Zip Bomb • Hacker News Board

Re: Zip Bomb

#11

Post by Achshar » Fri, Oct 05, 2012, 9:17 AM UTC

trool wrote: post #7

Old as fuck.

It may be old but i didn't knew about it until it was brought up on a /r/technology thread yesterday.

Old =/= everyone knows about it.

Re: Zip Bomb

#12

Post by rorrr » Fri, Oct 05, 2012, 9:19 AM UTC

simoncoggins wrote: post #8

I've seen something similar with a PNG file for user supplied profile image [1]. The image was a 10000x10000 all black PNG image which compresses to a pretty small file size. Unless you validate the image dimensions as well as the file size it may cause problems, for instance when GD is used to try to resize it exhausted the memory limit. [1] https://bugs.launchpad.net/mahara/+bug/784978

Out of curiosity I just made two images:

15,000 x 15,000: http://i.imgur.com/WzCyE.png

50,000 x 50,000: http://i.imgur.com/kgmHu.png

Both FF and Chrome refuse to open the second one. IE does something weird. Both Opera and Safari figure out the size correctly, but don't display the image.

Re: Zip Bomb

#13

Post by nhebb » Fri, Oct 05, 2012, 9:25 AM UTC

trool wrote: post #7

Old as fuck.

>Old as fuck.

So is algebra, and yet, every year millions of people learn it for the first time.

Re: Zip Bomb

#14

Post by misnome » Fri, Oct 05, 2012, 9:27 AM UTC

nhebb wrote: post #13

trool wrote: post #7

Old as fuck.

>Old as fuck. So is algebra, and yet, every year millions of people learn it for the first time.

But they don't immediately rush out to tell the world the "News"

Re: Zip Bomb

#15

Post by TazeTSchnitzel » Fri, Oct 05, 2012, 9:34 AM UTC

conductor wrote: post #5

Web browsers support compressed data, I wonder will they try to decompress something like this?

Gzip could certainly be abused.

Re: Zip Bomb

#16

Post by chuppo » Fri, Oct 05, 2012, 9:41 AM UTC

conductor wrote: post #5

Web browsers support compressed data, I wonder will they try to decompress something like this?

Yes they will, there was a post a while back which used this to bomb the browser.

Re: Zip Bomb

#17

Post by conductor » Fri, Oct 05, 2012, 9:44 AM UTC

chuppo wrote: post #16

conductor wrote: post #5

Web browsers support compressed data, I wonder will they try to decompress something like this?

Yes they will, there was a post a while back which used this to bomb the browser.

Also one can try to bomb virus scanners (on PC or on a mail server (using e-mail attachment)) or any other service which supports uploading+extracting zip files.

Re: Zip Bomb

#18

Post by DanBC » Fri, Oct 05, 2012, 9:48 AM UTC

Here are some other compression curiosities:

(http://www.maximumcompression.com/compression_fun.php)

It includes a 115 byte rar file that expands to 5 Mb. (That 115 bytes can be squashed down further; one compressor gets it to 39 bytes.); a file that compresses with one software but ends up bigger with another software; etc.

some say that file compression is linked to AI - good general purpose compression relies on being able to predict the text and create table; if you can predict something you understand it.

The Hutter prize tests this against the 100 Mb of enwiki8. Best attempt so far is a bit less than 16 Mb.

(http://prize.hutter1.net/) I remember zip bombs from early 90s BBSing. I also remember ANSI bombs.

Re: Zip Bomb

#19

Post by trool » Fri, Oct 05, 2012, 9:53 AM UTC

Achshar wrote: post #11

trool wrote: post #7

Old as fuck.

It may be old but i didn't knew about it until it was brought up on a /r/technology thread yesterday. Old =/= everyone knows about it.

The fact that you don't do your homework doesn't mean what this guy is doing is righteous.

Re: Zip Bomb

#20

Post by trool » Fri, Oct 05, 2012, 9:59 AM UTC

nhebb wrote: post #13

trool wrote: post #7

Old as fuck.

>Old as fuck. So is algebra, and yet, every year millions of people learn it for the first time.

I just learned I could copy and paste things easily using some mysterious keyboard shortcuts. Should I share it on HN? Surely someone isn't aware of that great (shall I say life-saving) feature?