The tag has no usage guidance.

learn more… | top users | synonyms

18
votes
4answers
3k views

Is VLC on Linux vulnerable to an attack from .wmv files designed to install viruses?

I was stupid and did not check a video file I downloaded from an untrustworthy source. It was .wmv file with no readable properties of the video. I know that .wmv videos can download viruses. What I ...
-1
votes
3answers
40 views

Forensic analysis of file metadata

Suppose I have received a file (doesn't matter what it is - document, image, video, audio, etc). I know that the operating system and also programs that create the file like Office, and even hardware ...
2
votes
2answers
394 views

Beside GIFAR are there any other known polyglot files? [closed]

A GIFAR file is a polyglot file with a fancy name. It can be "opened" both as a valid GIF file and a valid JAR file thus leading to security issues under certain circumstances. Definition of a GIFAR ...
8
votes
4answers
1k views

Making a Blacklist of filetypes to protect PHP application

I'm working in a PHP system where the user can upload files. I'm trying to protect the system from malicious codes, so I'm thinking about some type of blacklist of files that I've to block from ...
0
votes
3answers
76 views

Amateur society - What file type to use in email?

Suppose there is a small, non-profit, organisation; say a church or music society. They want to communicate with members, for example to distribute minutes of meetings. The members are have varying ...
2
votes
1answer
78 views

Thousands of files (png, pdf, tex, java, cpp, etc.) deleted on Mac OS X Yosemite

Yesterday, I noticed that, starting at 12:40, many thousands files had been automatically deleted from my drive. The computer is a Macbook Pro with a recent version of Mac OS X Yosemite. Since many ...
15
votes
8answers
1k views

Is it possible to prevent a file type from being determined in a Linux system?

I have several files on my Ubuntu system, which are LUKS encrypted partitions. For my own shame up to this day I thought that simply changing binary file's extension will be enough to hide what a file ...
17
votes
4answers
5k views

What is the corrupted image vulnerability? How does it work?

What exactly happens when someone injects malicious binary code into an image file (on Windows)? How is that done?
4
votes
1answer
769 views

What are the security risks associated with PDF files?

What are the security risks associated with PDF files? There is, of course, the general risk associated with any type of file: that whatever application is used to read it will have a bug that can be ...
2
votes
1answer
997 views

My MP3 file is blocked, but still playable?

My computer is telling me that my MP3 file is blocked: I have no problems playing the song, so I was wondering what exactly does it mean for my MP3 file to be blocked?
0
votes
1answer
215 views

Can I test/determine all decryption types on an unkown filetype. I do have the password [closed]

I have a file that's nearly 200Mb. It was reportedly packed/encrypted with Kruptos 2. But it has a .~enc extension. The header of the file is pure gibberish. Running file says it's data running ...
15
votes
5answers
6k views

Is there a way to check the filetype of a file uploaded using PHP?

I don't want it to just check the extension of the file as these can easily be forged even MIME types can be forged using tools like TamperData. So is there a better way to check file types in PHP ? ...
7
votes
5answers
2k views

Using PDF instead of doc(x) or html: safer?

Similar to the recent question about why we lock our computer, many people send documents as PDF file instead of a doc or html page because it would protect editing the document. And yes, it does add ...
5
votes
3answers
562 views

Why are PDFs less secure than other document formats?

My email client will flag up PDFs as potentially insecure, but won't do the same for other document formats such as PPTs. Why is this?
15
votes
4answers
1k views

Is it safe to store and replay user-provided mime types?

If a user uploads a file but modifies the request by setting the mime-type to something arbitrary, like "superdangerous/blackhatstuff", is it safe for me to send the same mime type back to a different ...
6
votes
5answers
1k views

How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?

My website will be hosting documents for end users and I would like to make this as secure as possible. Question Assuming that I have a need to share documents on a website that may contain hostile ...
8
votes
2answers
2k views

Why should I restrict the content type of files be uploaded to my site?

We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
21
votes
3answers
5k views

How can I be protected from pictures vulnerabilities?

I've just read this question What is the corrupted image vulnerability? How does it work? (GIFAR, EXIF data with javascript, etc..) I'm asking myself how can I protect myself and my website's users. ...
12
votes
3answers
3k views

Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?

We allow users to upload a number of files, all of which we either send over to scribd (doc, xls, ppts, etc) or display as a video ourselves (flv, mov, mp4, etc in flowplayer). To avoid users ...
9
votes
3answers
413 views

How to open a file from the Internet in a secure way?

Sometimes I have to open files (doc, zip, txt, pdf and some other) downloaded from the Internet (from unproven sites) on my computer. How could I mitigate the risk and open them in a more or less ...
4
votes
1answer
542 views

Do you know any .xry reader for MacOS/*BSD or Linux?

I am looking for a .xry reader (software) that works on mac/*bsd/linux in order to perform a forensic analysis. Can you suggest one?
10
votes
1answer
931 views

Which files are more insecure than others?

Regarding the fact (in case it's not always the proven fact, then an opinion) that there are types of files more safe for handling them after getting from the Internet than the other, i'd like to ask: ...