I was reading Ubuntu Forum's warning about malicious commands and found this interesting gem:

:(){ :|:& };:

WARNING: The above code will crash your machine unless you have strict proc limits in place (which you probably don't) prompting a hard restart.

Consider this code similar to running sudo rm -rf /.

But what does that mean? Even with my programming experience I've never seen a command that cryptic that's not assembly language.

  • 17
    An additional point: this is really in no way similar to sudo rm -rf /. That command deletes all your files; this one just clogs your machine's resources until it becomes unusable and you have to restart. – jtbandes Jul 23 '10 at 4:56
  • @jtban: Then edit it out. Both pieces of code are what I would consider "dangerous" to run. Yes sudo rm -rf / is more dangerous but I've seen people execute this on remote servers "just wanted to see what it did" where you have a hard time restarting without access to a control panel. – Josh K Jul 23 '10 at 17:03
  • 7
    its an emotibomb :P – RCIX Jul 26 '10 at 2:32
  • Note it could be arbitrary_name(){ arbitrary_name|arbitrary_name& };arbitrary_name. The name : not only makes this command short and cryptic, but also turns a : builtin that does nothing into a function that does a lot. If you sneak its definition :(){ :|:& } into somebody else's environment and let it stay there, it will strike when the victim expects it the least. – Kamil Maciorowski Jul 7 '17 at 7:34

It's, as you said, a forkbomb. What it does is define a function, then call it. The function is called :.

Let's name it forkbomb so we can better see what's going on:

forkbomb(){ forkbomb|forkbomb& };forkbomb

As you can see, and probably guess from your programming experience, the first part is the function definition (forkbomb(){ ... }), and the very last : is where the function gets called (the ; just separates statements in Bash).

Now, what does this function do? If you're familiar with Bash, you'll know that the | character pipes the standard output of one command/program to the standard input of another. So basically, :|: starts up two instances of the function (this is where it "forks").

And then the magic: the & puts those commands in the background, allowing the original function to return, while each instance forks 'til the cows come home in the background, thus using up all your resources and taking down the system (unless it has limits imposed on it).

| improve this answer | |
  • 1
    Great answer! I didn't realize you could use : as a function name. The rename helps. Will accept in 3 minutes . – TheLQ Jul 23 '10 at 4:48
  • 1
    +1 Cool... Great explanation. This is like a stack overflow for an the OS taskswitcher. Does it actually crash the kernel or does it just eat up resources until it just becomes too unbearable to use? – Evan Plaice Jul 23 '10 at 6:24
  • I don't think it actually crashes the kernel, at least not directly. It just keeps creating exponentially more processes, each of which take up CPU & memory, and with the processor trying to handle all of them it really becomes impossible to use. It might be that the kernel eventually crashes under the load (I'm not sure), but it'll be unusable before then. – jtbandes Jul 23 '10 at 14:17
  • 3
    Don't forget to explain the final :, which actually executes the function! – Phoshi Jul 23 '10 at 16:59
  • @Phoshi: thought I did, but I'll edit to clarify! – jtbandes Jul 23 '10 at 18:29

Taken from the Wikipedia article Forkbomb:

:()      # define ':' -- whenever we say ':', do this:
{        # beginning of what to do when we say ':'
    :    # load another copy of the ':' function into memory...
    |    # ...and pipe its output to...
    :    # ...another copy of ':' function, which has to be loaded into memory
         # (therefore, ':|:' simply gets two copies of ':' loaded whenever ':' is called)
    &    # disown the functions -- if the first ':' is killed,
         #     all of the functions that it has started should NOT be auto-killed
}        # end of what to do when we say ':'
;        # Having defined ':', we should now...
:        # ...call ':', initiating a chain-reaction: each ':' will start two more.
| improve this answer | |

Broken down:

: () // Define ':' as a function. When you type ':' do the following
    : // Call ':' 
    | // Redirect output
    : // Into ':'
    & // Push process to the background
}; // End of ':' def
: // Now do ':'

Change : to bomb and you have:

bomb(){ bomb|bomb& };bomb

It's really quite elegant.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.