Zip bomb 101: what is a zip bomb and how to create it?

We’ve all heard of bombs, the kinds that are destructive, noisily exploding, and leave behind a wake of debris. But there’s a different type of bomb on the block, and it’s one that’s been used fraudulently by hackers for years. Don’t worry. It’s not a real bomb but kind of a virtual one – known as the ‘zip bomb.’ So, what is a zip bomb, how does it work, how to create it, and most importantly, how do you keep yourself safe? Today, we’ll be answering all these questions and more – so let’s get cracking!

What is a Zip Bomb?

A zip bomb, also known as a zip of death, is an electronic file designed to crash or render data inaccessible when unzipped.

In this attack, a malicious actor sends a fraudulent compressed file, often disguised as an innocuous-looking document or image, to another user. This file contains a pattern of layers that, when decompressed by the recipient, can fill up their entire computer’s hard drive and significantly slow down or even crash the system due to the data expansion. As such, they are also called decompression bombs.

Zip bombs have been around since the 1990s but have become more widespread in modern times due to cybercriminals using this method to target unsuspecting people or companies. For a zip bomb to be successful, the victim must open the file containing the malicious payload and expand it.

When discussing whether zip bombs are harmful, there are two sides to the argument. On the one hand, some people believe that zip bombs are an effective tool for launching distributed denial-of-service (DDoS) attacks and disrupting the services of major organizations. On the other hand, many claims that these attacks are ineffective and only cause minor inconveniences compared to other malicious attack vectors.

Regardless of opinions on the effectiveness of zip bombs, it is essential to understand how these attacks work to better protect yourself from them. The following section will explain how a zip bomb attack works. before that,

Quick Recap of Key Points

• A Zip bomb is a malicious file size that is extremely small but contains multiple compressed levels, which cause extreme memory and disk usage when unzipped.
• According to a study by Avast, over 35% of all detected malware in 2020 were Zip bombs.

How Does a Zip Bomb Attack Work?

A zip bomb attack is a form of cyber attack that is also used to disable websites and servers. It involves an attacker creating and sending a malicious file that’s compressed into a small size but contains a tremendous amount of data to the victim. 

When a victim decompresses the zip bomb, the victim’s computer tries to allocate memory and resources to accommodate the expanded data. In the case of a zip bomb, the decompressed data is much larger than the computer’s available resources, leading to system crashes, slowing down, or other serious problems.

For example, a zip bomb might contain a single file that is extremely large, or it might have many small files that decompress into a massive amount of data. In either case, the result is the same: the computer’s resources are overwhelmed, leading to performance problems or even system crashes.

In some cases, the malicious file may be disguised as something innocuous, like a .exe extension or .winzip file, making it easier for individuals to open. Zip bomb attacks can be executed by attaching infected files in emails, uploading them onto forums or websites, or even directly inserting them onto webmail systems. As such, it can be difficult for users to identify these malicious files before opening them.

Here is an example of a famous zip bomb – “42.zip”

42.zip

It’s a zip file with 42 kilobytes of compressed data and five levels of nested zip files in sets of 16, each with a 4.3 gigabyte file for a total of 4.5 petabytes of uncompressed data. So, when this zip file is sent, it may look like a file of size 42kb, but when it is extracted, the actual size will be 42pb.

Creating a zip bomb:

Creating a zip bomb is an unethical and potentially illegal act, as it is designed to cause harm to a computer’s resources and can potentially cause damage to the affected computer. I strongly discourage you from attempting to create a zip bomb.

However, for educational purposes, we will show you the outline of how to create one.

1. Open the notepad and start typing 0. (let’s say, 1000 characters)
2. Copy the zeros and paste them several times as you need.
3. Once you feel enough, save the file and make copies of that text file. (let’s say, 10 files)
4. Make a zip file with those copies of text files.
5. Make copies of the created zip file.
6. Now, make a new zip file with those copies of the zip files.
7. Repeat steps 5 & 6 until you feel enough.
8. That’s it.

Remember, each character occupies 1 byte of memory. So, if you have a million zeros in a text file, then it occupies a million bytes of memory. 

• 1 million bytes / 1024 = 976.5 KB, which is nearly 1 MB.
• So each file holds 1 MB of data, and 10 files hold 10 MB.

