Security: Are decompression bombs about to hit your e-mail

bigc73542 · Mar 11, 2004

Link to story: http://www.publictechnology.net/modules.php?op=modload&name=News&file=article&sid=725

[size=+1]Security: Are decompression bombs about to hit your e-mail[/size]

Article by security specialist & PublicTechnology.net columnist mi2g:

Decompression bombs are starting to make the rounds in cyberspace and pose a rising digital risk. Decompression bombs are specially crafted files designed to be decompressed into much larger files with bogus content that consume the available space, effectively using up all the disk space on the machine running the anti-virus scans. Data compression often works by coding repeat units of data - for example a string like "aaaaaaaaaa" could be represented as "a10". The vulnerability of this process is that an attacker could send a file containing "a1000000000...", which could result in a massive denial of service if any attempt is made to put it through a decompression engine.

The rapid spread of new Bagle variants that propagate by inviting recipients of infected emails to open an encrypted Zip file and providing a password in the message body, have demonstrated quite conclusively that any attempts to educate the vast majority of computer users about the dangers of opening attachments are imperfect and mostly futile. The benefit for malware authors is that the encryption process scrambles the contents of the Zip file, making it difficult for email virus scanners to find the tell-tale viral signatures...

.
.
.
Click to expand...

Abrashea · Mar 13, 2004

wow! You're really informed! Thanks for the heads up on this!

meneer · Mar 14, 2004

I'm afraid there nothing new here . As you will recaal there was an alert lately (for instance at this link: http://seclists.org/lists/fulldisclosure/2004/Jan/0279.html about a few scanners not being able to withstand a bomb attack. This was news, sionce most scanners know the trick and know how to handle it.

Yes, perhaps I'm a bit alergic to mi2g reports too

Log in or Sign up

Security: Are decompression bombs about to hit your e-mail

bigc73542 Retired Moderator

Abrashea Registered Member

meneer Registered Member

Log in or Sign up

Security: Are decompression bombs about to hit your e-mail

bigc73542 Retired Moderator

Abrashea Registered Member

meneer Registered Member

Useful Searches