555
I use Zip Bombs to Protect my Server (idiallo.com)
submitted 4 days ago by some_guy@lemmy.sdf.org to c/technology@lemmy.world
98 comments fedilink hide all child comments

The one-liner:

dd if=/dev/zero bs=1G count=10 | gzip -c > 10GB.gz

This is brilliant.

(page 2) 48 comments
sorted by: hot top controversial new old
[-] melroy@kbin.melroy.org 11 points 4 days ago

let me try..

[-] melroy@kbin.melroy.org 11 points 4 days ago

Looks fine to me. Only 1 CPU core I think was 100%.

10+0 records in
10+0 records out
10737418240 bytes (11 GB, 10 GiB) copied, 28,0695 s, 383 MB/s
[-] melroy@kbin.melroy.org 11 points 4 days ago

ow.. now the idea is to unzip it right?

nice idea:

if (ipIsBlackListed() || isMalicious()) {
    header("Content-Encoding: deflate, gzip");
    header("Content-Length: "+ filesize(ZIP_BOMB_FILE_10G)); // 10 MB
    readfile(ZIP_BOMB_FILE_10G);
    exit;
}
[-] mbirth@lemmy.ml 7 points 4 days ago

Might need some

if (ob_get_level()) ob_end_clean();

before the readfile. 😉

[-] billwashere@lemmy.world 5 points 3 days ago

I want to know he they built that visualization

[-] UnbrokenTaco@lemm.ee 6 points 4 days ago

Interesting. I wonder how long it takes until most bots adapt to this type of "reverse DoS".

[-] sugar_in_your_tea@sh.itjust.works 6 points 3 days ago

Then we'll just be more clever as well. It's an arms race after all.

[-] Aatube@kbin.melroy.org 4 points 4 days ago

macOS compresses its memory. Does this mean we'll see bots running on macOS now?

[-] UnbrokenTaco@lemm.ee 6 points 4 days ago

Is it immune to zip bombs?

[-] Aatube@kbin.melroy.org 3 points 4 days ago

All I know is it compresses memory. The mechanism mentioned here for ZIP bombs to crash bots is to fill up memory fast with repeating zeroes.

[-] Guidy@lemmy.world 5 points 4 days ago

I thought it was to fill all available storage. Maybe it’s both?

[-] tdawg@lemmy.world 3 points 4 days ago

No, but that's an interesting question. Ultimately it probably comes down to hardware specs. Or depending on the particular bot and it's env the spec of the container it's running in

Even with macos's style of compressing inactive memory pages you'll still have a hard cap that can be reached with the same technique (just with a larger uncompressed file)

[-] 4am@lemm.ee 2 points 3 days ago

How long would it take to be considered an inactive memory page? Does OOM conditions immediately trigger compression, or would the process die first?

[-] tdawg@lemmy.world 1 points 3 days ago

So I'm not an expert but my understanding is the flow is roughly:

  1. Available memory gets low
  2. Compress based on LRU rules
  3. Use swap
  4. OOM

So it's more meant to be preventative afaik

load more comments (2 replies)
[-] fmstrat@lemmy.nowsci.com 2 points 3 days ago

This is why I use things like Docusaurus to generate static sites. Vulnerability injections are pretty hard when there's no code to inject into.

[-] frozenpopsicle@lemmy.dbzer0.com 1 points 3 days ago

❤️

load more comments
view more: ‹ prev next ›
this post was submitted on 29 Apr 2025
555 points (100.0% liked)

Technology

69658 readers
2307 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
L4s@hackingne.ws