DOCSLIB.ORG

Compression Bombs Strike Back

Compression Bombs Strike Back

Compression Bombs Strike Back Giancarlo Pellegrino [email protected] BeNeLux OWASP Day 2016 November 25th, Leuven, Belgium About Me Post doctoral researcher of the System Security group at CISPA, Saarland University, Germany Research focus: ● Web application security / security protocols ● Vulnerability detection (logic vulns, Server-Side Requests Abuses, CSRF) Former member of S3 group at EURECOM, Sophia-Antipolis, France Former research associate in the Security & Trust research group at SAP SE November 28, 2016 2 Introduction HTTP, json, XML, SOAP IMAP, POP3, SMTP XMPP Modern applications rely on (core) network services, e.g., Web, email, and IM services November 28, 2016 3 Introduction Modern applications rely on (core) network services, e.g., Web, email, and IM services Amount of exchanged data continues to increase steadily ● More data → more transfer time → unresponsiveness → user unhappiness November 28, 2016 4 Introduction Modern applications rely on (core) network services, e.g., Web, email, and IM services Amount of exchanged data continues to increase steadily ● More data → more transfer time → unresponsiveness → user unhappiness ● Avg web page size as Doom ~2.3MB [1] [1] HTTP Archive: http://www.httparchive.org/interesting.php?a=All&l=Apr%201%202016 November 28, 2016 5 Introduction Modern applications rely on (core) network services, e.g., Web, email, and IM services Amount of exchanged data continues to increase steadily ● More data → more transfer time → unresponsiveness → user unhappiness Solution 1: buy more bandwidth! November 28, 2016 6 Introduction Modern applications rely on (core) network services, e.g., Web, email, and IM services Amount of exchanged data continues to increase steadily ● More data → more transfer time → unresponsiveness → user unhappiness Solution 1: buy more bandwidth! ➔ Bandwidth costs November 28, 2016 7 Introduction Modern applications rely on (core) network services, e.g., Web, email, and IM services Amount of exchanged data continues to increase steadily ● More data → more transfer time → unresponsiveness → user unhappiness Solution 1: buy more bandwidth! ➔ Bandwidth costs Another solution is ... November 28, 2016 8 Introduction Modern applications rely on (core) network services, e.g., web, email, and IM services Amount of exchangedDataData data continues compression!compression! to increase steadily ● More data → more transfer time → unresponsiveness → user unhappiness Solution 1: buy more bandwidth! ➔ Bandwidth costs Another solution is ... November 28, 2016 9 Data Compression 100KB 15KB Reduces # of bits of a string by removing redundancy ● lossless if decompr(compr(d)) = d or lossy if decompr(compr(d)) ~= d Lots of algorithms (See [1]) Among the most popular: Deflate [RFC 1951] ● Implemented in libraries, e.g., zlib, or as a tool, e.g., gzip, and zip archive tool ● Available in most of the programming languages [1] SALOMON, D. Data Compression: The Complete Reference. Springer-Verlang, 2007. November 28, 2016 10 Compression in Protocols IMAP Compression [RFC 4978] HTTP Compression [RFC 7230] XMPP Compression [XEP-0138] Compression used by network protocols to reduce message size Mandated by protocol specifications ● e.g., HTTP (response!) compression, IMAP, XMPP, SSH, PPP, and others Or implemented as custom feature ● e.g., HTTP request compression November 28, 2016 11 Compression in HTTP (RFC 7230) HTTP Request GET / HTTP/1.1 Host: wikipedia.org [...] November 28, 2016 12 Compression in HTTP (RFC 7230) HTTP Request GET / HTTP/1.1 Host: wikipedia.org [...] Retrieve default HTTP Response HTML page HTTP/1.1 200 OK ~80Kb of page [...] Content-Length: 82170 Content-Type: text/html; charset=UTF-8 <!DOCTYPE html><html [...] November 28, 2016 13 Compression in HTTP (RFC 7230) HTTP Request GET / HTTP/1.1 Host: wikipedia.org Accept-Encoding: gzip, deflate [...] November 28, 2016 14 Compression in HTTP (RFC 7230) HTTP Request GET / HTTP/1.1 Host: wikipedia.org Accept-Encoding: gzip, deflate [...] Select algorithm HTTP Response HTTP/1.1 200 OK Response size -70% [...] Content-Length: 18879 Content-Type: text/html; charset=UTF-8 Content-Encoding: gzip �%O�� 5 � * ���Ԟ � # [...] Compressed response body Decompress November 28, 2016 15 The Problem of Data Compression If not properly implemented, it can make application vulnerable to DoS Risks: 1)Intensive task ● Computationally intensive ● If abused, it can stall an application 2)Data Amplification ● Decompression increases the data to be processed (compression rate of zlib ~1:1024) ● Internal components may not be designed to handle high volume of data 3)Unbalanced Client-Server Scenario ● One party pre-compute compressed messages ● The other one decompresses messages each time Popular examples from the past... November 28, 2016 16 The Past: Zip Bombs (1996) 42.zip 42 KB zip file → 4.5 PB uncompressed data lib0.zip lib1.zip ... lib15.zip book0.zip book1.zip ...book15.zip 5 layers of nested zip files in blocks of 16, last layer with text files of 4.3 GB each chapter0.zip chapter1.zip ... chapter15.zip doc0.zip doc1.zip ... doc15.zip Cause Disk/Memory exhaustion page0.zip page1.zip ... page15.zip Sent as attachment to crash anti-virus 0.dll 1.dll ... 