Why a 64 MB archive has to be opened

Mail gateways handle archives in one of two ways. The first is to block them outright. That works for a week, until finance cannot send a report as a ZIP, and the rule is switched off.

The second is to open only the first layer. That is a written instruction for the attacker: put a RAR inside the ZIP and nothing goes further. In many gateways that limit is not even visible in the configuration.

The third way is to open under a budget. It is the only one that works, and the rest of this piece is about how it is configured.

Opening an unknown archive means spending resources. A 42 KB file can expand to a petabyte; this is called a zip bomb, and it is not malicious code but ordinary compression arithmetic.

A bomb needs no antivirus signature and static analysis will not find it — it exists only during extraction. So the defence belongs in the limit, not in the signature.

Extraction therefore always runs under a budget: recursion depth, total expanded size, inner file count and an overall scan budget. Ours are 4, 512 MB, 5000 and 300 MB respectively.

Compression ratio is the signal of a bomb. But honest files compress hard too: a text log at 100× is entirely normal, because it is full of repeated lines.

One threshold will either pass the bomb or block the report. Wherever you put it, the error moves to the other side.

So two thresholds work. The soft one (100×) quarantines: a person decides. The hard one (500×) rejects: this is no longer a report. Two numbers instead of one remove the trade-off between false positives and false negatives.

Recursion depth is the cheapest tool a bomb has: every layer multiplies the ratio. Four layers is enough in practice — five levels of nesting essentially never occurs in real mail.

The inner file count is bounded separately. An archive containing a hundred thousand empty files passes the total-size limit while choking the filesystem and the scanner on operation count.

And the overall scan budget, in time and in bytes, is the last barrier for anything that slipped past all the rest.

The most common bypass is a password-protected archive. The scanner cannot open it, so it passes it as clean. The user takes the password from the message body, because that is where the attacker wrote it.

The fix is just as simple: look for the password in the body, in an attached document, or in text inside an image via OCR, and try it. We attempt up to eight candidates.

Once opened, everything inside is scanned from scratch — finding the password starts the inspection rather than ending it. If no password is found, the archive enters the "did not open" state and the failure policy applies.

Disk image files — VHD, VMDK, ISO — look like ordinary attachments and most gateways never open them. An executable sits inside quite comfortably.

They have to be mounted and scanned exactly like an archive. The same is true for OneNote, CHM and other container formats.

The second case is a faked extension. Even if the name ends in `.doc`, if the content is a ZIP then it is a ZIP. Format is always determined from magic bytes, never from the name.

The soft threshold sends mail to quarantine, but if quarantine is a folder nobody looks at, it is merely a slower form of blocking.

So three things are mandatory there: a notice to the recipient, a plain statement of the reason ("this archive compresses 180×"), and a named owner of the decision.

And a metric: how long a message sits in quarantine on average, and what share is eventually released. If 95% is released the threshold is too low; if 5% is, quarantine is really a block.

Send three things to your own gateway. First, a RAR inside a ZIP with an ordinary test file. Second, an archive whose password is written in the message body. Third, an ISO with an executable inside.

If all three arrive, you have no archive layer. If two arrive, the configuration stopped half way — which is the most common case.

A fourth test is optional but useful: send something with a high ratio that is entirely honest, such as a large text log. If it is blocked, you have one threshold rather than two.