I Came to Drop Bombs

Auditing the Compression Algorithm Weapons Cache
Cara Marie

NCC GroupBlackhat USA 2016

About Me• NCC Group Senior Security Consultant

Pentested numerous networks, web applications,mobile applications, etc.

• Hackbright Graduate• Ticket scalper in a previous life
• @bones_codes | cara.marie@nccgroup.com

What is a Decompression Bomb?
A decompression bomb is a ﬁle designed to crash or renderuseless the program or system reading it.

Vulnerable Vectors• Chat clients• Image hosting• Web browsers• Web servers• Everyday web-services software• Everyday client software• Embedded devices (especially vulnerable due to weakhardware)• Embedded documents• Gzip’d log uploads

A History Lesson
early 90’s • ARC/LZH/ZIP/RAR bombs were used to DoS FidoNetsystems
2002 • Paul L. Daniels publishes Arbomb (Archive “Bomb”
detection utility)
2003 • Posting by Steve Wray on FullDisclosure about a bzip2
bomb antivirus software DoS
2004 • AERAsec Network Services and Security publishes
research on the various reactions of antivirus software
against decompression bombs, includes a comparisonchart2014 • Several CVEs for PIL are issued — ﬁrst release July 2010
(CVE-2014-3589, CVE-2014-3598, CVE-2014-9601)
2015 • CVE for libpng — ﬁrst release Aug 2004
(CVE-2015-8126)

Why Are We Still Talking About This?!?

Why Are We Still Talking About This?!?

Compression is the New Hotness

Who This Is For

Who This Is For

The Archives

An archive bomb, a.k.a. zip bomb, is often employed to disable
antivirus software, in order to create an opening for more
traditional viruses• Singly compressed large ﬁle• Self-reproducing compressed ﬁles,i.e. Russ Cox’s Zips All The Way Down

• Nested compressed ﬁles, i.e. 42.zip

The Archives
42.zip42.zip (42.374B) is comprised of:
16 x 4294967295 = 68.719.476.720 (68GB)
16 x 68719476720 = 1.099.511.627.520 (1TB)
16 x 1099511627520 = 17.592.186.040.320 (17TB)
16 x 17592186040320 = 281.474.976.645.120 (281TB)
16 x 281474976645120 = 4.503.599.626.321.920 (4.5PB)— Each containing a single 4.3GB ﬁle —Compression Bombs
Ratio Calculation

Compression Ratio =1048576 =Uncompressed Content
Compressed Content

10485760KB (10GB)
10KB

The Archives
Compression Ratio Graph

The Archives
Compression Ratio Graph (sans bzip2)

The Archives
Compression Ratios

Utility
bzip2

Size
7KB

Compression Ratio~1427411:1

xar (bzip2)

9KB~1198921:1

7z (gzip)
xz
RAR
LZFSE
gzip
ZIP
xar (default)
LZ4

1.5MB
1.5MB
5.2MB
6.3MB
10.2MB
10.2MB
10.2MB
41.2MB~6848:1~6875:1~2003:1~1625:1~1029:1~1029:1~1028:1~258:1

Ratios calculated from a zero-generated 10GB ﬁleAlgorithm
Burrows–WheelerBurrows–Wheeler
DEFLATE
LZMA
LZSS/PPM
DEFLATEDEFLATEDEFLATE
LZ77

Mitigations
Security 101• Never rely on client-side checks for security• Perform server-side checks to validate:• File format is expected for context• File size will not exceed maximum limit• File name is sane/safe• File names are validated to avoid symlink/hardlink or directory

traversal attacks

Mitigations
The Archives

Limit the amount of resources available to the process and its
children• For Linux platforms, cgroups can and should be used to limit

both CPU and memory usage• In Python resource limits can be conﬁgured via the resource

module’s setrlimit and RLIMIT* directives:
import resource
rsrc = resource.RLIMIT_DATA

resource.setrlimit(rsrc, (1024000, hard)) # limit to 1MB• Ruby’s Process module has similar RLIMIT directives

Mitigations
The Archives

Restrict output ﬁle size and number of extracted ﬁles, and throw anexception if either of these limits are reachedimport zlib
def decompress(data, maxsize=1024000):dec = zlib.decompressobj()
data = dec.decompress(data, maxsize)
if dec.unconsumed_tail:raise ValueError("Possible bomb")del dec
return data

