Compression Bombs Strike Back Giancarlo Pellegrino - - PowerPoint PPT Presentation

▶
compression bombs strike back
SMART_READER_LITE
LIVE PREVIEW

Compression Bombs Strike Back Giancarlo Pellegrino - - PowerPoint PPT Presentation

May 06, 2023 291 likes •868 views

Compression Bombs Strike Back Giancarlo Pellegrino gpellegrino@mmci.uni-saarland.de BeNeLux OWASP Day 2016 November 25 th , Leuven, Belgium About Me Post doctoral researcher of the System Security group at CISPA, Saarland University,

slide-1
SLIDE 1

Compression Bombs Strike Back

Giancarlo Pellegrino

gpellegrino@mmci.uni-saarland.de

BeNeLux OWASP Day 2016 November 25th, Leuven, Belgium

slide-2
SLIDE 2

November 28, 2016 2

About Me

 Post doctoral researcher of the System Security group at

CISPA, Saarland University, Germany

 Research focus:

  • Web application security / security protocols
  • Vulnerability detection (logic vulns, Server-Side Requests Abuses,

CSRF)

 Former member of S3 group at EURECOM, Sophia-Antipolis,

France

 Former research associate in the Security & Trust research

group at SAP SE

slide-3
SLIDE 3

November 28, 2016 3

Introduction

 Modern applications rely on (core) network services, e.g., Web, email, and IM services

HTTP, json, XML, SOAP XMPP IMAP, POP3, SMTP

slide-4
SLIDE 4

November 28, 2016 4

Introduction

 Modern applications rely on (core) network services, e.g., Web, email, and IM services  Amount of exchanged data continues to increase steadily

  • More data → more transfer time → unresponsiveness → user unhappiness
slide-5
SLIDE 5

November 28, 2016 5

Introduction

 Modern applications rely on (core) network services, e.g., Web, email, and IM services  Amount of exchanged data continues to increase steadily

  • More data → more transfer time → unresponsiveness → user unhappiness
  • Avg web page size as Doom ~2.3MB [1]

[1] HTTP Archive: http://www.httparchive.org/interesting.php?a=All&l=Apr%201%202016

slide-6
SLIDE 6

November 28, 2016 6

Introduction

 Modern applications rely on (core) network services, e.g., Web, email, and IM services  Amount of exchanged data continues to increase steadily

  • More data → more transfer time → unresponsiveness → user unhappiness

 Solution 1: buy more bandwidth!

slide-7
SLIDE 7

November 28, 2016 7

Introduction

 Modern applications rely on (core) network services, e.g., Web, email, and IM services  Amount of exchanged data continues to increase steadily

  • More data → more transfer time → unresponsiveness → user unhappiness

 Solution 1: buy more bandwidth!

➔ Bandwidth costs

slide-8
SLIDE 8

November 28, 2016 8

Introduction

 Modern applications rely on (core) network services, e.g., Web, email, and IM services  Amount of exchanged data continues to increase steadily

  • More data → more transfer time → unresponsiveness → user unhappiness

 Solution 1: buy more bandwidth!

➔ Bandwidth costs

 Another solution is ...

slide-9
SLIDE 9

November 28, 2016 9

Introduction

 Modern applications rely on (core) network services, e.g., web, email, and IM services  Amount of exchanged data continues to increase steadily

  • More data → more transfer time → unresponsiveness → user unhappiness

 Solution 1: buy more bandwidth!

➔ Bandwidth costs

 Another solution is ...

Data compression! Data compression!

slide-10
SLIDE 10

November 28, 2016 10

Data Compression

 Reduces # of bits of a string by removing redundancy

  • lossless if decompr(compr(d)) = d or lossy if decompr(compr(d)) ~= d

 Lots of algorithms (See [1])  Among the most popular: Deflate [RFC 1951]

  • Implemented in libraries, e.g., zlib, or as a tool, e.g., gzip, and zip archive tool
  • Available in most of the programming languages

100KB 15KB

[1] SALOMON, D. Data Compression: The Complete Reference. Springer-Verlang, 2007.

slide-11
SLIDE 11

November 28, 2016 11

Compression in Protocols

 Compression used by network protocols to reduce message size  Mandated by protocol specifications

