Executive Summary Archive extraction is one of the most trusted operations in modern computing. From package managers to backup systems, we routinely extract TAR files without a second thought. But what happens when the archive itself is malicious? This analysis examines a how archive traversal technique uses deeply nested directory structures and symbolic link chains to bypass validation mechanisms and write files outside the intended extraction directory. By understanding how path resolution works at the filesystem level, we can see why simple validation fails and how attackers exploit this gap.

Disclaimer: This article is written from a purely technical perspective to educate readers about internet infrastructure and network architecture. I have no political affiliation and seeks only to examine the technical mechanisms that enabled Iran’s 2026 internet shutdown. Introduction On January 8, 2026, at 8:00 PM Iran Standard Time, approximately 92 million Iranian citizens were suddenly disconnected from the global internet. This shutdown, which began during the twelfth day of nationwide protests, represented one of the most extensive and sophisticated internet blackouts ever recorded Wikipedia Georgia Tech News.