What Is A Fork Bomb?

Date First Published: 23rd June 2023

Topic: Cybersecurity

Subtopic: Threats To Individuals

Article Type: Computer Terms & Definitions

Difficulty Level: 6/10

Learn about what a fork bomb is in this article.

A fork bomb, also known as a rabbit virus, is a type of DoS attack where an existing process is taken and continuously replicated to start new processes, which will eventually cause the system to become overloaded and make it unable to respond to legitimate requests. It is basically the practice of creating forks and forks of processes until the system does not have any more resources left.

Unlike logic bombs and time bombs, fork bombs have no payload and do their damage by replicating themselves to use up all available system resources. Also, they are not like traditional DoS attacks where the requests come from outside the network. Instead, they come from the target network.

Fork bombs do not usually require much technical or coding knowledge for attackers to create. It is even possible for attackers to crash a computer and make it unresponsive just by writing a single line of code. Attackers often use the Python, Java, C, and Ruby programming languages to create a malicious script for a fork bomb attack.

Effects Of Fork Bomb Attacks

Fork bomb attacks block legitimate programs from running and prevent any new processes from being created, temporarily making the system unusable. Since all available resources are used, including the CPU and RAM, this can result in the operating system crashing or freezing until the computer is restarted. A computer affected by a fork bomb attack will often ignore keyboard inputs and any attempts to log out, which basically locks it out.

If work was unsaved, this can lead to a loss of important data, and cause huge delays in the time work is completed. If a fork bomb attack affects a web server, it could lead to financial losses and reputational harm for businesses due to unscheduled downtime.

Which Systems Are Vulnerable To Fork Bomb Attacks?

Fork bomb attacks target Linux and Unix-like operating systems because they can fork (copy) other processes. Windows cannot fork an existing process and is not vulnerable to traditional fork bomb attacks. In order for fork bomb attacks to succeed on Windows, complex programming is required for a set of processes to be very quickly created. Since Windows operating systems do not have the same functionality as the Unix fork system call, a fork bomb must create a new process instead of forking an existing one.

Prevention

One way of preventing fork bombs is by putting a limit on the number of processes that a user can create on the system at once. For example, setting the maximum number of processes open to 30 would cause the fork bomb to reach the 30 process limit quickly and prevent it from opening any new processes. Not running untrusted software and scripts can also prevent these types of attacks as they may contain a fork bomb designed to crash the system. Even with modern operating systems, there is no way to completely prevent fork bomb attacks.

Traditional antivirus software might not be able to protect against fork bomb attacks because they may only contain a single line of code and do not use file formats that antiviruses often scan. Fork bombs often look quite light and look like a text file, which will rarely lead to them being detected by antiviruses.

History

In 1978, an early variant called "wabbit" was reported to run on System/360, which made copies of processes nonstop to use up all of its resources. Any script like it could be disguised as a useful file sent as an email attachment. When opened, the fork bomb attack would be launched. It may have come from a similar attack called RABBITS reported in 1969 on a Burroughs 5500 at the University of Washington.

Comments