Invisible Ink of Compression

The talk looks at DEFLATE, the algorithm behind gzip, PNG and HTTP compression, and argues that its format leaves room for behavior a normal compressor would never produce. It opens with a captured HTTP stream where one copy looks ordinary and another carries extra content in unused parts of the encoding. The LZ77 back-reference mechanism is explained with a short sentence example, and edge cases are then tested by hand-crafting bitstreams and decoding them in CyberChef and infgen-style tools.

Several odd results follow. Back-references that reach beyond the available data produce null bytes, which the speaker traces to how gzip copies memory. Huffman tables can carry unused symbols, or be shaped so the compressed data is entirely printable. Other demos include a gzip file that newer versions reject but older ones extract, a self-referencing archive, a boot-sector puzzle, and a PNG variant where pixel values stay the same while the encoding changes.

To counter this, the speaker built a detector called deflate defector that flags anomalies such as unnecessary literal runs, empty blocks, unused Huffman symbols and statistically implausible code lengths. The closing section covers plans to scan for anomalies in the wild and possible browser or web tooling. The takeaway for defenders is that compressed content can hold data that ordinary decompression will not reveal.