What is a zip bomb?
When downloading files from either emails or websites, it's critical to be aware of the risks. After all, this is how many viruses, trojans, and other types of cyberattacks are deployed, masking themselves as harmless files that are unknowingly downloaded. However, viruses and trojans are only the tip of the iceberg, and there are plenty of other threats out there that organizations need to protect against.
One such threat is that of zip bombs, a type of malicious archive file that exploits popular ZIP compression techniques, potentially causing significant damage to targeted systems. But what is a zip bomb, and how can your organization protect against them? To provide clarity to these questions, this article will explore zip bomb attacks, their potential impact, and practical strategies for protection. Read on to learn more.
Understanding zip bombs (decompression bombs)
A zip bomb, otherwise known as a decompression bomb or "zip of death," is a type of malicious file that leverages compression algorithms to create files significantly smaller than their decompressed counterparts. Its purpose is to deceive a system or application into allocating excessive resources during decompression, leading to system instability, crashes, or denial of service.
Zip bombs exploit the compression techniques employed in the most widely used file archiving formats, such as ZIP or RAR. These formats use algorithms like DEFLATE, which remove redundancy and reduce file size; however, when compression is applied recursively, with files containing other compressed files in a nested manner, the resulting archive can become incredibly large. Below, we detail exactly how zip bombs work and how to understand their potential impact on your organization.
|
In a 1,000-person organization, 14 users are expected to download or execute malware annually, with seven generating monthly events and four experiencing weekly encounters.
|
How zip bombs work
Zip bombs rely on what is known as recursive compression, where files are compressed multiple times within an archive—exploiting existing compression algorithms used in ZIP applications. Each iteration compounds the compression, leading to exponential growth in the compressed size. For example, a file may start with a small size of just a few kilobytes, but after several rounds of compression, it can expand to hundreds of gigabytes or even terabytes.
To further increase the impact, zip bombs employ infinite decompression loops that trick decompression tools by creating structures that never end, consuming excessive system resources and causing the decompression process to continue indefinitely. This means that when a decompression tool encounters such a loop in a compressed file, it continuously attempts to decompress the contents, leading to an infinite cycle of extraction attempts.
