fork bomb

Around 1978, an early variant of a fork bomb called wabbit was reported to run on a System/360. It may have descended from a similar attack called RABBITS reported from 1969 on a Burroughs 5500 at the University of Washington.{{Cite web|url=http://catb.org/~esr/jargon/html/W/wabbit.html|access-date=October 15, 2013|title=wabbit|publisher=The Jargon Lexicon|first=Eric S.|last=Raymond|author-link=Eric S. Raymond|date=October 1, 2004|archive-date=May 15, 2012|archive-url=https://web.archive.org/web/20120515224853/http://www.catb.org/~esr/jargon/html/W/wabbit.html|url-status=live}}

File:Forkbomb on Ubuntu.png

Fork bombs operate both by consuming CPU time in the process of forking, and by saturating the operating system's process table.{{cite book |first=Nong |last=Ye |year=2008 |page=16 |title=Secure Computer and Network Systems: Modeling, Analysis and Design |publisher=John Wiley & Sons |isbn=978-0470023242}}{{cite book |first=Dong |last=Jielin |year=2007 |page=200 |title=Network Dictionary |isbn=978-1602670006}} A basic implementation of a fork bomb is an infinite loop that repeatedly launches new copies of itself.

In Unix-like operating systems, fork bombs are generally written to use the fork system call. As forked processes are also copies of the first program, once they resume execution from the next address at the frame pointer, they continue forking endlessly within their own copy of the same infinite loop. this has the effect of causing an exponential growth in processes. As modern Unix systems generally use a copy-on-write resource management technique when forking new processes,{{cite book |author-first=Dhananjay M. |author-last=Dhamdhere |author-link=Dhananjay M. Dhamdhere |date=2006 |page=285 |title=Operating Systems: A Concept-based Approach |publisher=McGraw-Hill Higher Education |isbn=0-07-061194-7}} a fork bomb generally will not saturate such a system's memory.

Microsoft Windows operating systems do not have an equivalent functionality to the Unix fork system call;{{cite book |first=Mark |last=Hammond |year=2000 |page=35 |title=Python Programming On Win32: Help for Windows Programmers |publisher="O'Reilly Media, Inc." |isbn=1565926218}} a fork bomb on such an operating system must therefore create a new process instead of forking from an existing one, such as with batch echo %0^|%0 > $_.cmd & $_. In this batch script, %0|%0 is written to $_.cmd, which is then executed by & $_.{{Cite AV media |url=https://www.youtube.com/watch?v=SD_bg2VRTAc |title=@echo.%0^{{!}}%0›$^_^.c^md&$_›nul |date=2024-06-26 |last=Enderman |access-date=2024-06-30 |via=YouTube}}

A classic example of a fork bomb is one written in Unix shell :(){ :|:& };:, possibly dating back to 1999,{{cite newsgroup | author = Michal Zalewski | date = 1999-08-19 | newsgroup = muc.lists.bugtraq | url = https://groups.google.com/g/muc.lists.bugtraq/c/CH1RVi3TWZo | access-date=2022-12-10 | title = [RHSA-1999:028-01] Buffer overflow in libtermcap tgetent() | quote = bash$ :(){ :|:&};:}}} which can be more easily understood as

fork() {

fork | fork &

}

fork

In it, a function is defined (fork()) as calling itself (fork), then piping (|) its result into itself, all in a background job (&).

The code using a colon : as the function name is not valid in a shell as defined by POSIX, which only permits alphanumeric characters and underscores in function names.{{Cite web | url = https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap03.html#tag_03_235 | publisher = The Open Group/IEEE | title = The Open Group Base Specifications Issue 7, 2018 edition IEEE Std 1003.1™-2017 Section 3.235 | quote = Name: In the shell command language, a word consisting solely of underscores, digits, and alphabetics from the portable character set. The first character of a name is not a digit.}} However, its usage is allowed in GNU Bash as an extension.{{Cite web | url = https://www.gnu.org/software/bash/manual/bash.html#Shell-Functions | title = The GNU Bash Reference Manual, Section 3.3| access-date = 2022-12-11 | quote = When the shell is in POSIX mode (see Bash POSIX Mode), fname must be a valid shell name and may not be the same as one of the special builtins (see Special Builtins). In default mode, a function name can be any unquoted shell word that does not contain ‘$’.}}

As a fork bomb's mode of operation is entirely encapsulated by creating new processes, one way of preventing a fork bomb from severely affecting the entire system is to limit the maximum number of processes that a single user may own. On Linux, this can be achieved by using the ulimit utility; for example, the command ulimit -u 30 would limit the affected user to a maximum of thirty owned processes.{{cite book |last=Cooper |first=Mendel |year=2005 |title=Advanced Bash Scripting Guide |isbn=1430319305 |pages=305–306}}

On PAM-enabled systems, this limit can also be set in /etc/security/limits.conf,{{cite book |last=Soyinka |first=Wale |year=2012 |title=Linux Administration: A Beginners Guide |isbn=978-0071767590 |pages=364–365|publisher=McGraw Hill Professional }}

and on *BSD, the system administrator can put limits in /etc/login.conf.{{cite book |last=Lucas |first=Michael W. |year=2007 |title=Absolute FreeBSD: The Complete Guide to FreeBSD |isbn=978-1593271510 |pages=198–199|publisher=No Starch Press }}

Modern Linux systems also allow finer-grained fork bomb prevention through cgroups and process number (PID) controllers.{{cite web |date=2019-10-08 |title=Process Number Controller in Documentation/ as appeared in Linux kernel 5.3 |url=https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/pids.html |access-date=October 8, 2019 |archive-date=October 8, 2019 |archive-url=https://web.archive.org/web/20191008121821/https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/pids.html |url-status=live }}

• Zip bomb
• Billion laughs attack
• Deadlock (computer science)
• Logic bomb
• Time bomb (software)

{{Reflist}}

• {{GitHub|aaronryank/fork-bomb|Fork bomb examples}}

{{Information security}}

{{DEFAULTSORT:Fork bomb}}

Category:Denial-of-service attacks

Category:Process (computing)