15.dll 0.dll 1.dll ... 15.dll software AAAAAAAAAA ... A 4.3GB 4.5 PB November 28, 2016 17 The Past: Billion Laughs (2003) Resource exhaustion in libxml2 when processing nested XML entity definitions <?xml version="1.0"?> <!DOCTYPE lolz [ <!ENTITY lol "lol"> <!ELEMENT lolz (#PCDATA)> <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"> <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;"> <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"> <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"> <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"> <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"> <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;"> <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;"> <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;"> ]> <lolz>&lol9;</lolz> 810 bytes of XML document expanded to 3GB November 28, 2016 18 The Past: Zip Bombs and Billion Laughs 42.zip <?xml version="1.0"?> lib0.zip lib1.zip ... lib16.zip <!DOCTYPE lolz [ <!ENTITY lol "lol"> <!ELEMENT lolz (#PCDATA)> <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"> book0.zip book2.zip ...book16.zip <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;"> <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">ThisThis waswas 1996-2003!1996-2003! <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"> chapter0.zip chapter2.zip ... chapter16.zip <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"> <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"> <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">NowNow wewe knowknow better,better, right?right? <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">doc0.zip doc1.zip ... doc16.zip <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;"> ]> <lolz>&lol9;</lolz> page0.zip page1.zip ... page16.zip 0.dll 1.dll ... 16.dll 0.dll 1.dll ... 16.dll AAAAAAAAAA ... A 4.3GB November 28, 2016 19 The Present Reviewed protocol specs, design patterns, and coding rules Unawareness of the risks, guidelines on handling data compression are missing or misleading November 28, 2016 20 The Present Reviewed protocol specs, design patterns, and coding rules Unawareness of the risks, guidelines on handling data compression are missing or misleading 1. Protocol specifications: ➔ No data compression handling issues, redirects to SSL/TLS (concerned with leakage and packet limits, but unexplained how they apply to other protocols) November 28, 2016 21 The Present Reviewed protocol specs, design patterns, and coding rules Unawareness of the risks, guidelines on handling data compression are missing or misleading 1. Protocol specifications: ➔ No data compression handling issues, redirects to SSL/TLS (concerned with leakage and packet limits, but unexplained how they apply to other protocols) 2. Secure Design Patterns: ● Patterns to solve vulns. during design phase : DoS Safety, Compartmentalization, and Small Process ➔ However, lack of the details to address implementation-level concerns November 28, 2016 22 The Present Reviewed protocol specs, design patterns, and coding rules Unawareness of the risks, guidelines on handling data compression are missing or misleading 1. Protocol specifications: ➔ No data compression handling issues, redirects to SSL/TLS (concerned with leakage and packet limits, but unexplained how they apply to other protocols) 2. Secure Design Patterns: ● Patterns to solve vulns. during design phase : DoS Safety, Compartmentalization, and Small Process ➔ However, lack of the details to address implementation-level concerns 3. Secure Coding Rules ● Only one, i.e., Anti-Zip Bomb coding rule ➔ Sadly, incorrect November 28, 2016 23 The Present Reviewed protocol specs, design patterns, and coding rules Unawareness of the risks, guidelines on handling data compression are missing or misleading 1. Protocol specifications: ➔ No data compression handling issues, redirects to SSL/TLS (concerned with leakage and packet

View Full Text

Details

  • File Type
    pdf
  • Upload Time
    -
  • Content Languages
    English
  • Upload User
    Anonymous/Not logged-in
  • File Pages
    56 Page
  • File Size
    -

Download

Channel Download Status
Express Download Enable

Copyright

We respect the copyrights and intellectual property rights of all users. All uploaded documents are either original works of the uploader or authorized works of the rightful owners.

  • Not to be reproduced or distributed without explicit permission.
  • Not used for commercial purposes outside of approved use cases.
  • Not used to infringe on the rights of the original creators.
  • If you believe any content infringes your copyright, please contact us immediately.

Support

For help with questions, suggestions, or problems, please contact us