  • e.g., HTTP (response!) compression, IMAP, XMPP, SSH, PPP, and others

 Or implemented as custom feature

  • e.g., HTTP request compression

XMPP Compression [XEP-0138] IMAP Compression [RFC 4978] HTTP Compression [RFC 7230]

slide-12
SLIDE 12

November 28, 2016 12

Compression in HTTP (RFC 7230)

GET / HTTP/1.1 Host: wikipedia.org [...] HTTP Request

slide-13
SLIDE 13

November 28, 2016 13

Compression in HTTP (RFC 7230)

GET / HTTP/1.1 Host: wikipedia.org [...] HTTP/1.1 200 OK [...] Content-Length: 82170 Content-Type: text/html; charset=UTF-8 <!DOCTYPE html><html [...] Retrieve default HTML page ~80Kb of page HTTP Request HTTP Response

slide-14
SLIDE 14

November 28, 2016 14

Compression in HTTP (RFC 7230)

GET / HTTP/1.1 Host: wikipedia.org Accept-Encoding: gzip, deflate [...] HTTP Request

slide-15
SLIDE 15

November 28, 2016 15

Compression in HTTP (RFC 7230)

GET / HTTP/1.1 Host: wikipedia.org Accept-Encoding: gzip, deflate [...] HTTP/1.1 200 OK [...] Content-Length: 18879 Content-Type: text/html; charset=UTF-8 Content-Encoding: gzip %O 5 * # Ԟ [...] Select algorithm Response size -70% Compressed response body Decompress HTTP Request HTTP Response

slide-16
SLIDE 16

November 28, 2016 16

The Problem of Data Compression

 If not properly implemented, it can make application vulnerable to DoS  Risks:

1)Intensive task

  • Computationally intensive
  • If abused, it can stall an application

2)Data Amplification

  • Decompression increases the data to be processed (compression rate of zlib ~1:1024)
  • Internal components may not be designed to handle high volume of data

3)Unbalanced Client-Server Scenario

  • One party pre-compute compressed messages
  • The other one decompresses messages each time

 Popular examples from the past...

slide-17
SLIDE 17

November 28, 2016 17

The Past: Zip Bombs (1996)

 42 KB zip file → 4.5 PB uncompressed data  5 layers of nested zip files in blocks of 16, last layer with

text files of 4.3 GB each

 Cause Disk/Memory exhaustion  Sent as attachment to crash anti-virus

software

0.dll 1.dll 15.dll ... page0.zip doc0.zip chapter0.zip book0.zip lib0.zip page1.zip page15.zip 42.zip lib1.zip lib15.zip ... doc1.zip doc15.zip ... ... chapter1.zip chapter15.zip ... book1.zip book15.zip ... 4.3GB AAAAAAAAAA ... A 0.dll 1.dll 15.dll ... 4.5 PB

slide-18
SLIDE 18

November 28, 2016 18

The Past: Billion Laughs (2003)

 Resource exhaustion in libxml2 when processing nested XML entity definitions  810 bytes of XML document expanded to 3GB

<?xml version="1.0"?> <!DOCTYPE lolz [ <!ENTITY lol "lol"> <!ELEMENT lolz (#PCDATA)> <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"> <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;"> <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"> <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"> <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"> <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"> <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;"> <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;"> <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;"> ]> <lolz>&lol9;</lolz>

slide-19
SLIDE 19

November 28, 2016 19

The Past: Zip Bombs and Billion Laughs

<?xml version="1.0"?> <!DOCTYPE lolz [ <!ENTITY lol "lol"> <!ELEMENT lolz (#PCDATA)> <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"> <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;"> <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"> <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"> <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"> <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"> <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;"> <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;"> <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;"> ]> <lolz>&lol9;</lolz>

0.dll 1.dll 16.dll ... page0.zip doc0.zip chapter0.zip book0.zip lib0.zip page1.zip page16.zip 42.zip lib1.zip lib16.zip ... doc1.zip doc16.zip ... ... chapter2.zip chapter16.zip ... book2.zip book16.zip ... 4.3GB AAAAAAAAAA ... A 0.dll 1.dll 16.dll ...

