A better zip bomb

Post by hinkley » Fri, Jul 05, 2019, 1:24 AM UTC

deathanatos wrote: post #118

hinkley wrote: post #99

Earlier quoted context omitted.

See, I don’t understand this. Zip is a streamable format. I don’t understand why you would extract the archive before checking the contents? I worked on productizing a code signing tool a while back and I believe the first thing I did after we got it working was change it so nothing touched the disk until after the signature had been validated (in this case the signers had business relationships with each other. This…

> Zip is a streamable format Not really. For a normal, created in one-shot ZIP, yes. But the types of ZIPs in the article are going to act differently if you tried streaming them. The core idea of the article is overlapping the various files within the ZIP, s.t. they share bytes. But this is only apparent if you're using the central directory, which you can't if you're streaming, since it appears after all the data.…

Post by yarg » Fri, Jul 05, 2019, 2:56 AM UTC

ZephyrP wrote: post #119

yarg wrote: post #36

Earlier quoted context omitted.

If windows defender breaks scanning when it encounters a zip bomb, could that be used to mask malware later in the file?

I work at a threat intelligence firm which provides services for aggregating desktop antivirus engines & specialized malware detection tooling; I've submitted dozens of public and manually constructed compression-bombs for analysis (including this one). Many antivirus engines, even very small vendors, handle this case better than you might imagine.

Post by charonn0 » Fri, Jul 05, 2019, 4:27 AM UTC

hinkley wrote: post #121

charonn0 wrote: post #120

Earlier quoted context omitted.

> See, I don’t understand this. Zip is a streamable format. Zip is a streamable format but it also supports random access through a table of contents (the "central directory") located at the end of the file. This bomb works by overlapping the file offsets in the table of contents.

> I don’t understand why you would extract the archive before checking the contents.

Post by jobigoud » Fri, Jul 05, 2019, 7:35 AM UTC

Mazzen wrote: post #104

_urga wrote: post #67

I recently created a zip validator and decoder for scanning email attachments, @ronomon/zip. It's not yet open-sourced but it has defenses against excessive compression ratios, mismatching local and central directory headers, ambiguous filenames, directory traversals and symlink traversals, and anything ambiguous that could exploit differences in zip implementations, e.g. some zip implementations decode from the fron…

I understand that you don't want to release prematurely but what I don't understand: Why don't you release your code from the first line written? I start committing to Github right from the start. Others might already want to follow your project or even contribute PRs. I'd definitely be interested. Maybe at least create the repo so we can subscribe to activities ;) Best!

Post by hinkley » Fri, Jul 05, 2019, 9:16 AM UTC

girvo wrote: post #125

hinkley wrote: post #122

Earlier quoted context omitted.

Why is everybody fixating on my preface? > I don’t understand why you would extract the archive before checking the contents?

Because a curious part of written internet culture is that of fixating on small mistakes that aren't even important to the overall context or meaning of a post, and ignoring the actual content. Why, I'm unsure, but I've been noticing it a lot more now that I'm aware of it!