Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

441–450 of 467 posts

Re: I use zip bombs to protect my server

#441

Post by zzo38computer »

anamexis wrote: post #233
grishka wrote: post #184

Earlier quoted context omitted.

> you can always create zip bombs that are links on a web page that don't show up for humans I did a version of this with my form for requesting an account on my fediverse server. The problem I was having is that there exist these very unsophisticated bots that crawl the web and submit their very unsophisticated spam into every form they see that looks like it might publish it somewhere. First I added a simple captch…

I did essentially the same thing. I have this input in a form: Email: With this CSS: .nah { opacity: 0; position: absolute; top: 0; left: 0; height: 0; width: 0; z-index: -1; } And any form submission with a value set for the email is blocked. It stopped 100% of the spam I was getting.

If CSS is disabled or using a browser that does not implement CSS, that might also be an issue. (A mode to disable CSS should ideally also be able to handle ARIA attributes (unless the user disables those too), but not all implementations will do this (actually, I don't know if any implementation does; it doesn't seem to on mine), especially if they were written before ARIA attributes were invented.)

Re: I use zip bombs to protect my server

#442

Post by scoodah »

M95D wrote: post #358
GTP wrote: post #341

Earlier quoted context omitted.

I guess it depends on the server's implementation. but, since you need some logic to decide when to serve the html bomb anyway, I don't see why you would prefer this solution. Just use whatever script you're using to detect the bots to serve the bomb.

No other scripts. Hide the link to the bomb behind an image so humans can't click it.

My first thought is how this would interact with things like screen readers and other accessibility devices

Re: I use zip bombs to protect my server

#443

Post by ku1ik »

stefs wrote: post #316
M95D wrote: post #296

Earlier quoted context omitted.

I would make it an invisible link from the main page (hidden behind a logo or something). Users won't click it, but bots will.

the problem with this is that for a tarpit, you just don't want to make it expensive for bots, you also want to make it cheap for yourself. this isn't cheap for you. a zip bomb is.

Right, so an invisible link + a zipbomb is da bomb.

Re: I use zip bombs to protect my server

#444

Post by ku1ik »

scoodah wrote: post #442
M95D wrote: post #358

Earlier quoted context omitted.

No other scripts. Hide the link to the bomb behind an image so humans can't click it.

My first thought is how this would interact with things like screen readers and other accessibility devices

Don’t screen readers ignore invisible text/links?

Re: I use zip bombs to protect my server

#445

Post by victorbjorklund »

sinuhe69 wrote: post #176
thayne wrote: post #75

Earlier quoted context omitted.

Disclosure: IANAL The CFAA[1] prohibits: > knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; As far as I can tell (again, IANAL) there isn't an exception if you believe said computer is actively attempting to abuse your system[2]. I'm not sure if a zip bomb would constitute intenti…

There is IMO no legal use case for an external computer system to initiate a connection with my system without prior legal agreement. It all happens on good will and therefore can be terminated at any time.

So you can hack any browser that connects to your website because they dont have a legal agreement with you? Dont think that will work as a defense

Re: I use zip bombs to protect my server

#446

Post by imron »

Ugohcet wrote: post #325
M95D wrote: post #283

Earlier quoted context omitted.

I wonder if I could create a 500TB html file with proper headers on a squashfs, an endless ... with no closing tags, and if I could instruct the server to not report file size before download. Any ideeas?

Why use squashfs when you can do the same OP did and serve a compressed version, so that the client is overwhelmed by both the uncompression and the DOM depth: yes " "|dd bs=1M count=10240 iflag=fullblock|gzip | pv > zipdiv.gz Resulting file is about 15 mib long and uncompresses into a 10 gib monstrosity containing 1789569706 unclosed nested divs

This is beautiful

Re: I use zip bombs to protect my server

#447

Post by johnisgood »

bjoli wrote: post #237
ChuckMcM wrote: post #21

I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of script kiddies ddosing my poor little server. I switched to just identifying 'bad actors' who are clearly trying to do bad things and just banning their IP with firewall rules. That's becoming more challenging with IPV6 though. Edit: And for folks who write t…

I am just banning large swaths of IPs. Banning most of Asia and the middle east reduced the amount of bad traffic by something like 98%.

Same, using ipsets, and a systemd {service,timer} for updating the lists.

Re: I use zip bombs to protect my server

#448

Post by hombre_fatal »

sureIy wrote: post #406
hombre_fatal wrote: post #356

Earlier quoted context omitted.

You can use WordPress as a static site generator: https://simplystatic.com/ Then WordPress is just your private CMS/UI for making changes, and it generates static files that are uploaded to a webhost like CloudFlare Pages, GitHub Pages, etc.

It has been a long time since I tried that, but it was never as simple as they claimed it to be. Now that plugin became a service, at which point you might just use a WP host and let them do their thing.

Yeah, true. There are other options that might be better like https://wordpress.org/plugins/staatic/.

I think a crawler that generates a static directory from your site probably the best approach since it generalizes over any site. Even better if you're able to declare all routes ahead of time.

Re: I use zip bombs to protect my server

#449

Post by wil421 »

dspearson wrote: post #285
cobbaut wrote: post #272

Earlier quoted context omitted.

Back then things like postmaster@theirdomain and webmaster@theirdomain were read by actual people. Also the whois command often worked.

I work for one of the largest Swiss ISPs, and these mailboxes are still to this day read by actual people (me included), so it's sometimes worthwhile even today.

I tried to contact Hetzner and others about customers scanning my ports. Nobody cares about that. I took issue when I kept getting firewall alerts for port scans on open Plex ports.

I went down a crazy rabbit hole and found a bunch of domains that were random parts of street addresses. Obviously created automatically and they were purposely trying to make it harder to find related domains.

Re: I use zip bombs to protect my server

#450

Post by miramba »

donnachangstein wrote: post #93
aaronbaugher wrote: post #89

Earlier quoted context omitted.

Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that? Especially when they don't have a budget for it, and you're helping them out as a favor? It's so easy to spin up Wordpress for them, but I'm not a fan either. I've tried Drupal in the past f…

> Can you recommend an alternative for a non-technical organization, where there's someone who needs to be able to edit pages and upload documents on a regular basis, so they need as user-friendly an interface as possible for that 25 years ago we used Microsoft Frontpage for that, with the web root mapped to a file share that the non-technical secretary could write to and edit it as if it were a word processor. Someh…

“best viewed with Internet Explorer in 1024x768”
Post reply on HN