Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I created a slideshow and mentioned that user must not trust URL based on file extension, however, I got some claims against that, because URL's like this should be safe:

  • example.com/images/pic001.jpg
  • example.com/files/cv.pdf
  • example.com/media/track2.mp3

As I knew using Apache Mod Rewrite attacker can redirect any URL with any extension to executable file by direct download, at that case, only Antivirus can protect user when clicked on any link, so,

What are risks of URL's generally?

How to check if the URL not a link to malware before download?

share|improve this question
add comment

3 Answers

up vote 8 down vote accepted

Even images may contain malware, for instance a lot of embedded devices have been jail broken via vulnerabilities in libtiff.

More than that, URL extensions will not always match the real file name. The value may be rewritten by HTTP headers in server response like this one:

Content-Disposition: filename="myfile.exe"

share|improve this answer
1  
+1 for content-disposition –  Filip Haglund Jul 21 '13 at 8:47
add comment

I don't think you can really trust any URL just by looking at it (taking URLs in general).

You could use a service like Virus Total to scan it

https://www.virustotal.com/en/#url

That is still not fool proof though.

share|improve this answer
1  
Please be aware that VirusTotal is now owned by Google. Just sayin'... (insert twisted evil grin here) –  Deer Hunter Jul 21 '13 at 8:26
    
I guess we should create a new start up! –  Casey Jul 21 '13 at 15:05
add comment
  1. Reputation - Obviously you can put a little more trust into big names like facebook.com or google.com when compared to clickhereforfreeporn.com. Reputation isn't foolproof though, sites can be hacked. However, reputable sites should (hopefully) put a little more effort into securing their stuff so I won't worry about it too much. If I do get a malware, I'll just let my AV deal with it or wipe my machine in the worst case scenario.

  2. Scan it with VirusTotal before clicking the URL. Obviously this is a pain in the ass and it is not something you can expect users to do before clicking on every single link in front of them. It's also not foolproof as VirusTotal cannot not detect every single piece of malware out there.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.