But the zip file, which consists of 10 files and is compressed, will only have the compressed size (let’s say 1.5 MB). It will only have the actual size (10 MB) if it’s expanded. 

So, a single zip file will hold 1.5 MB of data. Make as many copies and many layers as you need.

Defending Against Zip Bomb Attacks

Although it is difficult to defend against a zip bomb attack due to its small file size, measures can still be taken. One of the most common steps is to increase the input file size limit from the default setting. Organizations and administrators should set a size threshold appropriate for the type of files that are commonly used or shared on their networks. This will help prevent malicious zip bombs from slipping past security checks, as larger zip files cannot be accepted if a smaller size threshold is set.

Additionally, organizations should use data compression technologies when transmitting large files over the network to minimize the risk of a successful attack. By compressing the files before sending them, entities can reduce their file sizes substantially, lowering their chances of becoming targets of zip bomb attacks.

Some organizations also deploy automated malware scanners at crucial points within the network, such as email server gateways or web browser filters. These tools look for any suspicious code or patterns within an incoming file and block any potentially malicious requests with minimal human effort. While this method can reduce the chances of an attacker successfully delivering a zip bomb payload, it requires significant system resources and may be ineffective if not tuned correctly.

Try using anti-virus software to scan for malicious content before opening the file. Scanning with anti-virus software is one of the most effective methods for preventing zipper bomb attacks. In general, these programs are designed to detect malicious files and programs on a computer system, then eliminate them from the computer before any data can be compromised or affected. This includes the detection of any zipper bomb attack. Even if the user unknowingly downloads an infected zip file, the anti-virus software should detect and take appropriate measures to protect the system. 

 Another tip is to unzip the suspected file using specialized programs such as 7-zip, known for effective unzipping of compressed files. Lastly, if you suspect that the file contains a zip bomb but cannot determine its content without opening it, consider using emulation techniques such as “sandboxing .” This isolates the program from other applications by creating an isolated environment and allows malware detection programs to uncover malicious activity before it takes effect.

Following basic precautions such as using anti-virus software and avoiding untrusted download sources can help decrease an organization’s or individual’s vulnerability to attack. While these measures may not completely eliminate all malicious traffic from entering a system through a zip bomb attack, when implemented properly, they can create several layers of defense that significantly reduce the likelihood of success for an attacker.

The Impact of Zip Bomb Attacks

Zip bomb attacks can have a devastating impact. These types of attacks occur when attackers create malicious files that, when decompressed and expanded, can fill up an entire hard drive with thousands of files in mere seconds. These attacks are especially dangerous for companies, as they can cause system crashes, degrade performance, and disrupt operations due to the lack of available storage space. Moreover, as protecting against these types of cyberattacks is very difficult in most cases, they can pose a serious threat to organizations and their data.

On the other hand, some posit that zip bombings are not always as devastating as they could be. For example, these days, many modern devices have a certain amount of storage space designed to accommodate large downloads such as videos or music albums. Therefore, if an attacker were to try to launch a zip bomb attack on your device, the large file would be blocked before it could expand and break your device’s memory limitations. As such, it is essential to remember this caveat when considering the dangers of zip bombs.

Overall, the impact of zip bomb attacks can be severe if left unchecked. However, suppose users take precautionary measures and adhere to safety guidelines outlined by their service provider or software vendor. In that case, the risk posed by zip bombs can be kept at bay. 

With those impacts in mind, let’s wrap up the article with a meaningful conclusion and some FAQs.

Conclusion

We may have created a zip bomb, but do you know it is somehow useless now? Know the reason behind why I’m calling it useless.

In older days, the compression application had a feature called “recursive decompression.” Recursive decompression refers to repeatedly decompressing nested archive files until all files are extracted. In this process, a compressed archive file is extracted, and if any of the extracted files are also archive files, they are also decompressed. This process is repeated until all files have been decompressed and are no longer archived files.

The zip bomb was a bomb designed specifically for these applications. But now, most current apps do not employ recursive decompression because of zip bombs. Even today, most typical storage devices (such as your computer’s hard disk) are slow. As a result, writing a significant volume of data to the storage device would take a lengthy time. Anyone unpacking a zip bomb slowly would notice this and just stop doing it. So, the zip bomb might be useless unless the application uses recursive decompression.

Responses to Common Questions