Zip bomb

lastmod 2025-05-07created 2025-04-301 edits

A zip bomb, also known as a zip of death or decompression bomb, is a malicious compressed computer file designed to crash or hang a program or system that reads it. It serves to disable antivirus software so that a more traditional virus can get in more easily.

The program does not interfere with normal computer operation and looks like an ordinary ZIP file. However, if something tries to extract it, such as antivirus software attempting to scan it, an enormous amount of hard disk space and memory is required.

Modern antivirus software includes a step that detects whether a zip file is a zip bomb and, if it is, does not extract it.

Details

A zip bomb is small in its compressed state to avoid arousing the user's suspicion. However, when someone tries to extract the file, its size exceeds what the system can handle. This technique was used in the days of dial-up bulletin board systems.

A well-known example of a zip bomb is the file 42.zip. It is 42KB compressed, but inside it are 16 compressed files, each nested 16 at a time across 5 layers. The bottom layer contains a single 4.3GB (4 294 967 295 bytes) file, and when fully extracted the total size becomes 3.99PB (4 503 599 626 321 920 Bytes). The file can be downloaded from various websites. Many antivirus programs scan only a few repeated layers to prevent attacks that cause buffer overflows, out-of-memory conditions, or exceed the allowed program access time.

To achieve extreme compression ratios, zip bombs often consist mostly of repeated strings. To compress such files, only a single file is carried through each recursive layer, and dynamic programming is sometimes used to achieve exponential efficiency.

There are also zip files built to replicate themselves when extracted.

On July 2, 2019, a zip bomb was presented that does not use recursion but instead overlaps file headers and contents. It is about 10MB compressed, but extracting it releases 281TB of files all at once.

Creating a Zip Bomb

dd if=/dev/zero bs=1G count=10 | gzip -c > 10GB.gz

Generate 10GB of zero-byte data with /dev/zero, then compress it with gzip.
The result is a zip bomb about 10MB in size.

Server example

Send the Zip Bomb when middleware detects a blacklisted IP or a malicious pattern.

if (ipIsBlackListed() || isMalicious()) {  
    header("Content-Encoding: deflate, gzip");  
    header("Content-Length: "+ filesize(ZIP_BOMB_FILE_10G));  
    readfile(ZIP_BOMB_FILE_10G);  
    exit;  
}

Table of Information Security

Table of Information Security
Related security categories	Computer security, Automotive security, Cybercrime (Cybersex trafficking, Computer fraud), Cybergeddon, Cyberterrorism, Cyberwarfare, Electronic warfare, Information warfare, Internet security, Mobile security, Network security, Copy protection, Digital rights management
Threats	Adware, Advanced persistent threat, Arbitrary code execution, Backdoors, Bombs (Fork, Logic, Time, Zip), Hardware backdoors, Code injection, Crimeware, Cross-site scripting, Cross-site leaks, DOM clobbering, History sniffing, Cryptojacking, Botnets, Data breach, Drive-by download, Browser Helper Objects, Viruses, Data scraping, Denial-of-service attack, Eavesdropping, Email fraud, Email spoofing, Exploits, Fraudulent dialers, Hacktivism, Infostealer, Insecure direct object reference, Keystroke loggers, Malware, Payload, Phishing (Voice), Polymorphic engine, Privilege escalation, Ransomware, Rootkits, Scareware, Shellcode, Spamming, Social engineering, Spyware, Software bugs, Trojan horses, Hardware Trojans, Remote access trojans, Vulnerability, Web shells, Wiper, Worms, SQL injection, Rogue security software, Zombie
Defenses	Application security (Secure coding, Secure by default, Secure by design (Misuse case)), Computer access control (Authentication, (Multi-factor authentication), Authorization), Computer security software (Antivirus software, Security-focused operating system), Data-centric security, Software obfuscation, Data masking, Encryption, Firewall, Intrusion detection system (Host-based intrusion detection system (HIDS), Anomaly detection), Information security management (Information risk management, Security information and event management (SIEM)) Runtime application self-protection, Site isolation

Favorite site

Zip bomb - Wikipedia
I use zip bombs to protect my server | GeekNews
- Most internet traffic is bots, and some of them have malicious purposes (spam, hacking, etc.).
- The author has suffered damage from bots in the past, such as a WordPress server getting infected and being removed from Google Search.
- Started using Zip Bombs to prevent this.

author Zer0 sitemap