Is there any way to detect these things before unzipping them?
I run unzip -l, it tells you which files are how big are inside.
A better zip bomb
51–60 of 138 posts
Re: A better zip bomb
#52Pretty powerful! Lots of breakage with things that touch this file. Simply downloading it in Chrome caused issues, Chrome began extracting it to a temp folder (presumably for some malware scanning?) and quickly started filling the disk. Windows 10 then began doing the same thing for Windows Defender, but some sane limits aborted it after a few seconds.
If windows defender breaks scanning when it encounters a zip bomb, could that be used to mask malware later in the file?
It probably flags it as unsafe and triggers smart screen. Meaning you have to go out of your way to use the file.
As for malware that would be unzipped when using an external zip file; first you would need to trigger the zip bomb on defender but not the external tool, and second defender will still scan the individual files getting unziped by that tool.
Re: A better zip bomb
#53Earlier quoted context omitted.
Why would Chrome automatically begin unzipping the file? I'm afraid to even download it now...
I accidentally downloaded it without realising this. I'd assume it performs malware scanning. Luckily I was able to end the process from the chrome task manager (shift+escape) without disrupting the rest of the browser.
Or it could do the same as Safari, open "safe files" by default (which for zip archives means "decompress them").
Re: A better zip bomb
#54Not currently detected by anyone, according to VirusTotal: https://www.virustotal.com/gui/url/d98f43e8a91f1ddb4980d4602...
Re: A better zip bomb
#55Earlier quoted context omitted.
Wouldn't the decompression fail in that case?
The idea is to publish the checksum of the archive separately. After downloading the archive you can calculate its checksum and compare with the published checksum. If they differ you known something is up (possibly bad). When a browser helpfully decompresses the archive you can no longer perform this check.
If it fails to decompress because the file is corrupt, the browser would more then likely keep the archive?
But if someone replaces the archive with a malicious file that decompress normally, he will also probably change the listed checksum on the download page....
Re: A better zip bomb
#56Earlier quoted context omitted.
If windows defender breaks scanning when it encounters a zip bomb, could that be used to mask malware later in the file?
In such a case could anything actually extract that malware and run it?
Sure, as long as that other thing knew not to treat the file as a zip, or had a mechanism to skip over or blank out the first chunk of the file.
I wonder how Windows Defender would treat something that looked like a self-extracting archive? Perhaps the archive portion could be this zip bomb affair, but the executable portion had a small change in it to bypass that and do something else nefarious instead, eg hand execution control to a point later in the file.
Re: A better zip bomb
#57i have a Nigerian prince in my inbox why might be in for a treat....
In my time as a scambaiter, one of the most important lessons taught to everyone was: "Don't weaponize them"
Re: A better zip bomb
#58Are you able to theoretically look at compressed data without size Metadata and estimate its final size without actually uncompressing it?
Re: A better zip bomb
#59lovely... its on my "collection" along with the "one square kilometer" pdf : https://www.librarystack.org/one-square-kilometer-for-walter...
Add the USB kill there too.
Re: A better zip bomb
#60Earlier quoted context omitted.
How can you for instance verify the checksum of the file when it's deleted?
You don't. Though to Apple's credit, users who are concerned with verifying checksums probably overlap with those that take cursory steps to harden their browser by, among various steps, disallowing Safari to open "safe" documents (that's what they're called in Safari's option).
Would it be prejudice to think that the checksum verifying users are not using safari?