The fork bomb is a form of denial of service attack against a computer system. It relies on the assumption that the number of programs and processes which may be simultaneously executed on a computer has a limit. A fork bomb works by creating a large number of processes very quickly in order to saturate the available space in the list of processes kept by the computer’s operating system. Once saturated, no new programs may be started until another terminates, which is not likely since the instances of the bomb program are each waiting to do just that. The system becomes much more difficult (s l o w), or even impossible, to use. The name wabbit (probably from Elmer Fudd’s version of ‘rabbit’ in the Bugs Bunny cartoons) has been used for such malicious programs as their malicious characteristic is to multiply quickly. It is possible to add aditional malign intent to such programs, as for instance to kill non-wabbit processes or delete files, in which case the program will typically no longer be regarded as a wabbit, since its most malign property would not then be mere multiplication.
Difficulty of cure
Once a successful fork bomb has been activated in a system, it may not be possible to resume normal operation without rebooting it, as the only solution to a fork bomb is to destroy all instances of it. This is often not possible since trying to use a program to kill the rogue processes requires another process be created, which may not be possible if there are no emply slots in the process table or space in memory structures used when a process is installed on the system.
Difficulty of prevention
The way in which a fork bomb functions is to spawn as many processes as possible; thus, to prevent a fork bomb one simply needs to limit the number of processes which may be produced by a single program or user. By only allowing untrusted users to run a relatively small number of processes, the danger of a fork bomb, malicious or unintentional, is reduced. However, this does not prevent the possibility of a group of users collaborating to consume process slots.
(Wikipedia)
Leave a Reply