Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [compression]

the act of compression reduces the size of the file(s) being compressed by encoding information and eliminating statistical redundancy.

2
votes
1answer
57 views

What method to compress English by hand has the highest compression ratio? [closed]

Solitaire is a method for encrypting messages by hand. Reading it though, the only advantage the Solitaire has over a one time pad is that it can encrypt longer messages. It requires a new, random key ...
4
votes
1answer
243 views

How to protect websites against ZIP bombs and reference bombs?

A Zip bomb (concept here) seems quite a "smart" and easy vulnerability to websites where uploading ZIP files is allowed. Such sites are under a threat (at least to make some degree of damage to them) -...
0
votes
1answer
47 views

Can a compressed archive be constructed in a way to extract into system folders?

Using compression utilities, is it possible to create an archive that when extracted, will place certain files in certain areas on a users PC? For example, suppose if I wrote a virus or a malicious ...
0
votes
1answer
56 views

Which HTTP Compression should I use (and how?)

I know that there are multiple HTTP Compression tools out there. In order to entirely prevent a site from being susceptible to BREACH, which HTTP Compression algorithm should I use? Also, how ...
2
votes
1answer
54 views

How does CRIME work against cookies

Wiki on CRIME: CRIME <...> is a security exploit against secret web cookies RFC 2616 on Content-Encoding: The Content-Encoding entity-header <...> when present, its value indicates what &...
-5
votes
3answers
437 views

Which encryption algorithm allows for the less output data than source data? [duplicate]

I am trying to figure out how to get my source information to compile smaller using encrypted text. This could potentially change the game in transferring large-chunked data and offer security at the ...
0
votes
1answer
80 views

What is the algorithm for ARJ encrypted files?

I came across some password protected ARJ files. What is the algorithm for ARJ encrypted files ? How to decrypt them ?
0
votes
2answers
89 views

Best way to encrypt user data stored in xml?

First of all I am not very familiar with the world of encryption so please be nice. I have got a data that should store in an xml using NetDataContractSerializer. This xml file gets the size of from ...
1
vote
0answers
61 views

BREACH attack against SPA

I have a single page application that is hosted at example.com that relies on api.example.com. The SPA sends user credentials (JWT token) in authorization header for every request. Let's suppose ...
14
votes
1answer
437 views

JPEG artifacts leaking information about redacted contents

It was mentioned that JPEG should not be used between image creation and redaction of sensitive contents, because compression artifacts around the redacted area may leak information. Given how this ...
3
votes
2answers
283 views

SSL/TLS compression attacks on mail servers (smtp)

Currently, we know few compression attacks on the SSL/TLS protocol (such as Crime or Breach). I wonder for few days if these attacks are practicable on a mail server (smtp). Is CRIME attack ...
2
votes
1answer
43 views

Application control of HTTP content compression [closed]

How does an application control whether or not its http content is compressed? I am not talking about TLS level compression, but rather about the compression of https:// response bodies only. In ...
0
votes
2answers
139 views

How can I select a compression utility that is popular and secure enough

In a previous posting on Which is a safe way to transfer a copy of a sensitive document?, I have received suggestions to compress and encrypt an attachment file using the options of utilities such as ...
0
votes
0answers
23 views

Detectability of packing files in Windows 10

I follow the tutorial here: https://www.youtube.com/watch?v=g0RmclTe7Lo to pack calc.exe in windows 10 at C:\Windows\System32\calc.exe But I get the following error: What's the problem? It ...
2
votes
2answers
283 views

Encryption and Compression

I've read that encryption produces random data and compression works by removing patterns in data and as a consequence, encrypted data has high entropy. I'm a bit confused, though. The reason I'm ...
15
votes
8answers
11k views

Are 7-Zip password-protected split archives safe against hackers when they are password-protected a couple of times?

Imagine I wish to upload my sensitive personal information (photos, document scans, list of passwords, email backups, credit card information, etc.) on Google Drive (or any other cloud service). I ...
5
votes
2answers
2k views

What are some possible uses of a zip bomb?

