Hello, guys, in this video, I'll show you a very interesting attack of type Denial-of-service called
fork bump or rabbit virus, pay special attention to it because it can be executed by a non-privileged
user and can bring down and make unusable the entire Linux system.
I can honestly say that it was a very unpleasant surprise for me to test it on the many Linux distributions
and see that it works on all of them.
In a matter of seconds and with only one line of code, a normal user will hack the system.
Let's get started and see if the attack life, but please don't test it on a production system because
it will make it unusable or on it in a vault or on a test system.
To which you have physical access.
Be prepared for a crash and a force reboot of your system. On the latest version of Ubuntu is a non-privileged
user.
And this is the key here.
I'm creating a new Bash script.
And inside the script, I'm adding a single line of code: $0 && $0 &
And that's all.
Don't worry, I'll explain it to you in detail later.
Now I'm saving the file, setting the execution permission and running the script as usual.
In a few seconds, the system will become unusable, I cannot even move the mouse anymore and there
is no chance to stop it.
I try to run the ls comment, but it doesn't work.
The system has crashed, the script has caused resource starvation, crashing the system, the only
way to get out of this is to force reboot the system using the power of or reboot button.
I'm stopping the VM and then starting it again so I can regain access.
I'm pausing the recording until it starts so I can log in.
The system has restarted.
Let's take a deeper look at the script and what has happened.
This is the script.
It performs a denial of service attack that makes use of the fork system call to create an infinite
number of processes.
So zero is a special variable that represents the script itself, so the script is running itself recursively
two times and the is going in the background for another recursive call.
It does this indefinitely.
Ampersand at the end puts the process in the background so a new child processes cannot die at all and
start eating the system resources.
Let's see how to prevent such a fork bump.
If you run ulimit -u, you will see the number of available processes for the current user.
This value is very large.
You can also run ulimit -a to see a lot of limits available to the shell and the processes it creates.
To prevent the fork
bomb we'll lower for the number of processes the user can start.
The processes cannot continuously replicate themselves: as root I'm opening the following file:
/etc/security/limits.conf
And at the end, I'm adding the following line, the name of the user, student, hard, nproc and
the value, for example, two thousand, this will limit the user processes to two thousand.
Please don't set to low the ulimit numbers.
By doing so, you will prevent the user from working on the system.
And you can also add such a limit for a group as follows: @ the name of the group, for example, admins
Hard, nproc and the value, for example, four thousand, I'm saving the file, the new limits will
be available for new sessions, so I'm logging out and then logging in again.
I'm opening a shell and running the script again.
We see that the system is not becoming unavailable and we can work on it, see this message, which
practically means that the shell is not allowed to create the new processes.
But the system is not unusable.
I can work on it.
Congratulations, you've just mitigated the fork bomb attack on Linux and made your system more secure.