Not Just a Pretty Picture

Images can be highly effective in causing a denial of service for:• Web servers and clients• Mobile clientsNot Just a Pretty Picture
Compression Ratio Graph

Not Just a Pretty Picture
Compression Ratio Graph (the Universals)

Not Just a Pretty Picture
Compression Ratios

FormatJPEG 2000
WebP*
ZopﬂiPNG
GIF
WebP
TIF
PNG
JPEG

Size
552B
4KB
12KB
68KB
177KB
292KB
316KB
586KB

Compression Ratio~181159:1~24414:1~8138:1~1436:1~552:1~334:1~309:1~167:1

Algorithm
DWT
LZ77
WebP
LZW
LZ77
LZW
DEFLATE
DCT

Ratios calculated from 10Kx10K, 8-bit single-color img (~95MB)– WebP restricts image input to a maximum of 16383 pixels*Initial WebP entry is the Imagemagick implementation

Mitigations
Not Just a Pretty Picture

Programmatically check image dimensions prior to processing• libpng allows size limitations to be placed using
png_set_user_limits()(the default is 1,000,000 by 1,000,000 pixels)• For Python, this can be done using PIL’s Image module:
from PIL import Image
im = Image.open(image_filename)width , height = im.size# Check image dimensions
if (width < MAX_IMAGE_WIDTH) and (height < MAX_IMAGE_HEIGHT):# do stuff

Mitigations
Not Just a Pretty Picture• Use workers to perform process intensive tasks• Limit the amount of resources available to the process and its

children• libpng allows users to impose memory consumption andancillary chunk limits via png_set_chunk_malloc_max() andpng_set_chunk_cache_max()• Contents are scrubbed to minimum required (exif data,avoiding image based XSS, etc.)

Bombs in Flight

HTTP bombs can be used to target:• Web servers• Web clients (includes mobile)• Embedded devices

Bombs in Flight
Compression Ratio GraphBombs in Flight
Compression Ratios

FormatGzip
Zopﬂi

Size
10.2MB
10.3MB

Compression Ratio~1029:1~1017:1

Algorithm
DEFLATEDEFLATE

bzip2

7KB

~1427410:1

27KB
1.5MB

~387844:1~7089:1

Burrows–Wheeler
LZ77

brotli
LZMA

Ratios calculated from a zero-generated 10GB HTML ﬁle– Zopﬂi binary restricts content to 2GB– Bzip2 is supported by Lighttpd– Brotli is supported in Firefox and Chrome(currently only for HTTPS)– LZMA is supported in Opera beta 33

Mitigations
Bombs in Flight

Limit the amount of resources available to the process and its
children• For Apache, use the RLimit* directives: RLimitCPU, RLimitMEM,and RLimitNPROC• For Nginx, use the worker_rlimit_core, worker_rlimit_nofile,and worker_processes directives• For Linux platforms, cgroups can be used to limit both CPUand memory usage

Mitigations
Bombs in Flight• Limit request sizes• This can be done in Apache using the LimitRequestBodydirective• For Nginx use the client_max_body_size directive• Limit request compression ratios• For Apache, use mod_deflate’s DeflateInflateRatioLimit,

DeflateInflateRatioBurst, and DeflateWindowSize directives

The Search Continues• Various protocols, i.e. SSH, FTP• Fonts• Videos• Embedded devices• Version control systems, i.e. Git, SVN

Anything that makes use of compression is a potential vector forthis type of attack.

Tools• GzipBloat
https://github.com/cyberisltd/GzipBloat• Burp Image Size Extension
https://github.com/silentsignal/burp-image-size• bomb.codes
https://bomb.codes/

ToolsToolsToolsMitigation Summary• Restrict resources — place limits on processes and theirchildren• Don’t rely on size alone — check image dimensions prior torendering• Restrict ﬁle size output — verify that the output ﬁle size won’t

max out storage• Limit number of extracted ﬁles — calculate the ﬁle total toensure that storage/processing power won’t be overloaded• Perform dynamic testing — always verify mitigations via manual

testing to ensure that they are functioning properly

Archive bombs are decompression bombs,
but not all decompression bombs are archive bombs.

Questions?

@bones_codes | cara.marie@nccgroup.com