3 ms·
I have never felt such a greater sense of inadequacy in cyber security as I have after reading this article. This is simply amazing the level of sophistication
by abuani 9y ago
I have never felt such a greater sense of inadequacy in cyber security as I have after reading this article. This is simply amazing the level of sophistication Eddie was in terms of an attack on the service, and the mitigation techniques used were things I never would have considered. I thought zip/tar bombs were just relics of yesteryear that older folks talk about when they discuss how fun it was to prank the new hires.
Serious question: how does one begin to gain the knowledge necessary to mitigate such an attack, and is it something that developers should be more familiar with?
- WrtCdEvrydy 9y agoZip bombs are a classic way to crash any web service that allows you to upload files, modern AV will sometimes fuck up and bite into the file (normally in the legacy fields since they require 'brand name' 'well known' antivirus like 'Norton') Especially if you are aware that they open the files to "extract info" from them. You can modify the file extension to the correct type and let it rip.
- abuani 9y agoI found this: https://github.com/abdulfatir/ZipBomb https://github.com/abdulfatir/ZipBomb which I will be looking into today! Are zipbombs typically something a developer should be actively writing to protect against? Or does a library like Helmet typically provide protection against these attack vectors?
- Cozumel 9y agoDon't rely on libraries, just sort yourself out with learning the basics :)
- abuani 9y agoNot trying to be lazy here, but what are some legitimate resources to begin learning? I'm willing to wade through the complexity, so white papers or research is also very welcome.
- fictioncircle 9y agoOwasp presentations, Blackhat presentations, etc. usually give you a general idea of what people are seeing and then you research the specific attack(s) in depth. This isn't the sort of thing you can commit to memory. https://www.owasp.org/images/c/c9/Benelux_day_20161125_G_Pellegrino_CompressionBombsStrikeBack.pdf https://www.owasp.org/images/c/c9/Benelux_day_20161125_G_Pel...
- WrtCdEvrydy 9y agoProtection generally comes in the fact that the AV will explode or your library will explode. You just need to ensure that such an explosion does not destroy your service as well.
- SomeStupidPoint 9y agoAnd try to make it explode quickly -- if it fails slowly, it can be uses to DDoS, by getting all your worker threads to spend most of their time on your files.