5 ms·

People have been coming up with ideas like that regularly. I'm not a fan. The title says that you can "defend" your webpage, but it is not clear how it "defend

by hannob 3y ago

People have been coming up with ideas like that regularly. I'm not a fan. The title says that you can "defend" your webpage, but it is not clear how it "defends" against anything. The only thing you possibly achieve is that every now and then, someone with an automated scanner (which may be an attacker, or may be a security researcher or service) will see his tool crash or consume large amounts of resources. You're spending time trying to annoy attackers that you should probably just ignore. If you really worry that someone running some automated scanner against your webpage causes you any harm, you probably should spend your time with something different than building zip bombs, and instead fix the security problems you have.

JohnFen 3y ago
> The only thing you possibly achieve is that every now and then, someone with an automated scanner (which may be an attacker, or may be a security researcher or service) will see his tool crash or consume large amounts of resources. True. But it's also a low-cost, low-effort thing. It may not change the world, but putting a small hiccup in someone's operation can bring a small bit of joy.
Avamander 3y ago
Slowing down and resisting unauthorised scanners does sound like one more layer of defence to me.
bayindirh 3y ago
> you probably should spend your time with something different than building zip bombs, and instead fix the security problems you have. Why not both? You can both create a well configured server to reduce its attack surface and add a booby-trap or two for really adamant scanners which hit very specific endpoints on your site. I don't have to welcome every scanner with open arms. Maybe I'm doing some research, PoC||GTFO style, and your scanner found my research. It's not my problem.
- Freak_NL 3y ago
  > PoC||GTFO style ?
  - bayindirh 3y ago
    Oh. It's "International Journal of Proof-of-Concept or Get The Fuck Out (PoC||GTFO or PoC or GTFO)", available at https://www.alchemistowl.org/pocorgtfo/ https://www.alchemistowl.org/pocorgtfo/
waihtis 3y ago
Perhaps used to be true, however I believe active countermeasures will grow in importance in the near future. We are on the cusp of seeing a lot more sophisticated class of automated attacks (once the malicious cyber actors get a grasp on how to use LLM's in their favour) and active disruption of these capabilities will be important, not just building more shields around yourself. Before that, we need to fast-track the normalization of using active countermeasures as most are in the same camp as you are.
- dns_snek 3y ago
  Please elaborate, how are LLMs going to provide a "more sophisticated" class of automated attacks, and how are toy countermeasures like ZIP bombs going to defend against these "sophisticated" attacks? I could believe you if you said that ZIP bombs are perhaps mildly effective against script kiddies using ChatGPT to generate a naive, simplistic automated scanners that are susceptible to being "zip bombed". The other way around? Not so much. These zip bombs are trivial to defend against as an attacker, e.g. by inspecting the payload while you're decompressing it to see if it matches some expected output (an <html> tag, for example) or by aborting after the decompressed size exceeds some limit (10 MB is way more HTML than you'd typically expect, for example).
  - waihtis 3y ago
    I didn't say a zip bomb is effective against LLMs, I said active countermeasures in general
    - dns_snek 3y ago
      Do you mind elaborating, how are LLMs going to help with sophisticated attacks and what kind of countermeasures do you have in mind?
noobermin 3y ago
It really is only in the world of IT security is this attitude so pervasive, where you constantly blame victims. While defense is a great offense it can't hurt to be an annoyance to bad actors.
- el_oni 3y ago
  unless it paints a target on your back
- hannob 3y ago
  Can you tell me where in my words you read that I blamed victims? I think you're reading something into it that isn't there.
  - ivancho 3y ago
    You are very insistent that people are doing "defending" wrong, and I can see how someone could read victim blaming into it, the industry does have a bad habit of loud hindsight bias. But it's also entirely beside the point, since no one here is claiming that this is real security, it's just a small nostalgic hack, and it comes off a bit grumpy to be so adamantly against it.
    - serf 3y ago
      >You are very insistent that people are doing "defending" wrong, and I can see how someone could read victim blaming into it that's so absolutely ridiculous. "Hey bud, you're wearing your helmet backwards." "Oh, so it's MY fault when I run into something on my motorcycle, HUH?!" "Oh ok, well, have fun. I'll be safely over here. " a zip bomb will only serve to hinder teenage/kid 'hackers' -- next you're going to tell me if I don't implement a zip bomb somewhere that it'll deprive the next generation of hackers of a valuable life lesson -- please. At what point can we point out a flawed methodology without being accused of being 'the bad guys' ourselves? It gets to be that when you see someone making a mistake you feel like just letting them dive in and do it ; otherwise you'll be labeled the worlds' worst victim-blaming monster -- eh, easier to keep your mouth shut at some point .. that's a dangerous condition.
foul 3y ago
>You're spending time trying to annoy attackers that you should probably just ignore. s/ignore/block at firewall-level/ To me this article is of relevance nonetheless because It inspires me for messing with AI trainers by crafting an html page ZIP bomb full of ZIP-bomb-like embedded attachments (stylesheets, images, etc).
- berkes 3y ago
  I use fail2ban for this. I know what my servers run (and it's never PHP, Python microsoft/AD sharepoint etc, because I don't have services in these languages or systems) so I simply fail2ban everything that matches these broad items. Access "wp-admin"? Ban. Try "cron.php" ban. Looking for "phpmyadmin"? ban. It works reasonably well. These bots can switch to other IPs, or try again after the jailtime is lifted (20 mins in my case). But instead of a bot attempting thousands of endpoints, I get only one attempt. I initially configured this on a backend, that for reasons, had to handle every URL in the (Ruby, so heavy and slow) application layer: a bot trying common endpoints for popular CMSes and services, would put severe load on this application. Fail2ban was already there, blocking SSH, FTP, SMTP and whatnot, so I configured it to also handle these HTTP endpoints.
  - tlavoie 3y ago
    Fail2ban can also work on ModSecurity logs, banning IPs that trigger a bunch of rules there. By the way, I have mine set to block for 12 hours, and some still come back. I suppose what I should look into is some sort of progressive extension to the delay.
    - berkes 3y ago
      A progressive jailtime is, indeed, a very good idea.
- hannob 3y ago
  No, ignore. WAFs that "block" "attacks" that ultimately should just cause a 404 error are part of the same mindset: That you think you "have to do something" about an attack that you should probably just ignore. They're also part of the mindset that security should mean adding more complexity, which is the opposite of what you should do.
ivancho 3y ago
No one is really worried, and no time is wasted when the outcome is occasional fun. There's no security holes to fix, there's just a bunch gnats poking at your server and you shoo them away, that's all.
- hannob 3y ago
  If your goal is "fun" then I guess that's fine. But don't pitch it as "defending" your website.
  - esdf 3y ago
    It is fun to pitch it as defending a website. Now it’s fine
deleted 3y ago
[deleted]