This article claims that zip bombs cannot be used today as modern systems are too smart for it and no victim is going to slowly unpack terrabytes of data so zip bombs are basically useless. Is this ...
8
votes
1answer
937 views

Brotli compression for HTTPS

It appears that Chrome, Firefox, and soon Edge, support the new Brotli compression algorithm over HTTPS only. I can't find anything on whether this new compression algorithm is susceptible to the ...
4
votes
1answer
167 views

Are there valid reasons for compressed files (zip, gzip, etc.) to spoof file size?

Zip files, GZip files, and likely others, include information about the contained file, including the uncompressed size of the file. However, when extracting these files the number is meaningless as ...
0
votes
2answers
251 views

What are the implications of reversing hashes

Today it was posited to me that sha256 has a domain large enough to never encounter a collision and that because it is such a large domain and given that a reverse function was created for it, that ...
1
vote
0answers
357 views

Is it possible to obfuscate binaries with UPX or similar software?

Warez scene groups often compress their binary executables using UPX or similar software. I've heard somewhere that they do this to obscure the algorithms they use from other groups, but I find this ...
1
vote
4answers
238 views

Why browsers don't support TLS without encryption and deprecate compression for public data

These days we observes trend to use HTTP over TLS (HTTPS) for all communication. It recommend all weighty Internet service vendors and that claims to good practice. But TLS suite have 3 options for ...
3
votes
1answer
54 views

.NET extraction and storage of compression files concerns

I have been provided a specification for an enhancement to one of my companies software products to allow extraction of uploaded compression files (just Zip currently) that will save and migrate the ...
1
vote
0answers
88 views

The RAR archive format and authenticity verification [closed]

The changelog for RAR 5 mentions the following: Features removed: authenticity verification feature did not provide the required level of reliability and was removed; ... I didn't find any ...
1
vote
2answers
689 views

Various questions about file compression and encryption regarding hacking (zip, rar, 7z) [closed]

So I'm curious about a few aspects of compressed files (Zip, rar, 7z, etc), and how they impact hack-ability. There is enough on this subject that I'm not clear about (since this isn't a career of ...
0
votes
1answer
1k views

Base64 or HEX encoded? [closed]

I have this string encoded and compressed (link to full string) ...
1
vote
1answer
408 views

Decryping a RAR file with same password

I came across a problem very similar recently and wondered if anyone knew how to solve this. So say for example I have an RAR archive called archiveA.rar and a password to protect it the password is ...
7
votes
3answers
3k views

Encrypted password inside compressed archive

File compression utilities like Winrar or ZIP or 7zip encrypt the password and store it inside the archive. How safe is that? I mean you are giving away the archive with the password inside,it's not ...
3
votes
3answers
166 views

is g-zipping assets a security concern?

I recently noticed that the assets sent to clients aren't gzipped or minified on either my companies intranet or its public facing website. I brought this to the attention of the networking ...
4
votes
3answers
993 views

Security of decompression tools

How safe is it to decompress untrusted files with unrar-free? With unzip? I'm using debian jessie. What steps can be taken to minimize the threat while extracting the file's contents?
3
votes
1answer
258 views

Security risks of symmetric encryption with compression for database data

I would like to compress data before encrypting and storing it in a MySQL database to reduce especially bandwith requirements. In the future, the DB may be accessible via a web interface. Various ...
2
votes
2answers
145 views

Can BREACH be thwarted by simply adding a sort of “salt” into the page being compressed?

Django supplies GZip middleware, but the docs issue a stark warning about BREACH, which I had, hitherto, forgotten about. The first thought I had was that I should be able modify the middleware to ...
13
votes
3answers
7k views

Is gzipping content via TLS allowed?

So I have these few compression directives at http level in nginx: gzip on; gzip_http_version 1.1; gzip_vary on; I read that this should be avoided because of CRIME/BREACH attack, is this correct?
1
vote
3answers
201 views

CRIME attack - If Javascript can be injected on the attacked machine, why not directly sending the cookie to a remove server?

I read about the CRIME - How to beat the BEAST successor? question and answer, but I don't understand that: If Javascript can be injected and run on the attacked machine, why not directly sending the ...
101
votes
5answers
15k views

Can simply decompressing a JPEG image trigger an exploit?

