Friday, August 2, 2013

Fork bomb - DoS attack


A form of DoS attack under unix-like systems called fork bomb, is simple yet effective (if no user resource limit is set) attack which is mainly interesting by it's short implementation.

Forking the process (man 2 fork) means creating a child process which is exact duplicate of it's parent with some key points.

Forked process has it's on process ID, it's own memory for stack, child doesn't inherit parents memory locks and some other not so important (at this point) details unique to child processes.

Key point is that by forking a process we have exact copy of parent process, this is useful for many things like server-client communication and so on ... Another important thing to know under unix-like systems is piping (pipe - used for process communication)

example: (pipe)

cat text.txt | grep "crawl"

This simple command means: execute cat command and pipe it through grep (send cat output as grep input and execute grep "crawl".

So let's get back to our simple fork bomb:

:(){ :|:& };:

Where ":" is function name, and :|: means we are piping : to itself and & means to do it in background.
Last ":" mans start execution of this simple function.

Note that if you try to execute this simple function it will freeze your machine probably in less then a second depending on memory available (if no user memory limit is set).

For those interested in linux programming, there is a great book know as APUE (advanced programming in the unix environment)



  

No comments:

Post a Comment