Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I use zip bombs to protect my server

idiallo.com

Post reply on HN
Print view View original

451–460 of 467 posts

Re: I use zip bombs to protect my server

#451

Post by naikrovek »

gblargg wrote: post #295
thayne wrote: post #75

Earlier quoted context omitted.

Disclosure: IANAL The CFAA[1] prohibits: > knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; As far as I can tell (again, IANAL) there isn't an exception if you believe said computer is actively attempting to abuse your system[2]. I'm not sure if a zip bomb would constitute intenti…

So the trick is to disguise it as an accident. Have the zip bomb look like a real HTML file at the beginning, then have zeroes after that, like it got corrupted.

well, what does "damage" mean in that law? filling the disk isn't destructive. filling RAM isn't destructive. there's nothing in a zip-bomb approach that is destructive; a reboot or an `rm` (at most) undoes it all. I would say that this doesn't qualify as a destructive operation in any way.

IANAL

Re: I use zip bombs to protect my server

#452

Post by seanhunter »

zerr wrote: post #361
seanhunter wrote: post #228

Once upon a time around 2001 or so I used to have a static line at home and host some stuff on my home linux box. A windows NT update had meant a lot of them had enabled this optimistic encryption thing where windows boxes would try to connect to a certain port and negotiate an s/wan before doing TCP traffic. I was used to seeing this traffic a lot on my firewall so no big deal. However there was one machine in parti…

Didn't get why that WinNT box was connecting to your box. Due to some misconfigured Windows update procedure?

I never found this out, but there was some feature where NT would try to negotiate an encrypted connection to communicate and that’s the port it was connecting on. It’s a long time ago. It’s possible the box had been pwned, and that was command/control for a botnet or something. Lots of internet-facing windows boxes were at the time because MS security was absolutely horrendous at this time.

Re: I use zip bombs to protect my server

#453

Post by guappa »

eru wrote: post #421
guappa wrote: post #321

Earlier quoted context omitted.

Then you kill your service which might also be serving legitimate users.

It depends on how you set things up. Eg if you fork for every request, that process only serves that one user. Or if you can restart fast enough. I'm mostly inspired by Erlang here.

Fork at every request isn't going to make a fast server.

Re: I use zip bombs to protect my server

#454

Post by thephyber »

dspillett wrote: post #393
thephyber wrote: post #81

Earlier quoted context omitted.

Who, running a crawler which violates robots.txt, is going to prosecute/sue the server owner? The server owner can make an easy case to the jury that it is a booby trap to defend against trespassers.

> can make an easy case to the jury that it is a booby trap to defend against trespassers I don't know of any online cases, but the law in many (most?) places certainly tends to look unfavourably on physical booby-traps. Even in the US states with full-on “stand your ground” legislation and the UK where common law allows for all “reasonable force” in self-defence, booby-traps are usually not considered self-defence o…

The illegality of boobytrapping your house appears to be illegal because of the potential threat to life/health. A zip bomb doesn’t threaten any people. At worst, it can fill up memory and storage on a device. I’m pretty sure it wouldn’t violate any of the same statutes and it most likely wouldn’t fall nicely under any of the common law jurisprudence that you mentioned.

> pull that zipbomb repeatedly to eat your bandwidth, and they likely have more and much cheaper bandwidth than your little site.

Go read what a zip bomb is. There is one that is only a few KB, which is comparable in server load + bandwidth to a robots.txt.

Re: I use zip bombs to protect my server

#455

Post by stefs »

ku1ik wrote: post #443
stefs wrote: post #316

Earlier quoted context omitted.

the problem with this is that for a tarpit, you just don't want to make it expensive for bots, you also want to make it cheap for yourself. this isn't cheap for you. a zip bomb is.

Right, so an invisible link + a zipbomb is da bomb.

maybe, maybe not. it's one tool at your disposal. it's easy to guard against zip bombs if you know about them - the question is, how thorough are the bot devs you're targeting?

there are other techniques. for example: hold a connection open and only push out a few bytes every few seconds - whether that's cheap for you or not depends on your servers concurrency model (if it's 1 OS thread per connection, then you'd DOS yourself with this - but with an evented model you should be good). if the bot analyzes images or pdfs you could try toxic files that exploit known weaknesses which lead to memory corruption to crash them; depends on the bots capabilities and used libraries of course.

Re: I use zip bombs to protect my server

#456

Post by MomsAVoxell »

seanhunter wrote: post #228

Once upon a time around 2001 or so I used to have a static line at home and host some stuff on my home linux box. A windows NT update had meant a lot of them had enabled this optimistic encryption thing where windows boxes would try to connect to a certain port and negotiate an s/wan before doing TCP traffic. I was used to seeing this traffic a lot on my firewall so no big deal. However there was one machine in parti…

You’d be surprised to know, that in a majority of the cases of NT installations in that era, providing services, there were very, very few admins around to even notice what was going on. Running services like this on an NT box was done ‘in order to not have to have an admin’, in so many thousands of cases, it cannot be underestimated.

Disclaimer: I put a lot of servers on the Internet in the 90’s/early 2000’s. It was industry-wide standard practice: ‘use NT so you don’t need an admin’.

Re: I use zip bombs to protect my server

#457

Post by efilife »

fareesh wrote: post #238

Is there a list of popular attack vector urls located somewhere? I want to just auto-ban anyone sniffing for .env or ../../../../ etc. Rather not write it myself

check out the lists in this repo

https://github.com/danielmiessler/SecLists/blob/master/Disco...

I combined a few of the most interesting lists from here into one and never miss an attack now

Re: I use zip bombs to protect my server

#458

Post by dmos62 »

MomsAVoxell wrote: post #456
seanhunter wrote: post #228

Once upon a time around 2001 or so I used to have a static line at home and host some stuff on my home linux box. A windows NT update had meant a lot of them had enabled this optimistic encryption thing where windows boxes would try to connect to a certain port and negotiate an s/wan before doing TCP traffic. I was used to seeing this traffic a lot on my firewall so no big deal. However there was one machine in parti…

You’d be surprised to know, that in a majority of the cases of NT installations in that era, providing services, there were very, very few admins around to even notice what was going on. Running services like this on an NT box was done ‘in order to not have to have an admin’, in so many thousands of cases, it cannot be underestimated. Disclaimer: I put a lot of servers on the Internet in the 90’s/early 2000’s. It was…

What was it about NT that made an admin unnecessary? Just marketing?

Re: I use zip bombs to protect my server

#459

Post by fennecbutt »

connicpu wrote: post #254
lgeek wrote: post #205

Earlier quoted context omitted.

On Firefox on Android on my pretty old phone, a blurry preview rendered in about 10 seconds, and it was fully rendered in 20 something seconds. Smooth panning and zooming the entire time

Firefox on a Samsung S23 Ultra did it a few seconds faster but otherwise the same experience

Following up with Firefox on S24 Ultra loaded from blank to image in a second and then could zoom right in fine with no blurriness or stuttering at all!

Re: I use zip bombs to protect my server

#460

Post by rekabis »

cobbaut wrote: post #272
mkwarman wrote: post #232

Earlier quoted context omitted.

I enjoyed reading this, thank you for sharing. When you say you tried to contact the admin of the box and that this was common back then, how would you typically find the contact info for an arbitrary client's admin?

Back then things like postmaster@theirdomain and webmaster@theirdomain were read by actual people. Also the whois command often worked.

A responsible domain owner still will read them. My own postmaster is a catch-all for all my domains, such that typos in the username still get caught. Has proven to be invaluable with the family domain, where harried medical staff make mistakes in setting up accounts for my parents.
Post reply on HN