A IT-Sec Christmas / New Year again? 🤔
Is this: "Large ZIP files trigger spurious possible zip bomb errors" → https://gitlab.archlinux.org/archlinux/packaging/packages/unzip/-/issues/3
…this again → https://www.bamsoftware.com/hacks/zipbomb/
…or not or what? 😬
#zip #itsec #zipcar #itsecurity #compras #opensource #basic #ITbasics #grml #rudimental #issues #itissues #xkcd #zipbomb
Ok I can confirm that gzip bombs work great!
I almost crashed my PC Firefox testing my own bomb.
I got inspiration from @lord 's article: https://lord.re/en/posts/139-gzip-bomb-nginx/ for the bomb
and from @robin 's article https://icewind.nl/entry/nixos-add-nginx-options/
To automate adding the bomb by default to every virtual host I have (with NixOS).
You can find the result here: https://framagit.org/ppom/nixos/-/commit/9a53e5de1df2ed6a3548d5ae94a8ac1178787248
I was browsing GoAccess to see which 404 errors i was serving. There is more than 18.000 connections to wp-admin.php which is the webadmin of WordPress. There is also many other attempts to different other php things, nothing very legit. It's a chance i use Hugo which is a static site generator. On this webserver there is no PHP or any other dynamic language. Webpages here are only simple plain text files without any logic, the server just read the files and send them.
Eu uso "bombas zip" para proteger meu servidor
"Uma bomba zip é um arquivo compactado relativamente pequeno que pode se expandir em um arquivo muito grande, capaz de sobrecarregar uma máquina.Neste blog, frequentemente recebo bots que procuram vulnerabilidades de segurança, os quais eu ignoro na maioria das vezes. Mas quando detecto que eles estão tentando injetar ataques maliciosos ou sondando uma resposta, eu retorno uma resposta 200 OK e lhes sirvo uma resposta gzip. Eu vario de um arquivo de 1 MB a 10 MB, que eles ficam felizes em ingestão. Na maioria das vezes, quando fazem isso, nunca mais ouço falar deles. Por quê? Bem, isso porque eles travam logo após ingestão do arquivo.
O que acontece é que eles recebem o arquivo, leem o cabeçalho que os instrui que se trata de um arquivo compactado. Então, eles tentam descompactar o arquivo de 1 MB para encontrar o conteúdo que estão procurando. Mas o arquivo se expande, se expande e se expande, até que eles ficam sem memória e o servidor trava. O arquivo de 1 MB se descompacta em um arquivo de 1 GB. Isso é mais do que suficiente para derrubar a maioria dos bots. No entanto, para aqueles scripts incômodos que não param, eu lhes envio o arquivo de 10 MB. Este se descompacta em 10 GB e mata instantaneamente o script.
Antes de lhe dizer como criar uma bomba zip, devo avisá-lo que você pode potencialmente travar e destruir seu próprio dispositivo. Continue por sua própria conta e risco. Então, aqui está como criamos a bomba zip:
A valid HTML zip bomb, https://ache.one/notes/html_zip_bomb by @ache
The article shows how to create an HTML zip bomb for AI crawlers not respecting the `robots.txt` file.
A zip bomb is a huge file (like 10Gib), that once compressed, has a reasonable size like 10Mib. An AI crawler will uncompressed it and will see all its memory being consumed, leading to a possible crash.
That’s an effective way to counter-attack disrespectful AI crawlers.
<h1 id="a-valid-html-zip-bomb"><a tabindex="0" class="anchor" href="/notes/html_zip_bomb">A valid HTML zip bomb</a></h1><p><img src="/notes/res/zip_bomb_file.svg" alt="Illustration d'une bombe zip" height="150" width="150"> Many sites have been affected by the aggressiveness of web crawlers designed to improve LLMs. I’ve been relatively spared, but since the phenomenon started, I've been looking for a solution to implement. Today, I present a zip bomb <a href="/bomb.html">gzip and brotli that is valid HTML</a>.</p><a href="/notes/html_zip_bomb"></a>
The initial problem is the aggressiveness of #LLM web #crawlers that don't respect "robots.txt". The first idea that comes to mind is IP #blocking . However, web crawlers have circumvented this restriction by using individual IPs via specialized #botnets .
Another solution is therefore to exhaust the resources of the harvesters. With a #zipbomb , we attempt to #exhaust their #RAM .
<h1 id="a-valid-html-zip-bomb"><a tabindex="0" class="anchor" href="/notes/html_zip_bomb">A valid HTML zip bomb</a></h1><p><img src="/notes/res/zip_bomb_file.svg" alt="Illustration d'une bombe zip" height="150" width="150"> Many sites have been affected by the aggressiveness of web crawlers designed to improve LLMs. I’ve been relatively spared, but since the phenomenon started, I've been looking for a solution to implement. Today, I present a zip bomb <a href="/bomb.html">gzip and brotli that is valid HTML</a>.</p><a href="/notes/html_zip_bomb"></a>
Sentient Beings Welcome!
Others please read this carefully.
Any attempt by bots, automated accounts and AI to follow or otherwise scrape this account despite #nobot #noai hashtag will be answered by me accordingly and then do not say you have not been warned ..
I work for sentient beings and not for machines of capitalists. Stay away!
I use Zip Bombs to Protect my Server
https://idiallo.com/blog/zipbomb-protection
The majority of the traffic on the web is from bots. For the most part, these bots are used to discover new content. These are RSS Feed readers, search engines crawling your content, or nowadays AI bots
𝕂𝚞𝚋𝚒𝚔ℙ𝚒𝚡𝚎𝚕
Hacker News
ppom
veroandi_br
kwayk42
Ivan Enderlin 🦀
Wilfredo 💬
grobi
Aubreader Masto
TiTiNoNero 