Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A better zip bomb

bamsoftware.com

Post reply on HN
Print view View original

21–30 of 138 posts

Re: A better zip bomb

#21

Post by amelius »

masklinn wrote: post #19
curiousgal wrote: post #4

Is there a way to automatically send this to SSH spammers/directory scanning bots?

This specifically exploits peculiarities of the PKZIP archival format (in combination with DEFLATE). SSH compression doesn't use zip, so unless the scanning bots also start downloading and processing / decompressing files they find on your honeypot, this is not going to apply (you can still use normal compression bombs to try and crash them: https://hackaday.com/2017/07/08/dropping-zip-bombs-on-vulner... )

Just add a file named "passwords.zip", or "creditcard_numbers.zip".

Re: A better zip bomb

#23

Post by gtsteve »

blodovnik wrote: post #22

Is there any way to detect these things before unzipping them?

It looks reasonably easy - the main thing you're looking for local file headers that are referenced multiple times by the central directory.

This is not invalid itself of course - some compression programs likely deduplicate files with this technique. But if it seems excessive, or it's the only thing in the archive then you've got a zip bomb.

You could probably come up with some techniques to obfuscate this of course but it'll increase the size of the archive.

Re: A better zip bomb

#24

Post by yreg »

gitgud wrote: post #15
r1ch wrote: post #2

Pretty powerful! Lots of breakage with things that touch this file. Simply downloading it in Chrome caused issues, Chrome began extracting it to a temp folder (presumably for some malware scanning?) and quickly started filling the disk. Windows 10 then began doing the same thing for Windows Defender, but some sane limits aborted it after a few seconds.

Why would Chrome automatically begin unzipping the file? I'm afraid to even download it now...

Safari always unzips any downloaded archive, wraps it in a folder and puts it into ~/Downloads.

I prefer this functionality as most of the time I do want to unarchive it. I can rearchive it later (or remember to use another browser) when I need to.

Re: A better zip bomb

#25

Post by rimliu »

yreg wrote: post #24
gitgud wrote: post #15

Earlier quoted context omitted.

Why would Chrome automatically begin unzipping the file? I'm afraid to even download it now...

Safari always unzips any downloaded archive, wraps it in a folder and puts it into ~/Downloads. I prefer this functionality as most of the time I do want to unarchive it. I can rearchive it later (or remember to use another browser) when I need to.

And if someone does not want this there is a checkbox in Preferences under "General": "Open 'safe' files after downloading". Unchecking it will prevent Safari form auto-extracting.

Re: A better zip bomb

#27

Post by jbverschoor »

curiousgal wrote: post #4

Is there a way to automatically send this to SSH spammers/directory scanning bots?

Hmmm.. wouldn't it be nice to add this to a honeypot webserver? if someone's looking for wp-login directories, just return zblg.zip. It would be nice if there's a 10TB option of about 0.5 - 1mb.

Re: A better zip bomb

#28

Post by bartread »

kekebo wrote: post #16
tpetry wrote: post #11

Earlier quoted context omitted.

That would be something new! A website crashing your browser because http or tls compression is sending „zip bombs“.

Not sure if your post is sarcastic but if not it already exists: https://blog.haschek.at/tools/bomb.php Usually aimed against bots though: https://hackaday.com/2017/07/08/dropping-zip-bombs-on-vulner...

Interesting. My immediate thought was, "that's awesome", followed by a plan to implement it on my own website, which gets regularly scanned for vulnerabilities.

But then two questions sprang to mind:

1. Does this eventually get your domain marked as potentially harmful in Firefox/Chrome/other browser?

2. What happens if you're fronted by a CDN like Cloudflare? I mean, I assume nginx won't be screwed over by this but, even then, will it infuriate your CDN provider and put you at risk of getting your account shut down.

My fit of vengeful glee has therefore been somewhat ablated for the time being.

Re: A better zip bomb

#29

Post by bestham »

yreg wrote: post #24
gitgud wrote: post #15

Earlier quoted context omitted.

Why would Chrome automatically begin unzipping the file? I'm afraid to even download it now...

Safari always unzips any downloaded archive, wraps it in a folder and puts it into ~/Downloads. I prefer this functionality as most of the time I do want to unarchive it. I can rearchive it later (or remember to use another browser) when I need to.

How can you for instance verify the checksum of the file when it's deleted?

Re: A better zip bomb

#30

Post by OrgNet »

bestham wrote: post #29
yreg wrote: post #24

Earlier quoted context omitted.

Safari always unzips any downloaded archive, wraps it in a folder and puts it into ~/Downloads. I prefer this functionality as most of the time I do want to unarchive it. I can rearchive it later (or remember to use another browser) when I need to.

How can you for instance verify the checksum of the file when it's deleted?

Wouldn't the decompression fail in that case?
Post reply on HN