The tag has no usage guidance.

learn more… | top users | synonyms

21
votes
3answers
4k views

How can I be protected from pictures vulnerabilities?

I've just read this question What is the corrupted image vulnerability? How does it work? (GIFAR, EXIF data with javascript, etc..) I'm asking myself how can I protect myself and my website's users. ...
17
votes
4answers
5k views

What is the corrupted image vulnerability? How does it work?

What exactly happens when someone injects malicious binary code into an image file (on Windows)? How is that done?
16
votes
8answers
1k views

Is it possible to prevent a file type from being determined in a Linux system?

I have several files on my Ubuntu system, which are LUKS encrypted partitions. For my own shame up to this day I thought that simply changing binary file's extension will be enough to hide what a file ...
15
votes
4answers
1k views

Is it safe to store and replay user-provided mime types?

If a user uploads a file but modifies the request by setting the mime-type to something arbitrary, like "superdangerous/blackhatstuff", is it safe for me to send the same mime type back to a different ...
14
votes
5answers
6k views

Is there a way to check the filetype of a file uploaded using PHP?

I don't want it to just check the extension of the file as these can easily be forged even MIME types can be forged using tools like TamperData. So is there a better way to check file types in PHP ? ...
12
votes
3answers
3k views

Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?

We allow users to upload a number of files, all of which we either send over to scribd (doc, xls, ppts, etc) or display as a video ourselves (flv, mov, mp4, etc in flowplayer). To avoid users ...
11
votes
1answer
841 views

Which files are more insecure than others?

Regarding the fact (in case it's not always the proven fact, then an opinion) that there are types of files more safe for handling them after getting from the Internet than the other, i'd like to ask: ...
9
votes
3answers
396 views

How to open a file from the Internet in a secure way?

Sometimes I have to open files (doc, zip, txt, pdf and some other) downloaded from the Internet (from unproven sites) on my computer. How could I mitigate the risk and open them in a more or less ...
8
votes
4answers
1k views

Making a Blacklist of filetypes to protect PHP application

I'm working in a PHP system where the user can upload files. I'm trying to protect the system from malicious codes, so I'm thinking about some type of blacklist of files that I've to block from ...
8
votes
2answers
2k views

Why should I restrict the content type of files be uploaded to my site?

We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
7
votes
5answers
1k views

Using PDF instead of doc(x) or html: safer?

Similar to the recent question about why we lock our computer, many people send documents as PDF file instead of a doc or html page because it would protect editing the document. And yes, it does add ...
6
votes
5answers
1k views

How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?

My website will be hosting documents for end users and I would like to make this as secure as possible. Question Assuming that I have a need to share documents on a website that may contain hostile ...
5
votes
3answers
520 views

Why are PDFs less secure than other document formats?

My email client will flag up PDFs as potentially insecure, but won't do the same for other document formats such as PPTs. Why is this?
4
votes
1answer
514 views

Do you know any .xry reader for MacOS/*BSD or Linux?

I am looking for a .xry reader (software) that works on mac/*bsd/linux in order to perform a forensic analysis. Can you suggest one?
2
votes
1answer
964 views

My MP3 file is blocked, but still playable?

My computer is telling me that my MP3 file is blocked: I have no problems playing the song, so I was wondering what exactly does it mean for my MP3 file to be blocked?
2
votes
1answer
65 views

Thousands of files (png, pdf, tex, java, cpp, etc.) deleted on Mac OS X Yosemite

Yesterday, I noticed that, starting at 12:40, many thousands files had been automatically deleted from my drive. The computer is a Macbook Pro with a recent version of Mac OS X Yosemite. Since many ...
2
votes
1answer
594 views

What are the security risks associated with PDF files?

What are the security risks associated with PDF files? There is, of course, the general risk associated with any type of file: that whatever application is used to read it will have a bug that can be ...
0
votes
3answers
73 views

Amateur society - What file type to use in email?

Suppose there is a small, non-profit, organisation; say a church or music society. They want to communicate with members, for example to distribute minutes of meetings. The members are have varying ...
-1
votes
1answer
189 views

Can I test/determine all decryption types on an unkown filetype. I do have the password [closed]

I have a file that's nearly 200Mb. It was reportedly packed/encrypted with Kruptos 2. But it has a .~enc extension. The header of the file is pure gibberish. Running file says it's data running ...