4 ms·

I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of

I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of script kiddies ddosing my poor little server. I switched to just identifying 'bad actors' who are clearly trying to do bad things and just banning their IP with firewall rules. That's becoming more challenging with IPV6 though. Edit: And for folks who write their own web pages, you can always create zip bombs that are links on a web page that don't show up for humans (white text on white background with no highlight on hover/click anchors). Bots download those things to have a look (so do crawlers and AI scrapers)

bjoli 1y ago
I am just banning large swaths of IPs. Banning most of Asia and the middle east reduced the amount of bad traffic by something like 98%.
- johnisgood 1y ago
  Same, using ipsets, and a systemd {service,timer} for updating the lists.
1970-01-01 1y ago
Why is it harder to firewall them with IPv6? I seems this would be the easier of the two to firewall.
- echoangle 1y ago
  Maybe it’s easier to circumvent because getting a new IPv6 address is easier than with IPv4?
- firesteelrain 1y ago
  I think they are suggesting the range of IPs to block is too high?
  - CBLT 1y ago
    Allow -> Tarpit -> Block should be done by ASN
    - lillecarl 1y ago
      You probably want to check how many ips/blocks a provider announces before blocking the entire thing. It's also not a common metric you can filter on in open firewalls since you must lookup and maintain a cache of IP to ASN, which has to be evicted and updated as blocks still move around.
- lillecarl 1y ago
  Manual banning is about the same since you just book /56 or bigger, entire providers or countries. Automated banning is harder, you'd probably want a heuristic system and look up info on IPs. IPv4 with NAT means you can "overban" too.
  - malfist 1y ago
    Why wouldn't something like fail2ban not work here? That's what it's built for and has been around for eons.
    - lillecarl 1y ago
      You don't always firewall 80/443 in Linux :(
    - ozim 1y ago
      Fun part was that fail2ban had RCE vulnerability. So you were more secure not running it now it should be fixed but can you be sure?
j_walter 1y ago
Check this out if you want to stop this behavior... https://github.com/skeeto/endlessh https://github.com/skeeto/endlessh
leephillips 1y ago
These links do show up for humans who might be using text browsers, (perhaps) screen readers, bookmarklets that list the links on a page, etc.
- ChuckMcM 1y ago
  true, but you can make the link text 'do not click this' or 'not a real link' to let them know. I'm not sure if crawlers have started using LLMs to check pages or not which would be a problem.
- alpaca128 1y ago
  Weird that text browsers just ignore all the attributes that hide elements. I get that they don't care about styling, but even a plain hidden attribute or aria-hidden are ignored.
grishka 1y ago
> you can always create zip bombs that are links on a web page that don't show up for humans I did a version of this with my form for requesting an account on my fediverse server. The problem I was having is that there exist these very unsophisticated bots that crawl the web and submit their very unsophisticated spam into every form they see that looks like it might publish it somewhere. First I added a simple captcha with distorted characters. This did stop many of the bots, but not all of them. Then, after reading the server log, I noticed that they only make three requests in a rapid succession: the page that contains the form, the captcha image, and then the POST request with the form data. They don't load neither the CSS nor the JS. So I added several more fields to the form and hid them with CSS. Submitting anything in these fields will fail the request and ban your session. I also modified the captcha, I made the image itself a CSS background, and made the src point to a transparent image instead. And just like that, spam has completely stopped, while real users noticed nothing.
- ChuckMcM 1y ago
  Oh that is great.
- anamexis 1y ago
  I did essentially the same thing. I have this input in a form: <label for="gb-email" class="nah" aria-hidden="true">Email:</label> <input id="gb-email" name="email" size="40" class="nah" tabindex="-1" aria-hidden="true" autocomplete="off" > With this CSS: .nah { opacity: 0; position: absolute; top: 0; left: 0; height: 0; width: 0; z-index: -1; } And any form submission with a value set for the email is blocked. It stopped 100% of the spam I was getting.
  - DuncanCoffee 1y ago
    Would this also stop users with automatic form filling enabled?
    - grishka 1y ago
flexagoon 1y ago
Automated systems like Cloudflare and stuff also have a list of bot IPs. I was recently setting up a selfhosted VPN and I had to change the IPv4 of the server like 20 times before I got an IP that wasn't banned on half the websites.
dsp_person 1y ago
> you can always create zip bombs that are links on a web page that don't show up for humans (white text on white background with no highlight on hover/click anchors) RIP screen reader users?
- some-guy 1y ago
  “aria-hidden” would spare those users, and possibly be ignored by the bots unless they are sophisticated.
gwd 1y ago
> I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of script kiddies ddosing my poor little server. This is the main reason I haven't installed zip bombs on my website already -- on the off chance I'd make someone angry and end up having to fend off a DDoS. Currently I have some URL patterns to which I'll return 418 with no content, just to save network / processing time (since if a real user encounters a 404 legitimately, I want it to have a nice webpage for them to look at). Should probably figure out how to wire that into fail2ban or something, but not a priority at the moment.
winrid 1y ago
fail2ban automates that and is in package managers

bjoli 1y ago

I am just banning large swaths of IPs. Banning most of Asia and the middle east reduced the amount of bad traffic by something like 98%.

johnisgood 1y ago
Same, using ipsets, and a systemd {service,timer} for updating the lists.

