Windows – unzip zip files that are contained in a zip file on windows

DMG files are not zipped files, as much as they are images. They are closer to an .iso than a .zip in that they are disk images which are mountable and the contents can be compressed.

A DMG therefor must also contain block data, along with the regular file attributes like Meta data and the actual data of the file.

A good compression / zip like 7zip should be able to make smaller files (Maybe faster), and keep the data you need without stuff like block data for whatever file system your DMGs use (HFS, UDF and FAT are some of the options).

Some thoughts. I agree with you, but can see why a service provider would choose to block .zip files. I can't find too much information on some of these, I will update if I find any more info.

1. There is such a thing as a zip bomb.

2. The ZIP file format supports various compression formats - specified as a 16-bit value. Many operating systems would load a library for that method to handle compression and decompression. It doesn't look like a custom one can be specified. Windows .hlp had a vulnerability like this where the .hlp file could contain a custom DLL for display purposes, but it doesn't look like this can be done with .zip.

3. Windows Explorer will read certain *.ini files (and other ones depending on the Windows version IIRC) and possibly run programs based on them. Windows 98 let you do a lot with this, whereas I believe in later versions it is restricted. I can't find anytihng whether or not a Desktop.ini file in a zip archive will be processed by Explorer if opened. But this could be an attack vector.

4. Technically ANY file opened by Windows that has a recognized extension launches a program. For .zip files by default that is explorer.exe, but could be another program if the user has installed a different ZIP application. If an attacker knows a user has WinZip, and is aware of a vulnerability of WinZip, the user could be targeted.

5. SFX zips obviously can be malicious.