Skip to main content

Questions tagged [compression]

the act of compression reduces the size of the file(s) being compressed by encoding information and eliminating statistical redundancy.

Filter by
Sorted by
Tagged with
108 votes
5 answers
22k views

Can simply decompressing a JPEG image trigger an exploit?

The novel Daemon is frequently praised for being realistic in its portrayal rather than just mashing buzzwords. However, this struck me as unrealistic: Gragg's e-mail contained a poisoned JPEG of ...
JDługosz's user avatar
  • 1,139
55 votes
5 answers
50k views

Encryption and compression of Data

If we want both encryption and compression during transmission then what will be the most preferable order. Encrypt then compress Compress then encrypt
Ali Ahmad's user avatar
  • 4,844
46 votes
1 answer
53k views

Does WinRAR leave traces of temporarily extracted files?

If I have an encrypted RAR file which will only open using a password, and I opened a file directly from within WinRAR by double clicking the file inside WinRAR, I assume that WinRAR will create a ...
Nean Der Thal's user avatar
42 votes
4 answers
16k views

BREACH - a new attack against HTTP. What can be done?

Following on from CRIME, now we have BREACH to be presented at Black Hat in Las Vegas Thursday (today). From the linked article, it suggests that this attack against compression will not be as simple ...
JoltColaOfEvil's user avatar
22 votes
2 answers
5k views

Is compression mandatory with TLS?

I've had a look within the official TLS specification but I cannot see any mention of this. Does TLS allow compression to be disabled? Or is it mandatory?
intrigued_66's user avatar
18 votes
8 answers
16k views

Are 7-Zip password-protected split archives safe against hackers when they are password-protected a couple of times?

Imagine I wish to upload my sensitive personal information (photos, document scans, list of passwords, email backups, credit card information, etc.) on Google Drive (or any other cloud service). I ...
Neli's user avatar
  • 229
18 votes
3 answers
12k views

Is gzipping content via TLS allowed?

So I have these few compression directives at http level in nginx: gzip on; gzip_http_version 1.1; gzip_vary on; I read that this should be avoided because of CRIME/BREACH attack, is this correct?
Florian Schneider's user avatar
15 votes
4 answers
6k views

Is it safe for GPG to compress all messages prior to encryption by default?

By default, GPG compresses text during encryption. Additionally, RFC 4880 says: 2.3. Compression OpenPGP implementations SHOULD compress the message after applying the signature but before ...
Tom Marthenal's user avatar
15 votes
1 answer
979 views

JPEG artifacts leaking information about redacted contents

It was mentioned that JPEG should not be used between image creation and redaction of sensitive contents, because compression artifacts around the redacted area may leak information. Given how this ...
forest's user avatar
  • 66.9k
13 votes
2 answers
5k views

Zlib DEFLATE decompression bomb

Can you give me an example of a short data string that, when decompressed using Zlib's DEFLATE method, expands to something much much longer? More precisely: what is the nastiest decompression bomb ...
D.W.'s user avatar
  • 99.9k
11 votes
1 answer
2k views

Does it weaken the encryption of SSH to use compression?

When using compression on openssh (a la ssh -C ...), does this reduce entropy and make the tunnel traffic more vulnerable to cryptanalysis? Is compression an option I should disable server-side for ...
TopherIsSwell's user avatar
11 votes
1 answer
3k views

Brotli compression for HTTPS

It appears that Chrome, Firefox, and soon Edge, support the new Brotli compression algorithm over HTTPS only. I can't find anything on whether this new compression algorithm is susceptible to the ...
rink.attendant.6's user avatar
10 votes
1 answer
3k views

Whats the best custom compression method to use when I have SSL?

Suppose I have an application which does encryption using SSL and provided you cannot control what cipher suite is being negotiated, and assuming that I have some custom compression over the data ...
Cookies's user avatar
  • 203
9 votes
4 answers
5k views

With BREACH attack, is session-based CSRF token still secure?

This is something I haven't been able wrap my head around, if BREACH allow leaking of information, do we have to mask or generate CSRF token in a time-based or per-request fashion to make it more ...
bitinn's user avatar
  • 213
8 votes
3 answers
4k views

Encrypted password inside compressed archive

File compression utilities like Winrar or ZIP or 7zip encrypt the password and store it inside the archive. How safe is that? I mean you are giving away the archive with the password inside,it's not ...
microwth's user avatar
  • 2,483
8 votes
5 answers
5k views

Does a binary executable have to have some critical plain-text components?

When companies package binary executables, they are often encrypted, compressed, scrambled, and otherwise made so that your lazy hacker can't simply open the program up in Notepad++ and see the code. ...
asteri's user avatar
  • 1,905
8 votes
1 answer
3k views

How to protect websites against ZIP bombs and reference bombs?

