Zip bomb

A zip bomb, also known as a Zip of Death or decompression bomb, is a malicious archive file designed to crash or render useless the program or system reading it. It is often employed to disable antivirus software, so that a more traditional virus sent afterwards could get through undetected.

Rather than hijacking the normal operation of the program, a zip bomb allows the program to work as intended, but the archive is carefully crafted so that unpacking it (e.g. by a virus scanner in order to scan for viruses) requires inordinate amounts of time, disk space or memory.

A zip bomb is usually a small file (up to a few hundred kilobytes) for ease of transport and to avoid suspicion. However, when the file is unpacked its contents are more than the system can handle.

The technique has been used on dialup bulletin board systems at least as long as compressing data archive programs have been around.^{[citation needed]}

Today, most antivirus programs can detect whether a file is a zip bomb and so avoid unpacking it.^[1]

One example of a Zip bomb was the file "42.zip" which was 42 kilobytes of compressed data, containing five layers of nested zip files in sets of 16, each bottom layer archive containing a 4.3 gigabyte (4 294 967 295 bytes; ~ 3.99 GiB) file for a total of 4.5 petabytes (4 503 599 626 321 920 bytes; ~ 3.99 PiB) of uncompressed data. ^[2] This file is still available for download on various websites across the internet.

See also

• Billion laughs, a similar attack on XML parsers
• Busy beaver, a program that produces the maximum possible output before terminating
• E-mail bomb
• Logic bomb

External links

• 42.zip on SecurityFocus.com
• July 2001 story from TheRegister.co.uk
• www.unforgettable.dk/

References

1. ^ Bieringer, Peter (2004-02-12). "AERAsec - Network Security - Eigene Advisories". http://www.aerasec.de/security/advisories/decompression-bomb-vulnerability.html. Retrieved 2011-02-19. 
2. ^ "42.zip". http://www.unforgettable.dk/.