I Came to Drop Bombs: Auditing the Compression Algorithm Weapon Cache
summary
Demonstrates concrete decompression bombs and measurements: a 25,500×25,500 JPEG 103 bytes that crashes Preview, nested archives like 42.zip → 4.5 PB expansion, and zero-generated 10 GB test files used to compare compressors. bzip2 yields the highest ratios, 7z/xz and Brotli score well, LZ4 is fastest but weakest; Zopfli PNG makes image bombs practical. Releases a reusable test corpus at bomb.codes library and recommends cgroups, output-size and image-dimension limits, separate worker processes, and dynamic testing; supplies GZip Bloat and Burp Image Extension as test tools.
AI-written summary · about
chapters (30)
- 0:00Introduction
- 0:49Topics
- 0:59About Me
- 1:17What is a decompression bomb
- 1:28JPEG demo
- 2:00Preview crashes
- 2:28History
- 2:59Misconceptions
- 3:51Silicon Valley
- 4:52Zip Bomb
- 6:47Zip Cache
- 7:10Compression Ratio
- 10:01Security 101
- 10:56Image bombs
- 11:16JPEG2000
- 11:35ZapFly
- 12:16PNG
- 13:02Image Dimensions
- 14:14Separate Workers
- 15:33HTTP Bombs
- 15:55broadly
- 16:34crash
- 17:16zip
- 17:28compression chart
- 18:12limiting resources
- 18:26limiting compression ratio
- 19:41testing
- 20:20burp image extension
- 20:44bombedcodes
- 22:07discussion
related talks
27mxz/liblzma backdoor Bash obfuscation explained
34mWhat We Learned Dissecting the World's Most Popular Containers
12mMy ZIP isn't your ZIP: Identifying and Exploiting Semantic Gaps Between ZIP
50mContainer Attack Surface Reduction Beyond Name Space Isolation
47mDenial of Service with a Fistful of Packets: Exploiting Algorithmic Complexity Vulnerabilities
33mMalicious Compliance Automated: Building Secure Containers and Obfusca...
41mAdventures in analyzing a backdoor in xz/liblzma
40m"Willy Wonka and the Secure Container Factory"