrote: post #362
djxfade wrote: post #142

Earlier quoted context omitted.

Statamic https://statamic.com/

weird "license" on that project. pretty much blocks any self host usage besides a personal blog. And only hosted option for the copyrighted code starts at 300/y these don't cover any use case people use WordPress for.

Not sure why sibling was downvoted to oblivion, the license could be easier to find. Here it is: https://statamic.com/license

Re: I use zip bombs to protect my server

#434

Post by donnachangstein »

aaronbaugher wrote: post #375
shakna wrote: post #284

Earlier quoted context omitted.

Part of that is Frontpage needing a Windows server, and all that entails. The other part is clients freaking out after Frontpage had a series of dangerous CVEs all in a row. And then finally every time a part of Frontpage got popular, MS would deprecate the API and replace it with a new one. Wordpress was in the right place at the right time.

Yeah, getting Frontpage working on a Linux/Apache system and supporting it back then wasn't exactly a treat. Good idea, maybe, but bad implementation.

I think you're mistaken. The use of WebDAV was not a requirement. Frontpage could function in "HTML editor" mode and just write to the filesystem. In that case, any WYSIWYG editor would do but FP was there and available.

Re: I use zip bombs to protect my server

#435

Post by blipvert »

jillyboel wrote: post #297
blipvert wrote: post #265

Earlier quoted context omitted.

We have a (internally accessible only) WP instance where the content is exported using a plugin as a ZIP file and then deployed to NGINX servers with a bit of scripting/Ansible. Could be automated better (drop ZIP to a share somewhere where it gets processed and deployed) but best of both worlds.

Which plugin?

Good question - didn’t set it up myself, but nothing too obscure I think

Re: I use zip bombs to protect my server

#436

Post by johannesrexx »

opan wrote: post #166
bobmcnamara wrote: post #158

Earlier quoted context omitted.

I made a 64kx64k JPEG once by feeding the encoder the same line of macro blocks until it produce the entire image. Years later I was finally able to open it.

I had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd foc…

qView opens this easily enough.

Re: I use zip bombs to protect my server

#437

Post by __david__ »

mkwarman wrote: post #232
seanhunter wrote: post #228

Once upon a time around 2001 or so I used to have a static line at home and host some stuff on my home linux box. A windows NT update had meant a lot of them had enabled this optimistic encryption thing where windows boxes would try to connect to a certain port and negotiate an s/wan before doing TCP traffic. I was used to seeing this traffic a lot on my firewall so no big deal. However there was one machine in parti…

I enjoyed reading this, thank you for sharing. When you say you tried to contact the admin of the box and that this was common back then, how would you typically find the contact info for an arbitrary client's admin?

I always liked the RP DNS record (https://www.rfc-editor.org/rfc/rfc1183) but no one seems to know about it or use it any more. The only reason my servers don't have one now is because route53 doesn't support it.

Re: I use zip bombs to protect my server

#438

Post by wfn »

GTP wrote: post #342
amelius wrote: post #311

Earlier quoted context omitted.

Maybe it's time for a /dev/zipbomb device.

ln -s /dev/urandom /dev/zipbomb && echo 'Boom!' Ok, not a real zip bomb, for that we would need a kernel module.

> Ok, not a real zip bomb, for that we would need a kernel module.

Or a userland fusefs program, nice funky idea actually (with configurable dynamic filenames, e.g. `mnt/10GiB_zeropattern.zip`...

Re: I use zip bombs to protect my server

#439

Post by winrid »

ChuckMcM wrote: post #21

I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of script kiddies ddosing my poor little server. I switched to just identifying 'bad actors' who are clearly trying to do bad things and just banning their IP with firewall rules. That's becoming more challenging with IPV6 though. Edit: And for folks who write t…

fail2ban automates that and is in package managers

Re: I use zip bombs to protect my server

#440

Post by [deleted] »

Twirrim wrote: post #243
palijer wrote: post #171

Earlier quoted context omitted.

This doesn't work if you pay bandwidth and CPU usage for your servers though.

The labyrinth doesn't have to be fast, and things like iocaine ( https://iocaine.madhouse-project.org/ ) don't use much CPU if you don't go and give them something like the Complete Works of Ahakespeare as input (Mine is using Moby Dick), and can easily be constrained with cgroups if you're concerned about resource usage. I've noticed that LLM scrapers tend to be incredibly patient. They'll wait for minutes for even…

[deleted]
Post reply on HN