This was 1996-2003! Now we know better, right? This was 1996-2003! Now we know better, right?

slide-20
SLIDE 20

November 28, 2016 20

The Present

 Reviewed protocol specs, design patterns, and coding rules

Unawareness of the risks, guidelines on handling data compression are missing or misleading

slide-21
SLIDE 21

November 28, 2016 21

The Present

 Reviewed protocol specs, design patterns, and coding rules

Unawareness of the risks, guidelines on handling data compression are missing or misleading

  • 1. Protocol specifications:

➔ No data compression handling issues, redirects to SSL/TLS (concerned with leakage and packet limits, but

unexplained how they apply to other protocols)

slide-22
SLIDE 22

November 28, 2016 22

The Present

 Reviewed protocol specs, design patterns, and coding rules

Unawareness of the risks, guidelines on handling data compression are missing or misleading

  • 1. Protocol specifications:

➔ No data compression handling issues, redirects to SSL/TLS (concerned with leakage and packet limits, but

unexplained how they apply to other protocols)

  • 2. Secure Design Patterns:
  • Patterns to solve vulns. during design phase : DoS Safety, Compartmentalization, and Small Process

➔ However, lack of the details to address implementation-level concerns

slide-23
SLIDE 23

November 28, 2016 23

The Present

 Reviewed protocol specs, design patterns, and coding rules

Unawareness of the risks, guidelines on handling data compression are missing or misleading

  • 1. Protocol specifications:

➔ No data compression handling issues, redirects to SSL/TLS (concerned with leakage and packet limits, but

unexplained how they apply to other protocols)

  • 2. Secure Design Patterns:
  • Patterns to solve vulns. during design phase : DoS Safety, Compartmentalization, and Small Process

➔ However, lack of the details to address implementation-level concerns

  • 3. Secure Coding Rules
  • Only one, i.e., Anti-Zip Bomb coding rule

➔ Sadly, incorrect

slide-24
SLIDE 24

November 28, 2016 24

The Present

 Reviewed protocol specs, design patterns, and coding rules

Unawareness of the risks, guidelines on handling data compression are missing or misleading

  • 1. Protocol specifications:

➔ No data compression handling issues, redirects to SSL/TLS (concerned with leakage and packet limits, but

unexplained how they apply to other protocols)

  • 2. Secure Design Patterns:
  • Patterns to solve vulns. During design phase : DoS Safety, Compartmentalization, and Small Process

➔ However, lack of the details to address implementation-level concerns

  • 3. Secure Coding Rules
  • Only one, i.e., Anti-Zip Bomb coding rule

➔ Sadly, incorrect

How does this lack of common knowledge and understanding affect implementations? How does this lack of common knowledge and understanding affect implementations?

slide-25
SLIDE 25

November 28, 2016 25

Impact on Implementations

slide-26
SLIDE 26

November 28, 2016 26

HTTP (Response) Compression (RFC 7230)

GET / HTTP/1.1 Host: wikipedia.org Accept-Encoding: gzip, deflate [...] HTTP/1.1 200 OK [...] Content-Length: 18879 Content-Type: text/html; charset=UTF-8 Content-Encoding: gzip %O 5 * # Ԟ [...] Select algoritm Response size -70% Compressed response body Decompress HTTP Request HTTP Response

slide-27
SLIDE 27

November 28, 2016 27

Compression Bombs against Web Browsers #1

GET / HTTP/1.1 Host: attacker.foo Accept-Encoding: gzip, deflate [...] HTTP/1.1 200 OK [...] Content-Length: 4000000 Content-Type: text/html; charset=UTF-8 Content-Encoding: gzip HTTP Request HTTP Response

4 GB of white spaces

Compression rate ~1:1000 See: Geoff Jones http://blog.cyberis.co.uk/2013/08/vulnerabilities-that-just-wont-die.html

slide-28
SLIDE 28

November 28, 2016 28

Compression Bombs against Web Browsers #1

GET / HTTP/1.1 Host: attacker.foo Accept-Encoding: gzip, deflate [...] HTTP/1.1 200 OK [...] Content-Length: 4000000 Content-Type: text/html; charset=UTF-8 Content-Encoding: gzip Decompress HTTP Request HTTP Response

