A decompression bomb on a computer is a malicious archive designed to consume resources when extracted. This technique overwhelms disk space, memory, and CPU by expanding a small file into gigabytes or terabytes of data.
Attackers use these archives to trigger denial of service, bypass upload limits, or crash security tools that scan compressed files. Understanding how these bombs work helps teams build more resilient defenses.
| Characteristic | Benign Archive | Decompression Bomb | Impact on System |
|---|---|---|---|
| Size of Original Data | Small, practical content | Tiny payload, huge expansion ratio | Minimal to none |
| Compression Ratio | Moderate, typical ratios | Extremely high, often extreme ratios | Resource exhaustion |
| Intent | Storage or transfer efficiency | Disruption or evasion | Malicious or accidental denial of service |
| Common Formats | ZIP, RAR, 7z with normal content | Nested archives, repeating patterns | Crashes, hangs, alerts |
| Detection Approach | Standard scanning | Heuristic limits, sandbox size caps | Requires specialized controls |
How Decompression Bombs Work
These bombs rely on algorithms that generate repetitive or highly redundant data. When a tool unpacks the archive, the final size can be orders of magnitude larger than the original file.
Nested archives, wildcard patterns, and recursive compression amplify the effect. Even systems with ample disk can run out of memory or inodes during extraction, creating operational failures.
Detection and Prevention Methods
Security tools limit expansion in sandbox environments, set extraction size caps, and monitor resource usage during unpacking. Administrators can disable risky formats or restrict decompression to isolated systems.
Configuration hardening, file type policies, and user education reduce the likelihood of successful attacks that leverage these bombs. Layered defenses are more effective than relying on a single control.
Operational Risks and Impacts
When a bomb expands unexpectedly, it can fill storage volumes, exhaust system memory, or spike CPU usage. Services that depend on available disk space may fail, affecting availability for other workloads.
In shared environments, a single extraction can impact multiple tenants or applications. Incident response teams must account for these scenarios when designing monitoring and throttling strategies.
Comparison with Other Threats
Unlike traditional malware that executes code, decompression bombs consume resources without directly compromising integrity or confidentiality. They are often used alongside other attacks to amplify damage.
Threat actors may combine these bombs with exploit chains that process untrusted input, increasing the chances of successful compromise. Defensive planning should address both direct and indirect risks.
Key Takeaways and Recommendations
- Set extraction size limits and sandbox decompressors to contain unexpected expansion.
- Restrict archive formats and disable unnecessary extensions on critical systems.
- Monitor storage and memory usage during automated import or scan operations.
- Educate users about risks from seemingly small downloaded files.
- Implement layered defenses to reduce reliance on any single control.
FAQ
Reader questions
Can a decompression bomb affect cloud storage services?
Yes, if an archive expands massively during a scan or sync, it can consume billed storage and trigger rate limits or service interruptions on cloud platforms.
What file formats are commonly used for these bombs?
Formats such as ZIP, RAR, and 7z are typical vectors, especially when nested recursively or containing patterns that expand dramatically during decompression.
How can antivirus tools detect these bombs before extraction? Products analyze compression ratios, archive depth, and headers to estimate potential expansion and block or sandbox files that exceed safe thresholds. Is opening unknown attachments the only infection path?
No, any untrusted file upload, such as from email, web forms, or third party sources, can deliver a bomb if the server automatically extracts user submitted archives.