Stardate 20010711.1220 (On Screen): This gave me a good chuckle. It's not an exploit so much as a form of harassment; its purpose is not to break through a firewall as much as to shut the firewall down. It's a form of DOS, in fact. Still, it's quite clever.
As part of trojan checking, some sophisticated firewalls now check all attachments on incoming email, which is reasonable. Of course, the trojan could be packed into some sort of archive, so necessarily this also has to unpack the archive before it can be checked. Someone figured out that you could take a huge file consisting entirely of the same value and compress it into an archive, and it would compress really well and result in a quite small archive. But when expanded again by the firewall it would explode and bring the firewall to its knees. A 42K archive would explode into up to 16 gigabytes of trash and all that would have to be checked for viruses and trojans. Ship ten or twenty of those at some system and the firewall will be down for about half an hour.
It will, of course, be trivially easy for the firewall company to fix it. All they have to do is make the unpacker smart, so that when it reaches some arbitrary upper limit (i.e. 100 megabytes) on unpacking, then it will give up and refuse to forward the archive. It should take someone about two hours to make the fix, and possibly a day to test. (discuss)