4 GB of white spaces

Compression rate ~1:1000 See: Geoff Jones http://blog.cyberis.co.uk/2013/08/vulnerabilities-that-just-wont-die.html

slide-29
SLIDE 29

November 28, 2016 29

Compression Bombs against Web Browsers #2

GET / HTTP/1.1 Host: attacker.foo Accept-Encoding: gzip, deflate [...] HTTP/1.1 200 OK [...] Content-Length: 4000 Content-Type: text/html; charset=UTF-8 Content-Encoding: gzip, gzip HTTP Request HTTP Response

4 GB of white spaces

2 layers of compression! x1000 smaller See: Geoff Jones http://blog.cyberis.co.uk/2013/08/vulnerabilities-that-just-wont-die.html

slide-30
SLIDE 30

November 28, 2016 30

Compression Bombs against Web Browsers #2

GET / HTTP/1.1 Host: attacker.foo Accept-Encoding: gzip, deflate [...] HTTP/1.1 200 OK [...] Content-Length: 4000 Content-Type: text/html; charset=UTF-8 Content-Encoding: gzip, gzip HTTP Request HTTP Response

4 GB of white spaces

2 layers of compression! Decompress x1000 smaller See: Geoff Jones http://blog.cyberis.co.uk/2013/08/vulnerabilities-that-just-wont-die.html

slide-31
SLIDE 31

November 28, 2016 31

HTTP (Response) Compression Bombs

“Vulnerabilities that just won't die - Compression Bombs” by Geoff Jones

http://blog.cyberis.co.uk/2013/08/vulnerabilities-that-just-wont-die.html

Most are still vulnerable! Most are still vulnerable!

slide-32
SLIDE 32

November 28, 2016 32

How about servers?

? ?

slide-33
SLIDE 33

November 28, 2016 33

Experiments

 Case studies:

  • HTTP, XMPP, and IMAP servers

 Testbed:

Internal Monitor Implementation Linux 3.8 Kernel /proc External monitor Attackers

Compression bombs

slide-34
SLIDE 34

November 28, 2016 34

HTTP (request) Compression Bomb (SOAP)

 Case studies:

  • HTTP, XMPP, and IMAP servers

 Testbed:

Internal Monitor Implementation Linux 3.8 Kernel /proc External monitor Attackers

Compression bombs

~4 MB, ~1:1000 compr. ratio

POST /index.html HTTP/1.1 Content-Encoding: gzip \r\n <soapenv:Envelope> <soapenv:Body>[...]</soapenv:Body> </soapenv:Envelope> \r\n 4 GB of white spaces

compressed

Same for JSON Same for JSON

slide-35
SLIDE 35

November 28, 2016 35

XMPP Compression Bomb

 Case studies:

  • HTTP, XMPP, and IMAP servers

 Testbed:

Internal Monitor Implementation Linux 3.8 Kernel /proc External monitor Attackers

Compression bombs

~4 MB, ~1:1000 compr. ratio

<?xml version='1.0' ?> <stream:stream to='server' xmlns='jabber:client' Version='1.0'> 4 GB of white spaces

compressed

slide-36
SLIDE 36

November 28, 2016 36

IMAP Compression Bomb

 Case studies:

  • HTTP, XMPP, and IMAP servers

 Testbed:

Internal Monitor Implementation Linux 3.8 Kernel /proc External monitor Attackers

