Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A better zip bomb

bamsoftware.com

Post reply on HN
Print view View original

41–50 of 138 posts

Re: A better zip bomb

#41

Post by ddebernardy »

bestham wrote: post #29
yreg wrote: post #24

Earlier quoted context omitted.

Safari always unzips any downloaded archive, wraps it in a folder and puts it into ~/Downloads. I prefer this functionality as most of the time I do want to unarchive it. I can rearchive it later (or remember to use another browser) when I need to.

How can you for instance verify the checksum of the file when it's deleted?

You don't. Though to Apple's credit, users who are concerned with verifying checksums probably overlap with those that take cursory steps to harden their browser by, among various steps, disallowing Safari to open "safe" documents (that's what they're called in Safari's option).

Re: A better zip bomb

#43

Post by willvarfar »

A lot of modern formats - jar, Apple's pages, etc, come to mind - are just zip files with a different extension.

So which of these files which are really zip do browsers or mail programs auto-open? Anyone think of any?

Re: A better zip bomb

#45

Post by dddddaviddddd »

rimliu wrote: post #25
yreg wrote: post #24

Earlier quoted context omitted.

Safari always unzips any downloaded archive, wraps it in a folder and puts it into ~/Downloads. I prefer this functionality as most of the time I do want to unarchive it. I can rearchive it later (or remember to use another browser) when I need to.

And if someone does not want this there is a checkbox in Preferences under "General": "Open 'safe' files after downloading". Unchecking it will prevent Safari form auto-extracting.

Have had this set for many years, I recall some early macOS malware would be present in malformed PDF files that could be downloaded in the background of an infected page & the would open/execute automatically for users who had 'Open safe files' set.

Re: A better zip bomb

#46

Post by qqii »

gitgud wrote: post #15
r1ch wrote: post #2

Pretty powerful! Lots of breakage with things that touch this file. Simply downloading it in Chrome caused issues, Chrome began extracting it to a temp folder (presumably for some malware scanning?) and quickly started filling the disk. Windows 10 then began doing the same thing for Windows Defender, but some sane limits aborted it after a few seconds.

Why would Chrome automatically begin unzipping the file? I'm afraid to even download it now...

I accidentally downloaded it without realising this. I'd assume it performs malware scanning. Luckily I was able to end the process from the chrome task manager (shift+escape) without disrupting the rest of the browser.

Re: A better zip bomb

#47

Post by trickstra »

bestham wrote: post #29
yreg wrote: post #24

Earlier quoted context omitted.

Safari always unzips any downloaded archive, wraps it in a folder and puts it into ~/Downloads. I prefer this functionality as most of the time I do want to unarchive it. I can rearchive it later (or remember to use another browser) when I need to.

How can you for instance verify the checksum of the file when it's deleted?

Convenience over security

Re: A better zip bomb

#49

Post by IronBacon »

luckylion wrote: post #40
sametmax wrote: post #35

Earlier quoted context omitted.

1. You put it in a URL marked as "noindex-nofollow". Google will avoid it. You are supposed to only serve the page to identified spam bots anyway. 2. You create an exception so that they never cache the page and don't proxy this exact URL.

> 1. You put it in a URL marked as "noindex-nofollow". Better yet, mark it Disallow in robots.txt - to see "noindex, nofollow", they'd still need to request the URL, running the risk to be served with the bomb. > 2. You create an exception so that they never cache the page and don't proxy this exact URL. They work as reverse proxies on host-basis, I don't think you can exclude a single URL. CF at least will never cac…

I put, as a test and for fun, a "Disallow" entry in my robots.txt (with a campy name to be honest) and not a single crawler hit that dir in more than three years, don't know if others had the same experience.

Re: A better zip bomb

#50

Post by astazangasta »

yarg wrote: post #36
r1ch wrote: post #2

Pretty powerful! Lots of breakage with things that touch this file. Simply downloading it in Chrome caused issues, Chrome began extracting it to a temp folder (presumably for some malware scanning?) and quickly started filling the disk. Windows 10 then began doing the same thing for Windows Defender, but some sane limits aborted it after a few seconds.

If windows defender breaks scanning when it encounters a zip bomb, could that be used to mask malware later in the file?

In such a case could anything actually extract that malware and run it?
Post reply on HN