The novel Daemon is frequently praised for being realistic in its portrayal rather than just mashing buzzwords. However, this struck me as unrealistic: Gragg's e-mail contained a poisoned JPEG of ...
1
vote
3answers
1k views

Disk level encryption + compression performance?

What are pros and cons for using disk level encryption like VeraCrypt and then turning on compression on mounted (virtually decrypted) drive? It seams to me that this can even increase some ...
3
votes
4answers
927 views

Which is more effective and 'secure': Compression+Encryption, or only Encryption?

This came up in an IRC discussion on freenode, and now I"m curious. The idea is that someone wants to determine whether or not encryption alone, or compression+encryption (with gpg/pgp being the ...
2
votes
2answers
188 views

Determine if compressed or encrypted [closed]

I have a bunch of network data and I would like to determine if it is either 1) encrypted or 2) compressed. I doubt it is both, but the potential exists. If I am assuming that the traditional ...
4
votes
1answer
4k views

Does encrypting a file make it larger?

I encrypted a Word document using Winrar by setting a password. Surprisingly the archive was larger than the original file (631 vs 614KB). I then tested to see what would happen if encryption wasn't ...
-2
votes
2answers
1k views

Can an compressed virus still do any harm to an OS [closed]

Let's say you have a piece of malware either as a standalone binary or hidden within a crafted image (two distinct cases). If I compress the standalone binary, can its mere presence as a compressed ...
3
votes
2answers
198 views

Could HTTPS-Attacks like CRIME be mitigated by changing the session cookie regularly?

I was just reading about CRIME which is an attack to steal sensitive information by creating requests. Could this attack be mitigated, if the Server wouldn't send the client the actual session key to ...
0
votes
1answer
495 views

Can any ECC field element be safely serialized as “compressed” and then restored as uncompressed?

I have a library that stores all its ECC Field Elements in uncompressed form, in a bloated Base64 XML format, and storage has become a concern. (We want to support QR code as a form factor,etc) ...
0
votes
1answer
305 views

Can I test/determine all decryption types on an unkown filetype. I do have the password [closed]

I have a file that's nearly 200Mb. It was reportedly packed/encrypted with Kruptos 2. But it has a .~enc extension. The header of the file is pure gibberish. Running file says it's data running ...
2
votes
1answer
832 views

Would it be possible to add additional files to a password protected zip 2.0 file

I don't have the ability to determine/recover the master password for a production system that uses zip 2 archives. However, I need to be able to add new files to existing encrypted archives. There ...
2
votes
2answers
540 views

How can I encrypt compressed data safely?

As mentioned in this particular answer, compressing data before encryption may lead to the CRIME attack, especially if the hacker has collected many similar versions of the transmitted data. Let's ...
44
votes
1answer
28k views

Does WinRAR leave traces of temporarily extracted files?

If I have an encrypted RAR file which will only open using a password, and I opened a file directly from within WinRAR by double clicking the file inside WinRAR, I assume that WinRAR will create a ...
2
votes
1answer
306 views

can you update a one-time pad, over one-time pad encryption (compressed)?

This might well be a silly question, but at the moment I've not thought of a reason it doesn't work. As I think is generally known, you should never re-use a one-time pad. But compression allows you ...
3
votes
1answer
2k views

Do the BEAST and CRIME attacks apply to an IMAP service?

While setting up the Dovecot IMAP service, I noticed that the default parameters are not optimal, it allows SSLv3 for example. Using Thomas Pournin's TestSSLServer.java program, I saw the following: ....
9
votes
2answers
2k views

Zlib DEFLATE decompression bomb

Can you give me an example of a short data string that, when decompressed using Zlib's DEFLATE method, expands to something much much longer? More precisely: what is the nastiest decompression bomb ...
4
votes
2answers
2k views

With BREACH attack, is session-based CSRF token still secure?

This is something I haven't been able wrap my head around, if BREACH allow leaking of information, do we have to mask or generate CSRF token in a time-based or per-request fashion to make it more ...