61–70 of 79 posts
I've done this without compression but just sending infinite data. On some days I've sent a TB to a single IP address... Might be an idea to combine this. I'd assume the resulting gzip file here contains a repeating pattern that you can generate on the fly?
Was your hosting OK with that? ZIP bombs are light on the "data transferred" front, a TB is pretty massive.
People have been coming up with ideas like that regularly. I'm not a fan. The title says that you can "defend" your webpage, but it is not clear how it "defends" against anything. The only thing you possibly achieve is that every now and then, someone with an automated scanner (which may be an attacker, or may be a security researcher or service) will see his tool crash or consume large amounts of resources. You're s…
Perhaps used to be true, however I believe active countermeasures will grow in importance in the near future. We are on the cusp of seeing a lot more sophisticated class of automated attacks (once the malicious cyber actors get a grasp on how to use LLM's in their favour) and active disruption of these capabilities will be important, not just building more shields around yourself. Before that, we need to fast-track t…
I could believe you if you said that ZIP bombs are perhaps mildly effective against script kiddies using ChatGPT to generate a naive, simplistic automated scanners that are susceptible to being "zip bombed". The other way around? Not so much.
These zip bombs are trivial to defend against as an attacker, e.g. by inspecting the payload while you're decompressing it to see if it matches some expected output (an tag, for example) or by aborting after the decompressed size exceeds some limit (10 MB is way more HTML than you'd typically expect, for example).
It reminds me of someone I read about from the early web who defended their website against email address harvesting crawlers by adding a dynamic page that threw up some random emails and links, where the links just led back to the dynamic page under a new path on the same host. The crawlers would get stuck downloading millions of fake email addresses until they eventually broke.
Earlier quoted context omitted.
Can you tell me where in my words you read that I blamed victims? I think you're reading something into it that isn't there.
You are very insistent that people are doing "defending" wrong, and I can see how someone could read victim blaming into it, the industry does have a bad habit of loud hindsight bias. But it's also entirely beside the point, since no one here is claiming that this is real security, it's just a small nostalgic hack, and it comes off a bit grumpy to be so adamantly against it.
that's so absolutely ridiculous.
"Hey bud, you're wearing your helmet backwards." "Oh, so it's MY fault when I run into something on my motorcycle, HUH?!"
"Oh ok, well, have fun. I'll be safely over here. "
a zip bomb will only serve to hinder teenage/kid 'hackers' -- next you're going to tell me if I don't implement a zip bomb somewhere that it'll deprive the next generation of hackers of a valuable life lesson -- please.
At what point can we point out a flawed methodology without being accused of being 'the bad guys' ourselves? It gets to be that when you see someone making a mistake you feel like just letting them dive in and do it ; otherwise you'll be labeled the worlds' worst victim-blaming monster -- eh, easier to keep your mouth shut at some point .. that's a dangerous condition.
Earlier quoted context omitted.
Guilty, I did this on my first project site back in the early 00s. It only worked for a small time before scanners got more sophisticated. It was a fun diversion but people who do this quickly adapt.
What if the returned content is just chat gpt generated add hoc nonsense in the amount nonsense heuristics-1 ?
I've done this without compression but just sending infinite data. On some days I've sent a TB to a single IP address... Might be an idea to combine this. I'd assume the resulting gzip file here contains a repeating pattern that you can generate on the fly?
Was your hosting OK with that? ZIP bombs are light on the "data transferred" front, a TB is pretty massive.
This reminds me of the chat bot tool that was deployed to reply to scam emails and waste maximal time of the scammers by seeming like a vulnerable, gullible target. The chat bot would drag out the interaction slowly, wasting as much time as possible for the scammer, all the while posing as a real human. There are a lot of comments here decrying this as a method to defend your website, but in some senses it's a very s…
Another possible tactic is to trickle your packets back slowly, say trickle 1 TCP packet back to them per second. Sure, they probably have client-side timeouts, but again, if everyone did this, wouldn't it be a pain to scan for vulns? Every endpoint you hit would last the duration of your timeout.
People have been coming up with ideas like that regularly. I'm not a fan. The title says that you can "defend" your webpage, but it is not clear how it "defends" against anything. The only thing you possibly achieve is that every now and then, someone with an automated scanner (which may be an attacker, or may be a security researcher or service) will see his tool crash or consume large amounts of resources. You're s…
True. But it's also a low-cost, low-effort thing. It may not change the world, but putting a small hiccup in someone's operation can bring a small bit of joy.
Earlier quoted context omitted.
Perhaps used to be true, however I believe active countermeasures will grow in importance in the near future. We are on the cusp of seeing a lot more sophisticated class of automated attacks (once the malicious cyber actors get a grasp on how to use LLM's in their favour) and active disruption of these capabilities will be important, not just building more shields around yourself. Before that, we need to fast-track t…
Please elaborate, how are LLMs going to provide a "more sophisticated" class of automated attacks, and how are toy countermeasures like ZIP bombs going to defend against these "sophisticated" attacks? I could believe you if you said that ZIP bombs are perhaps mildly effective against script kiddies using ChatGPT to generate a naive, simplistic automated scanners that are susceptible to being "zip bombed". The other w…
Is it legal to purposefully distribute a malicious payload as a booby trap?