Biggest image in the smallest space • Hacker News Board

Re: Biggest image in the smallest space

#31

Post by semi-extrinsic » Wed, Sep 02, 2015, 1:16 PM UTC

If you follow the "related reading" link on the bottom of TFA, you come to a page by Glenn Randers-Pehrson discussing how libpng deals with decompression bombs. On the bottom of that page you find the following curious note; anyone know what to make of it?

""" [Note for any DHS people who have stumbled upon this site, be aware that this is a cybersecurity issue, not a physical security issue. Feel free to contact me at to discuss it.] """

Re: Biggest image in the smallest space

#32

Post by silon7 » Wed, Sep 02, 2015, 1:17 PM UTC

jerf wrote: post #30

michaelmior wrote: post #2

Actually, it decompresses to a 5.8MB PNG. However, many graphics programs may choose to use three bytes per pixel when rendering the image and because it has incredibly large dimensions, this representation would take up 141GB of RAM.

One of the rules of secure programming is that any program that is used in an even remotely security-sensitive context, and anything displaying a Portable Network Graphic is likely to be used in such a context, must be able to specify resource usage limits. In this case that could be dimensions or a limit on the total RAM allowed to be used. Limits need not be hard, either, but could produce a query, for instance, th…

ulimit may help. Perhaps it could (maybe already is) be added to Chrome per-tab process.

Not sure of Windows equivalent, Microsoft has deprecated Windows System Resource Manager, not sure of a good equivalent (except going fully to Linux).

Re: Biggest image in the smallest space

#33

Post by saalweachter » Wed, Sep 02, 2015, 1:19 PM UTC

semi-extrinsic wrote: post #31

If you follow the "related reading" link on the bottom of TFA, you come to a page by Glenn Randers-Pehrson discussing how libpng deals with decompression bombs. On the bottom of that page you find the following curious note; anyone know what to make of it? """ [Note for any DHS people who have stumbled upon this site, be aware that this is a cybersecurity issue, not a physical security issue. Feel free to contact me…

He's presumably had problems with people confusing "decompression bombs" with the blowy-up kind and sending him panicky e-mails.

Re: Biggest image in the smallest space

#34

Post by fennecfoxen » Wed, Sep 02, 2015, 1:20 PM UTC

semi-extrinsic wrote: post #31

If you follow the "related reading" link on the bottom of TFA, you come to a page by Glenn Randers-Pehrson discussing how libpng deals with decompression bombs. On the bottom of that page you find the following curious note; anyone know what to make of it? """ [Note for any DHS people who have stumbled upon this site, be aware that this is a cybersecurity issue, not a physical security issue. Feel free to contact me…

What to make of it? Seems clear enough; he's (half-jokingly?) afraid that someone in the federal government will see the page and think "oh no! bombs! explosions! TERRORISM!" and identify more clearly that this is only a computer analogy.

Re: Biggest image in the smallest space

#35

Post by nerdy » Wed, Sep 02, 2015, 1:21 PM UTC

semi-extrinsic wrote: post #31

If you follow the "related reading" link on the bottom of TFA, you come to a page by Glenn Randers-Pehrson discussing how libpng deals with decompression bombs. On the bottom of that page you find the following curious note; anyone know what to make of it? """ [Note for any DHS people who have stumbled upon this site, be aware that this is a cybersecurity issue, not a physical security issue. Feel free to contact me…

I think it is related to the word "bomb" existing on the page

Re: Biggest image in the smallest space

#36

Post by pierrec » Wed, Sep 02, 2015, 1:24 PM UTC

jerf wrote: post #30

michaelmior wrote: post #2

Actually, it decompresses to a 5.8MB PNG. However, many graphics programs may choose to use three bytes per pixel when rendering the image and because it has incredibly large dimensions, this representation would take up 141GB of RAM.

One of the rules of secure programming is that any program that is used in an even remotely security-sensitive context, and anything displaying a Portable Network Graphic is likely to be used in such a context, must be able to specify resource usage limits. In this case that could be dimensions or a limit on the total RAM allowed to be used. Limits need not be hard, either, but could produce a query, for instance, th…

You're overdoing it a bit. I believe the most popular API/library for server-side manipulation of images is ImageMagick, and it has a few options for specifying limits that will easily protect against decompression bombs.

That being said, even with these limits, it's undeniable that something like ImageMagick still has a very large attack surface (especially since it uses many third-party libraries), so it should run in its own heavily unprivileged or sandboxed process.

Re: Biggest image in the smallest space

#37

Post by Cyph0n » Wed, Sep 02, 2015, 1:35 PM UTC

quarterto wrote: post #16

sulami wrote: post #14

Earlier quoted context omitted.

The file that decompresses to itself is a work of art. How does one even go about to create something like this?

Like this: http://research.swtch.com/zip . Fascinating read.

Written by THE Russ Cox?

Re: Biggest image in the smallest space

#38

Post by logicallee » Wed, Sep 02, 2015, 1:37 PM UTC

>The image is almost entirely zeroes, with a secret message in the center.

too pressed for time, did anyone look? What is it?

Re: Biggest image in the smallest space

#39

Post by userbinator » Wed, Sep 02, 2015, 1:40 PM UTC

jerf wrote: post #30

michaelmior wrote: post #2

Actually, it decompresses to a 5.8MB PNG. However, many graphics programs may choose to use three bytes per pixel when rendering the image and because it has incredibly large dimensions, this representation would take up 141GB of RAM.

One of the rules of secure programming is that any program that is used in an even remotely security-sensitive context, and anything displaying a Portable Network Graphic is likely to be used in such a context, must be able to specify resource usage limits. In this case that could be dimensions or a limit on the total RAM allowed to be used. Limits need not be hard, either, but could produce a query, for instance, th…

Now, go find an API/library for dealing with PNGs that allow you to pass in such a limit

The article itself links to http://libpng.sourceforge.net/decompression_bombs.html

These new libpng versions do not impose any arbitrary limits, on the memory consumption and number of ancillary chunks, but they do allow applications to do so via the png_set_chunk_malloc_max() and png_set_chunk_cache_max() functions, respectively.

Re: Biggest image in the smallest space

#40

Post by AndrewStephens » Wed, Sep 02, 2015, 1:41 PM UTC

I used to work on a scanning SMTP/HTTP proxy and even back then it wasn't unknown for people to send crafted decompression bombs to attempt to crash the services. We handled it by estimating the total uncompressed size upfront (including sub archives) and throwing out anything with a suspiciously large compression ratio.

I imagine that .pdf files are another avenue for mischief. They contain lots of chunks which may be compressed in varying ways.