A Zip bomb (concept here) seems quite a "smart" and easy vulnerability to websites where uploading ZIP files is allowed. Such sites are under a threat (at least to make some degree of damage to them) -...
T.Todua's user avatar
  • 2,727
7 votes
1 answer
11k views

Does encrypting a file make it larger?

I encrypted a Word document using Winrar by setting a password. Surprisingly the archive was larger than the original file (631 vs 614KB). I then tested to see what would happen if encryption wasn't ...
Celeritas's user avatar
  • 10.2k
7 votes
1 answer
855 views

How sensitive are acoustic side-channels to compression with a narrowband codec?

Assume sensitive audio emissions from a mechanical keyboard. These audio emissions are often sufficient to reconstruct the actual key presses that generated the sound. If the audio is compressed using ...
forest's user avatar
  • 66.9k
7 votes
2 answers
2k views

How to defeat CRIME, BREACH, TIME etc... server side (without sacrificing compression)

I am writing full-stack server side software and I have been researching CRIME attacks and it's relation to SPDY header compression as I am implementing the server side codecs for it at the moment. ...
user avatar
5 votes
2 answers
2k views

Compression and Encryption against security issues

I'm having a hard time knowing whether the following setup is vulnerable to CRIME/BREACH type attacks (which target HTTPS). I am running a Wireguard VPN that tunnels VXLAN protocol, using ChachaPoly20 ...
Orsiris de Jong's user avatar
5 votes
3 answers
2k views

Security of decompression tools

How safe is it to decompress untrusted files with unrar-free? With unzip? I'm using debian jessie. What steps can be taken to minimize the threat while extracting the file's contents?
Aryeh Leib Taurog's user avatar
5 votes
2 answers
3k views

How are websites actually mititating BREACH? (HTTPS + compression)

After reading some popular questions and answer on this website about BREACH, the only advice seems to be: don't compress anything that might contain secrets (including CSRF tokens). However, that ...
reed's user avatar
  • 15.8k
4 votes
2 answers
1k views

Encryption and Compression

I've read that encryption produces random data and compression works by removing patterns in data and as a consequence, encrypted data has high entropy. I'm a bit confused, though. The reason I'm ...
user6189164's user avatar
4 votes
2 answers
1k views

Does TLS 1.3 mitigate the BREACH vulnerability?

Section 5.4 of the TLS 1.3 specification describes record padding. One of the mitigations for BREACH is to add random padding. Therefore, I'm wondering: Does TLS 1.3 require random record padding? I'...
candrews's user avatar
  • 141
4 votes
2 answers
5k views

What are some possible uses of a zip bomb?

This article claims that zip bombs cannot be used today as modern systems are too smart for it and no victim is going to slowly unpack terrabytes of data so zip bombs are basically useless. Is this ...
Vegeta's user avatar
  • 41
4 votes
1 answer
2k views

Do the BEAST and CRIME attacks apply to an IMAP service?

While setting up the Dovecot IMAP service, I noticed that the default parameters are not optimal, it allows SSLv3 for example. Using Thomas Pournin's TestSSLServer.java program, I saw the following: ....
Lekensteyn's user avatar
  • 6,078
4 votes
1 answer
554 views

Is NTFS file compression vulnerable to a CRIME-like attack when using an encrypted volume?

I know that content compression can cause SSL to be vulnerable to the CRIME attack, via changes in the content length when injected plaintext matches existing content. Does this principle carry over ...
Polynomial's user avatar
  • 135k
4 votes
1 answer
473 views

Are there valid reasons for compressed files (zip, gzip, etc.) to spoof file size?

Zip files, GZip files, and likely others, include information about the contained file, including the uncompressed size of the file. However, when extracting these files the number is meaningless as ...
Tarka's user avatar
  • 141
4 votes
0 answers
928 views

Protection against JPEG compression bombs

There is a well-known threat named compression bombs. Such image formats as PNG and JPEG use compression methods, and therefore and in theory PNG/JPEG images might be a compression-bomb. I've found an ...
salazar324's user avatar
3 votes
4 answers
2k views

Which is more effective and 'secure': Compression+Encryption, or only Encryption?

This came up in an IRC discussion on freenode, and now I"m curious. The idea is that someone wants to determine whether or not encryption alone, or compression+encryption (with gpg/pgp being the ...
Thomas Ward's user avatar
3 votes
1 answer
834 views

Can Exchange/OWA still compress static images and be immune to HTTP compression attacks?

Microsoft Exchange / OWA (Outlook Web Access) allows for three different types of compression (link for Ex2010) Compression setting Description High Compresses both static and ...
makerofthings7's user avatar
3 votes
3 answers
238 views

is g-zipping assets a security concern?