by hannob 3y ago

JohnFen 3y ago

> The only thing you possibly achieve is that every now and then, someone with an automated scanner (which may be an attacker, or may be a security researcher or service) will see his tool crash or consume large amounts of resources. True. But it's also a low-cost, low-effort thing. It may not change the world, but putting a small hiccup in someone's operation can bring a small bit of joy.

Avamander 3y ago

Slowing down and resisting unauthorised scanners does sound like one more layer of defence to me.

bayindirh 3y ago

> you probably should spend your time with something different than building zip bombs, and instead fix the security problems you have. Why not both? You can both create a well configured server to reduce its attack surface and add a booby-trap or two for really adamant scanners which hit very specific endpoints on your site. I don't have to welcome every scanner with open arms. Maybe I'm doing some research, PoC||GTFO style, and your scanner found my research. It's not my problem.

Freak_NL 3y ago
> PoC||GTFO style ?
- bayindirh 3y ago
  Oh. It's "International Journal of Proof-of-Concept or Get The Fuck Out (PoC||GTFO or PoC or GTFO)", available at https://www.alchemistowl.org/pocorgtfo/ https://www.alchemistowl.org/pocorgtfo/

waihtis 3y ago

Perhaps used to be true, however I believe active countermeasures will grow in importance in the near future. We are on the cusp of seeing a lot more sophisticated class of automated attacks (once the malicious cyber actors get a grasp on how to use LLM's in their favour) and active disruption of these capabilities will be important, not just building more shields around yourself. Before that, we need to fast-track the normalization of using active countermeasures as most are in the same camp as you are.