Compression bombs

~4 MB, ~1:1000 compr. ratio

From: sender@foo To: receiver@foo Subject : I am a bomb! 4 GB of white spaces

compressed

slide-37
SLIDE 37

November 28, 2016 37

Compression Bombs Everywhere

Protocol

Network Service

XMPP

OpenFire Prosody Tigase Ejabberd, jabberd2

HTTP

Apache HTTPD + mod_deflate

+ mod-php, CSJRPC, mod-gsoap, mod-dav

Apache Tomcat + 2Way/Webutilities filter

+ Apache CXF + json-rpc, lib-json-rpc + Axis2/ +jsonrpc4j

Axis 2 standalone gSOAP standalone

IMAP Dovecot, Cyrus

slide-38
SLIDE 38

November 28, 2016 38

Compression Bombs Everywhere

Protocol

Network Service

XMPP

OpenFire Prosody Tigase Ejabberd, jabberd2

HTTP

Apache HTTPD + mod_deflate

+ mod-php, CSJRPC, mod-gsoap, mod-dav

Apache Tomcat + 2Way/Webutilities filter

+ Apache CXF + json-rpc, lib-json-rpc + Axis2/ +jsonrpc4j

Axis 2 standalone gSOAP standalone

IMAP Dovecot, Cyrus

CVE-2014-2741 CVE-2014-2746 CVE-2014-0118

  • Notif. devel
  • Notif. devels

CVE-2014-2744/ -2745 CVE-2014-0109/ -0110

  • Notif. devel
slide-39
SLIDE 39

November 28, 2016 39

Pitfalls

slide-40
SLIDE 40

November 28, 2016 40

Pitfalls

  • 1. Implementation
  • 2. Specification
  • 3. Configuration
slide-41
SLIDE 41

November 28, 2016 41

Pitfalls

  • 1. Implementation
  • 2. Specification
  • 3. Configuration
  • Use of Compression before Authentication
  • Improper Input Validation during Decompression
  • Logging Decompressed Messages
  • Improper Inter-Units Communication
  • Unbounded Resource Usage (CPU and Memory)
  • Erroneous Best Practice
  • Misleading Documentation
  • API Specs Inconsistency
  • Insufficient Configuration Options
  • Insecure Default Values
  • Decentralized Configuration Parameters
slide-42
SLIDE 42

November 28, 2016 42

  • 1. Implementation
  • 2. Specification
  • 3. Configuration

Pitfalls

  • Use of Compression before Authentication
  • Improper Input Validation during Decompression
  • Logging Decompressed Messages
  • Improper Inter-Units Communication
  • Unbounded Resource Usage (CPU and Memory)
  • Erroneous Best Practice
  • Misleading Documentation
  • API Specs Inconsistency
  • Insufficient Configuration Options
  • Insecure Default Values
  • Decentralized Configuration Parameters
slide-43
SLIDE 43

November 28, 2016 43

  • 1. Implementation
  • 2. Specification
  • 3. Configuration

Pitfalls

  • Use of Compression before Authentication
  • Improper Input Validation during Decompression
  • Logging Decompressed Messages
  • Improper Inter-Units Communication
  • Unbounded Resource Usage (CPU and Memory)
  • Erroneous Best Practice
  • Misleading Documentation
  • API Specs Inconsistency
  • Insufficient Configuration Options
  • Insecure Default Values
  • Decentralized Configuration Parameters

Check out our paper! http://trouge.net/gp/papers/compr_usenix15.pdf Check out our paper! http://trouge.net/gp/papers/compr_usenix15.pdf

slide-44
SLIDE 44

November 28, 2016 44

Pitfalls at Implementation level

Valid. Decompr. Parser

Logger

Appl.

M evt evt evt

Authn.

evt

 Abstract message processing pipeline extracted from our case studies

slide-45
SLIDE 45

November 28, 2016 45

Compression before Authentication

 Inconsistent best practice

  • Mandatory in SSL/TLS, recommended in XMPP, and undefined in IMAP and HTTP
  • Implementation may diverge from the specs, i.e., OpenSSH

 Developers may underestimate the risk or overlook recommendations  Prosody accepted compressed messages before user authentication

➔ DoS by unauthenticated attackers

Valid. Decompr. Parser

Logger

Appl.

M evt evt evt

Authn.

evt

CVE-2014-2744

slide-46
SLIDE 46

November 28, 2016 46

Improper Input Validation during Decompression

 3 ways to validate a message:

  • Compressed message size
  • mod-deflate: If (compr. size > LimitRequestBody) → Reject

➔ However, hard to assess message size from its compressed form (1 MB compr → 1 GB decompr.)

Valid. Decompr. Parser

Logger

Appl.

