A better zip bomb (bamsoftware.com)

Article summary

The article presents a method for constructing a non-recursive zip bomb that achieves a high compression ratio by overlapping files inside the zip container. This approach allows the output size to increase quadratically in the input size, reaching a compression ratio of over 28 million. The construction uses the DEFLATE compression algorithm and is compatible with most zip parsers. The article also discusses the limitations and potential optimizations of this method.

Main themes

• zip bomb construction
• compression algorithms
• file format vulnerabilities
• security implications
• browser behavior

What commenters say

• Some browsers automatically extract zip files, which can lead to issues with zip bombs, while others do not, highlighting a difference in security approaches.
• Verifying the checksum of a downloaded file is crucial to ensure its integrity, but this can be problematic if the browser automatically extracts the file.
• The use of zip bombs could potentially be used to mask malware, but most antivirus engines are able to handle this scenario effectively.
• Streaming zip files without extracting them to disk could be a more secure approach, but this may not be possible with all types of zip files.
• The construction of zip bombs highlights the importance of considering security vulnerabilities in file formats and compression algorithms.
• Some commenters argue that the automatic extraction of zip files by browsers is a useful feature, while others see it as a security risk.
• The ability to create zip bombs with high compression ratios has significant implications for security and data storage.