dns_snek 3y ago
Please elaborate, how are LLMs going to provide a "more sophisticated" class of automated attacks, and how are toy countermeasures like ZIP bombs going to defend against these "sophisticated" attacks? I could believe you if you said that ZIP bombs are perhaps mildly effective against script kiddies using ChatGPT to generate a naive, simplistic automated scanners that are susceptible to being "zip bombed". The other way around? Not so much. These zip bombs are trivial to defend against as an attacker, e.g. by inspecting the payload while you're decompressing it to see if it matches some expected output (an <html> tag, for example) or by aborting after the decompressed size exceeds some limit (10 MB is way more HTML than you'd typically expect, for example).
- waihtis 3y ago
  I didn't say a zip bomb is effective against LLMs, I said active countermeasures in general
  - dns_snek 3y ago
    Do you mind elaborating, how are LLMs going to help with sophisticated attacks and what kind of countermeasures do you have in mind?

noobermin 3y ago

It really is only in the world of IT security is this attitude so pervasive, where you constantly blame victims. While defense is a great offense it can't hurt to be an annoyance to bad actors.

el_oni 3y ago
unless it paints a target on your back
hannob 3y ago
Can you tell me where in my words you read that I blamed victims? I think you're reading something into it that isn't there.
- ivancho 3y ago
  You are very insistent that people are doing "defending" wrong, and I can see how someone could read victim blaming into it, the industry does have a bad habit of loud hindsight bias. But it's also entirely beside the point, since no one here is claiming that this is real security, it's just a small nostalgic hack, and it comes off a bit grumpy to be so adamantly against it.
  - serf 3y ago
    >You are very insistent that people are doing "defending" wrong, and I can see how someone could read victim blaming into it that's so absolutely ridiculous. "Hey bud, you're wearing your helmet backwards." "Oh, so it's MY fault when I run into something on my motorcycle, HUH?!" "Oh ok, well, have fun. I'll be safely over here. " a zip bomb will only serve to hinder teenage/kid 'hackers' -- next you're going to tell me if I don't implement a zip bomb somewhere that it'll deprive the next generation of hackers of a valuable life lesson -- please. At what point can we point out a flawed methodology without being accused of being 'the bad guys' ourselves? It gets to be that when you see someone making a mistake you feel like just letting them dive in and do it ; otherwise you'll be labeled the worlds' worst victim-blaming monster -- eh, easier to keep your mouth shut at some point .. that's a dangerous condition.

foul 3y ago

>You're spending time trying to annoy attackers that you should probably just ignore. s/ignore/block at firewall-level/ To me this article is of relevance nonetheless because It inspires me for messing with AI trainers by crafting an html page ZIP bomb full of ZIP-bomb-like embedded attachments (stylesheets, images, etc).

berkes 3y ago
I use fail2ban for this. I know what my servers run (and it's never PHP, Python microsoft/AD sharepoint etc, because I don't have services in these languages or systems) so I simply fail2ban everything that matches these broad items. Access "wp-admin"? Ban. Try "cron.php" ban. Looking for "phpmyadmin"? ban. It works reasonably well. These bots can switch to other IPs, or try again after the jailtime is lifted (20 mins in my case). But instead of a bot attempting thousands of endpoints, I get only one attempt. I initially configured this on a backend, that for reasons, had to handle every URL in the (Ruby, so heavy and slow) application layer: a bot trying common endpoints for popular CMSes and services, would put severe load on this application. Fail2ban was already there, blocking SSH, FTP, SMTP and whatnot, so I configured it to also handle these HTTP endpoints.
- tlavoie 3y ago
  Fail2ban can also work on ModSecurity logs, banning IPs that trigger a bunch of rules there. By the way, I have mine set to block for 12 hours, and some still come back. I suppose what I should look into is some sort of progressive extension to the delay.
  - berkes 3y ago
    A progressive jailtime is, indeed, a very good idea.
hannob 3y ago
No, ignore. WAFs that "block" "attacks" that ultimately should just cause a 404 error are part of the same mindset: That you think you "have to do something" about an attack that you should probably just ignore. They're also part of the mindset that security should mean adding more complexity, which is the opposite of what you should do.

ivancho 3y ago

No one is really worried, and no time is wasted when the outcome is occasional fun. There's no security holes to fix, there's just a bunch gnats poking at your server and you shoo them away, that's all.

hannob 3y ago
If your goal is "fun" then I guess that's fine. But don't pitch it as "defending" your website.
- esdf 3y ago
  It is fun to pitch it as defending a website. Now it’s fine

deleted 3y ago

[deleted]