M evt evt evt

Authn.

evt

CVE-2014-0118

mistake

slide-47
SLIDE 47

November 28, 2016 47

Improper Input Validation during Decompression

 3 ways to validate a message:

  • Compressed message size
  • mod-deflate: If (compr. size > LimitRequestBody) → Reject

➔ However, hard to assess message size from its compressed form (1 MB compr → 1 GB decompr.)

  • Decompression ratio
  • Patched mod-deflate: if (decompr ratio > threshold) → Reject

➔ Problem of ratio selection

Valid. Decompr. Parser

Logger

Appl.

M evt evt evt

Authn.

evt

mistake r i s k y

CVE-2014-0118

slide-48
SLIDE 48

November 28, 2016 48

Improper Input Validation during Decompression

 3 ways to validate a message:

  • Compressed message size
  • mod-deflate: If (compr. size > LimitRequestBody) → Reject

➔ However, hard to assess message size from its compressed form (1 MB compr → 1 GB decompr.)

  • Decompression ratio
  • Patched mod-deflate: if (decompr ratio > threshold) → Reject

➔ Problem of ratio selection

  • Decompressed message size
  • mod-deflate + mod-dav: If (decompr. size > LimitXMLRequestBody) → Reject

Valid. Decompr. Parser

Logger

Appl.

M evt evt evt

Authn.

evt

mistake correct r i s k y

CVE-2014-0118

slide-49
SLIDE 49

November 28, 2016 49

Improper Inter-Units Communication

 Upon exception, the pipeline halts and rejects message  mod-php and mod-gsoap limit the size of incoming (decompressed) message  … but had no means to halt mod-deflate

➔ mod-deflate keeps on decompressing data

  • Problem addressed in

Valid. Decompr. Parser

Logger

Appl.

M evt evt evt

Authn.

evt

CVE-2014-0118

slide-50
SLIDE 50

November 28, 2016 50

Logging Decompressed Messages

 Frequency and verbosity of log events can cause DoS  If exception is caused by compressed data, the needed resources may be underestimated  Upon invalid requests, Apache CXF logs first 100KB of incoming message

  • However, first it decompresses the entire message on a file, then logs the first 100KB

➔ DoS due to disk space exhaustion

Valid. Decompr. Parser

Logger

Appl.

M evt evt evt

Authn.

evt

CVE-2014-0109/ -0110

slide-51
SLIDE 51

November 28, 2016 51

Erroneous Best Practices (Spec. level)

 Only one code pattern specific for data compression

  • Rule: “IDS04-J. Safely extract files from ZipInputStream”
slide-52
SLIDE 52

November 28, 2016 52

Erroneous Best Practices (Spec. level)

 Only one code pattern specific for data compression

  • Rule: “IDS04-J. Safely extract files from ZipInputStream”

// Write the files to the disk, but // only if the file is not insanely big if (zipfile.getSize() > TOOBIG ) { throw new IllegalStateException("File to be unzipped is huge."); }

slide-53
SLIDE 53

November 28, 2016 53

Erroneous Best Practices (Spec. level)

 Only one code pattern specific for data compression

  • Rule: “IDS04-J. Safely extract files from ZipInputStream”

 .getSize() returns ZIP file header with uncompressed size

// Write the files to the disk, but // only if the file is not insanely big if (zipfile.getSize() > TOOBIG ) { throw new IllegalStateException("File to be unzipped is huge."); }

slide-54
SLIDE 54

November 28, 2016 54

Erroneous Best Practices (Spec. level)

 Only one code pattern specific for data compression

  • Rule: “IDS04-J. Safely extract files from ZipInputStream”

 .getSize() returns ZIP file header with uncompressed size  but ZIP headers not integrity protected!

➔ DoS countermeasure bypass // Write the files to the disk, but // only if the file is not insanely big if (zipfile.getSize() > TOOBIG ) { throw new IllegalStateException("File to be unzipped is huge."); }

  • Notif. Authors
slide-55
SLIDE 55

November 28, 2016 55

Conclusion

slide-56
SLIDE 56

November 28, 2016 56

Conclusion/Takeaway

 Compression bombs are back

➔ New vulnerabilities in popular network services

 ~20 years after the zip bombs, developers still unaware of the

risks of handling data compression

➔ 12 pitfalls which can be used by developers to build more

secure services