TL;DR
A fork bomb is a denial-of-service (DoS) attack in which a tiny piece of code causes a process to replicate endlessly, exhausting system resources until the server crashes. While the threat dates back to 1969, it remains relevant today. Key defenses include limiting the maximum number of processes per user and capping memory use per process in Linux environments. If hit, recovery requires a full server reset and removal of all malicious code instances.
How does a fork bomb work?
Imagine opening hundreds or even thousands of instances of a process on your computer. The fan would whir, performance would lag, and eventually, your device would crash. A fork bomb works in much the same way.
How does fork bomb code replicate?
Fork-bomb code creates a copy of a program. Once the new instance is running, the fork happens again. This process can happen indefinitely or until it exhausts all available memory. A DoS attack like this can be devastating.
Implementing fork bombs is relatively easy for an experienced hacker. We won't go into detail here (since we don't want to give anyone the wrong idea), but often, just a tiny bit of code is required.
Can you prevent a fork bomb?
You can't sit over the shoulder of every developer and keep them from including code that could harm you. But you can do two important things to ensure that a fork bomb is less likely to take your system down.
- Limit the maximum number of processes per user: In Linux, restricting how many processes a single user can own prevents an attack from gaining momentum.
- Cap memory use per process: Setting a memory ceiling per process allows you to detect and deny suspicious duplication before it depletes server capacity.
You can also limit memory use per process. If a process needs more than the limit you've set, you're likely dealing with a duplication, and you can deny execution right away. This simple step can also keep a fork bomb from depleting server capacity.
What should you do if a fork bomb hits your system?
If an attacker hits you with a fork bomb, you will need to reset your server. And unfortunately, you'll need to remove every instance of the code to make the attack stop.
- Reset your server.
- Identify and remove every instance of the fork bomb code.
If you're looking for even more ways to protect yourself in a Linux environment, consider our white paper about enforcing least-privilege access for Linux servers. And don't be afraid to reach out to Okta if you have questions.
Frequently asked questions
What exactly happens during a fork bomb attack?
A fork bomb works by executing a tiny piece of code that creates a copy of itself. Each new copy does the same, causing an exponential chain reaction that rapidly consumes all available system memory and processing resources until the server crashes.
How long have fork bomb attacks been around?
Fork bombs are not a modern invention — one of the earliest known instances of this type of attack dates back to 1969, demonstrating that even decades-old techniques can still be effective against unprepared systems.
How can I limit the risk of a fork bomb on a Linux server?
Two practical defenses exist: first, restrict the maximum number of processes any single user can own, which prevents the replication chain from scaling; second, set a memory usage cap per process so that any process exceeding that threshold can be denied execution before it causes damage.
What should I do if my server is hit by a fork bomb?
Recovery requires two steps: reset the affected server, and then carefully identify and remove every instance of the malicious code. Leaving even one copy of the code in place means the attack can resume.
Is it difficult for an attacker to deploy a fork bomb?
For an experienced attacker, implementing a fork bomb is relatively straightforward — often requiring only a very small amount of code. This low barrier to entry makes it important to have preventive controls in place rather than relying solely on detection.
Where can I learn more about protecting Linux servers from attacks like fork bombs?
Okta offers a white paper on enforcing least-privilege access for Linux servers, which covers additional strategies for reducing the attack surface and limiting the damage any single compromised process or user can cause.
References
Understanding Bash Fork Bomb Code. (January 2019). NixCraft.
Security Against Fork Bomb Attack in Linux-Based Systems. (April 2019). International Journal of Research in Advent Technology.
