YET ANOTHER ZIP TRICK WRITEUP

Summary from the TLDR InfoSec newsletter

This write-up explains how to create a "schizophrenic ZIP file". This type of ZIP file appears differently depending on the parser used. The trick relies on how parsers locate the Central Directory, with some using the offset field and others calculating it from the size. As a result, each method points to different Central Directories containing different file content, allowing the same ZIP file to display different contents depending on which parser opens it. This enables malicious files to be opened without the user's knowledge.