1970-01-01 1y ago

Why is it harder to firewall them with IPv6? I seems this would be the easier of the two to firewall.

echoangle 1y ago
Maybe it’s easier to circumvent because getting a new IPv6 address is easier than with IPv4?
firesteelrain 1y ago
I think they are suggesting the range of IPs to block is too high?
- CBLT 1y ago
  Allow -> Tarpit -> Block should be done by ASN
  - lillecarl 1y ago
    You probably want to check how many ips/blocks a provider announces before blocking the entire thing. It's also not a common metric you can filter on in open firewalls since you must lookup and maintain a cache of IP to ASN, which has to be evicted and updated as blocks still move around.
lillecarl 1y ago
Manual banning is about the same since you just book /56 or bigger, entire providers or countries. Automated banning is harder, you'd probably want a heuristic system and look up info on IPs. IPv4 with NAT means you can "overban" too.
- malfist 1y ago
  Why wouldn't something like fail2ban not work here? That's what it's built for and has been around for eons.
  - lillecarl 1y ago
    You don't always firewall 80/443 in Linux :(
  - ozim 1y ago
    Fun part was that fail2ban had RCE vulnerability. So you were more secure not running it now it should be fixed but can you be sure?

j_walter 1y ago

Check this out if you want to stop this behavior... https://github.com/skeeto/endlessh https://github.com/skeeto/endlessh

leephillips 1y ago

These links do show up for humans who might be using text browsers, (perhaps) screen readers, bookmarklets that list the links on a page, etc.

ChuckMcM 1y ago
true, but you can make the link text 'do not click this' or 'not a real link' to let them know. I'm not sure if crawlers have started using LLMs to check pages or not which would be a problem.
alpaca128 1y ago
Weird that text browsers just ignore all the attributes that hide elements. I get that they don't care about styling, but even a plain hidden attribute or aria-hidden are ignored.

grishka 1y ago

> you can always create zip bombs that are links on a web page that don't show up for humans I did a version of this with my form for requesting an account on my fediverse server. The problem I was having is that there exist these very unsophisticated bots that crawl the web and submit their very unsophisticated spam into every form they see that looks like it might publish it somewhere. First I added a simple captcha with distorted characters. This did stop many of the bots, but not all of them. Then, after reading the server log, I noticed that they only make three requests in a rapid succession: the page that contains the form, the captcha image, and then the POST request with the form data. They don't load neither the CSS nor the JS. So I added several more fields to the form and hid them with CSS. Submitting anything in these fields will fail the request and ban your session. I also modified the captcha, I made the image itself a CSS background, and made the src point to a transparent image instead. And just like that, spam has completely stopped, while real users noticed nothing.

ChuckMcM 1y ago
Oh that is great.
anamexis 1y ago
I did essentially the same thing. I have this input in a form: <label for="gb-email" class="nah" aria-hidden="true">Email:</label> <input id="gb-email" name="email" size="40" class="nah" tabindex="-1" aria-hidden="true" autocomplete="off" > With this CSS: .nah { opacity: 0; position: absolute; top: 0; left: 0; height: 0; width: 0; z-index: -1; } And any form submission with a value set for the email is blocked. It stopped 100% of the spam I was getting.
- DuncanCoffee 1y ago
  Would this also stop users with automatic form filling enabled?
  - grishka 1y ago

flexagoon 1y ago

Automated systems like Cloudflare and stuff also have a list of bot IPs. I was recently setting up a selfhosted VPN and I had to change the IPv4 of the server like 20 times before I got an IP that wasn't banned on half the websites.

dsp_person 1y ago

> you can always create zip bombs that are links on a web page that don't show up for humans (white text on white background with no highlight on hover/click anchors) RIP screen reader users?

some-guy 1y ago
“aria-hidden” would spare those users, and possibly be ignored by the bots unless they are sophisticated.

gwd 1y ago

> I sort of did this with ssh where I figured out how to crash an ssh client that was trying to guess the root password. What I got for my trouble was a number of script kiddies ddosing my poor little server. This is the main reason I haven't installed zip bombs on my website already -- on the off chance I'd make someone angry and end up having to fend off a DDoS. Currently I have some URL patterns to which I'll return 418 with no content, just to save network / processing time (since if a real user encounters a 404 legitimately, I want it to have a nice webpage for them to look at). Should probably figure out how to wire that into fail2ban or something, but not a priority at the moment.

winrid 1y ago

fail2ban automates that and is in package managers