+- Sinisterly (https://sinister.ly)
+-- Forum: Coding (https://sinister.ly/Forum-Coding)
+--- Forum: Coding (https://sinister.ly/Forum-Coding--71)
+--- Thread: Zip Bombs (/Thread-Zip-Bombs)
Pages:
1
2
Zip Bombs - Inori - 05-27-2016
If you've used a shell, you're well aware of what fork bombs are; they eat up ridiculous amounts of memory and force the user to restart their system. There's another, more permanent version available: zip bombs.
A zip bomb is massive data files within zip files within zip files within zip files, so at a glance, a 42 KB zip looks harmless, when in reality it's 4.5 fucking PetaBytes.
Using command line tools like 7-Zip, one could recursively unzip all of these files, completely filling the victims drives. It's not necessarily permanent, but it's annoying as hell to fix the damage.
Here's a copy of 42.zip if you don't trust the site (password is 42):
[attachment=299]
RE: Zip Bombs - Darku - 05-27-2016
How is this more permanent?
RE: Zip Bombs - Inori - 05-27-2016
(05-27-2016, 08:35 PM)Darku Wrote: How is this more permanent?
Where did I say it was permanent?
(05-27-2016, 08:04 PM)Emilia Wrote: It's not necessarily permanent
RE: Zip Bombs - Skullmeat - 05-27-2016
Nice job. You realize on most systems that a zip bomb will do jack all, correct? Most modern day AVs will detect these types of files and block them from decompressing, so unless the target is a full blown idiot, it will have no effect.
RE: Zip Bombs - Inori - 05-27-2016
(05-27-2016, 08:52 PM)Skullmeat Wrote: Most modern day AVs will detect these types of files and block them from decompressing, so unless the target is a full blown idiot, it will have no effect.
There's not a ton an AV can do aside from zero detection, and even that is considered unreliable at times (even when it's not, it's extremely resourcefully expensive for some reason). Plus, they're not usually compressed via conventional utilities. Massive ones like 42 are made more intuitively.
https://www.reddit.com/r/todayilearned/comments/4lb48b/til_there_is_a_42_kilobyte_zip_bomb_which_will/d3lzcqf
There's other variants, too. While XML bombs that increase in size exponentially are more effective, this is definitely the kind of thing that AVs detect (link).
RE: Zip Bombs - Skullmeat - 05-27-2016
I have and have tested a sample like 42.zip. My AV did pick it up. Second, a zip uses a specific header, with instructions on how to decompress the file. In addition, the kind of file dates back to the days of BBSes, so its a very old trick, not something you would want to rely on as an attack.
Also from reddit:
Quote:Hello, speaking as someone who does work for an anti-malware company, I know we happen to detect archive bombs, as do a lot of our competitors. There's nothing unique or unusual about adding detection for them.
Again, neat prank, but today its pretty useless.
RE: Zip Bombs - Inori - 05-27-2016
(05-27-2016, 09:28 PM)Skullmeat Wrote: I have and have tested a sample like 42.zip. My AV did pick it up. Second, a zip uses a specific header, with instructions on how to decompress the file. In addition, the kind of file dates back to the days of BBSes, so its a very old trick, not something you would want to rely on as an attack.
Again, neat prank, but today its pretty useless.
Fair enough. As I mentioned on discord, my school's IT is laughable, so they're probably figuring out what the hell is going on right now.
RE: Zip Bombs - Skullmeat - 05-28-2016
Your school IT suffers from an ID10T error.
RE: Zip Bombs - insidious - 05-28-2016
I'm going to put this on my brothers computer and record his reaction. It's going to be priceless.
(05-28-2016, 03:43 AM)Skullmeat Wrote: Your school IT suffers from an ID10T error.Sounds like any standard school IT 0.0
In any case, I wonder if one could modify this to be more useful in an attack.
Ie: write your own compression algorithm (or take an open source one?), set it up, and create a file such that upon double clicking it... Boom, bombed, man
Don't need to use proprietary stuff like 7-zip or zip files at all
That's probably a bit far fetched though
RE: Zip Bombs - Inori - 05-28-2016
(05-28-2016, 06:32 AM)insidious15 Wrote: In any case, I wonder if one could modify this to be more useful in an attack.
Ie: write your own compression algorithm (or take an open source one?), set it up, and create a file such that upon double clicking it... Boom, bombed, man
Don't need to use proprietary stuff like 7-zip or zip files at all
That's probably a bit far fetched though
Well, @Skullmeat brought up the point of zip headers and how they have instructions for unzipping the archive, so there's probably a way to force recursive unzipping.