I recently noticed that the assets sent to clients aren't gzipped or minified on either my companies intranet or its public facing website. I brought this to the attention of the networking ...
Luke's user avatar
  • 187
3 votes
1 answer
781 views

What steganographic techniques can I use in images that survive lossy compression?

Learning a bit about IT security, a segment of the material was the basics of steganography - specifically, hiding information in the lowest significance bits of images, and converting images into ...
sisisisi's user avatar
  • 193
3 votes
2 answers
733 views

SSL/TLS compression attacks on mail servers (smtp)

Currently, we know few compression attacks on the SSL/TLS protocol (such as Crime or Breach). I wonder for few days if these attacks are practicable on a mail server (smtp). Is CRIME attack ...
Arthur's user avatar
  • 33
3 votes
1 answer
4k views

Detect a server supporting SPDY?

With my current interest in the CRIME attack, I am currently trying to check if there actually exits a way to "fingerprint" a server that supports SPDY? My research lead me to believe only that the ...
Metahuman's user avatar
  • 493
3 votes
1 answer
274 views

How does CRIME work against cookies

Wiki on CRIME: CRIME <...> is a security exploit against secret web cookies RFC 2616 on Content-Encoding: The Content-Encoding entity-header <...> when present, its value indicates what ...
eddyP23's user avatar
  • 289
3 votes
2 answers
267 views

Could HTTPS-Attacks like CRIME be mitigated by changing the session cookie regularly?

I was just reading about CRIME which is an attack to steal sensitive information by creating requests. Could this attack be mitigated, if the Server wouldn't send the client the actual session key to ...
Falco's user avatar
  • 1,502
3 votes
1 answer
126 views

.NET extraction and storage of compression files concerns

I have been provided a specification for an enhancement to one of my companies software products to allow extraction of uploaded compression files (just Zip currently) that will save and migrate the ...
Cyassin's user avatar
  • 525
3 votes
1 answer
3k views

Would it be possible to add additional files to a password protected zip 2.0 file

I don't have the ability to determine/recover the master password for a production system that uses zip 2 archives. However, I need to be able to add new files to existing encrypted archives. There ...
Nick's user avatar
  • 437
3 votes
3 answers
833 views

Does compression level influence security of encryted 7z files?

I want to archive some GB of sensitive data. It is to be stored on an external drive that also includes non sensitive data so i don't want to encrypt the whole drive. For that purpose i want to use ...
WiCloverS18's user avatar
3 votes
1 answer
556 views

Security risks of symmetric encryption with compression for database data

I would like to compress data before encrypting and storing it in a MySQL database to reduce especially bandwith requirements. In the future, the DB may be accessible via a web interface. Various ...
azren's user avatar
  • 141
2 votes
1 answer
571 views

can you update a one-time pad, over one-time pad encryption (compressed)?

This might well be a silly question, but at the moment I've not thought of a reason it doesn't work. As I think is generally known, you should never re-use a one-time pad. But compression allows you ...
pacifist's user avatar
  • 814
2 votes
1 answer
555 views

Decryping a RAR file with same password

I came across a problem very similar recently and wondered if anyone knew how to solve this. So say for example I have an RAR archive called archiveA.rar and a password to protect it the password is ...
munim_R's user avatar
  • 23
2 votes
2 answers
1k views

How can I encrypt compressed data safely?

As mentioned in this particular answer, compressing data before encryption may lead to the CRIME attack, especially if the hacker has collected many similar versions of the transmitted data. Let's ...
Naftuli Kay's user avatar
  • 6,793
2 votes
2 answers
396 views

Can BREACH be thwarted by simply adding a sort of "salt" into the page being compressed?

Django supplies GZip middleware, but the docs issue a stark warning about BREACH, which I had, hitherto, forgotten about. The first thought I had was that I should be able modify the middleware to ...
orokusaki's user avatar
  • 1,362
2 votes
2 answers
491 views

Determine if compressed or encrypted [closed]

I have a bunch of network data and I would like to determine if it is either 1) encrypted or 2) compressed. I doubt it is both, but the potential exists. If I am assuming that the traditional ...
zz3star90's user avatar
2 votes
1 answer
110 views

Application control of HTTP content compression [closed]

How does an application control whether or not its http content is compressed? I am not talking about TLS level compression, but rather about the compression of https:// response bodies only. In ...
Frugal Guy's user avatar
2 votes
1 answer
198 views

Does storing your files as single compressed archives compromise integrity?

Compressing your files as tar.gz or zip for storage or backup saves space and is faster than handling thousands of files. But it looks like small corruptions in the archive, for example because of ...
Strapakowsky's user avatar
  • 3,089
2 votes
3 answers
2k views

Disk level encryption + compression performance?

What are pros and cons for using disk level encryption like VeraCrypt and then turning on compression on mounted (virtually decrypted) drive? It seams to me that this can even increase some ...
watbywbarif's user avatar