Hot answers tagged

20

You want PHP's Fileinfo functions, which are the PHP moral equivalent of the Unix 'file' command. Be aware that typing a file is a murky area at best. Aim for whitelist ("this small set of types is okay") instead of blacklist ("no exes, no dlls, no ..."). Do not depend on file typing as your sole defense against malicious files.


20

It is not clear from your description why you want block these files exactly. I see the following possibilities: You want to block files that might infect the server itself. Unfortunately this can be about anything: shell, perl, python, awk, ... and of course compiled binaries. But to get these files executed without explicitly calling them with an ...


19

Video files by themselves can not contain a "virus" in the classical sense but they can be used to exploits bugs in the media players (or sometimes even the OS) when handling the file formats and codecs. By using these exploits they can then execute code. Like most video players vlc also has/had lots of bugs which could be exploited, including in the ...


18

I have some suggestions: Use a separate domain. Host the images on a separate domain that is used only to host user-provided images. This will ensure that many browser-level attacks can have only limited effects. For instance, suppose the user's browser is vulnerable to content-type sniffing attacks, so it is possible to upload an image that some ...


16

What you're looking for is called deniable encryption. There are two forms of deniable encryption. The first sort is "information-theoretic" deniable encryption: encryption where no mathematical analysis an attacker can perform can prove that a file is encrypted data and not a collection of random bytes. The second sort is "real-world" deniable ...


13

Warning. The steps you describe are not enough to be safe, if those files are available from your servers. Explanation. Because browsers do content-sniffing in a variety of circumstances to guess at the appropriate MIME type, there are a variety of subtle cross-site scripting attacks that remain possible. The general category is sometimes known as ...


12

No, you shouldn't reply the user-supplied MIME type to the user. The simplest attack that you're exposing your users to would be to upload text/html file with arbitrary Javascript code e.g. in [script] elements. Users given the uploaded file URL would have the Javascript executed, resulting in XSS. This can be somewhat mitigated by serving the files with ...


12

Don't block any specific MIME types. Block any kind of execution of the uploaded files. A simple way is to store uploaded files outside of the web root and serve them via scripting. If that's not possible, store files in a subdirectory and configure your server not to execute any scripts in that directory. Remember to do this for any scripting language that ...


11

Files have signatures or "magic numbers" embedded in them, usually near the beginning of the file. libmagic is a library which extracts a files signature and looks it up in a signature database. This is the way Unix type systems determine file types i.e. if you save a text file without an extension on Linux it will still automatically open with a text ...


10

Such an attack relies on the image parser containing a bug that allows the execution of what would otherwise be a slightly wacky picture. For example, instead of "red" being interpreted as a color, the computer may try to interpret it as a shell command.


10

Yes, VLC can be hacked. Here you can check CVE list of VLC. But don't panic, just because your VLC freeze, that doesn't necessarily ​mean that someone hacked you. Make sure that your VLC is up to date. Can you submit that file to this website Cuckoo Sandbox and then paste the report here, just out of curiosity let us see, what will heppen when that file is ...


9

It must be noted that a file does not have an inherent "content-type" per se. A file is a bunch of bytes, and has a name. When you download a file from a Web server, the server infers a content-type (such as "application/pdf") from whatever clues it can find, mostly the so-called "extension" (the few letters at the end of the file name; e.g. ".pdf" is ...


8

The short answer: It is not safe. Allowing the user to specify the MIME type and the contents of the file is a self-inflicted XSS hole. A malicious user Mallory could specify the MIME type text/html, and provide a HTML document that contains malicious Javascript. When you serve that document to another user Alice, Alice's browser will execute the ...


8

The reason PDFs are preferred isn't security so much as a combination of technical capability and user expectation. The security of PDF and Word read only modes is about the same (which is to say, not very good, but good enough to prevent casual use.) Both files require a viewer on the other side, and there is both a Word and PDF viewer app for free, while ...


8

Typically the problem is not due to uploading, but hosting and same-origin/malware issues. Imagine the following scenario: Alice uploads a file which is served from https://example.com/alice/foo. Bob uploads a file which is served from https://example.com/bob/bar. Charlie downloads .../alice/foo, and later downloads .../bob/bar. Alice and Bob are ...


8

The best way to open such files is by running them inside a sandbox. I would suggest a virtual machine. Regarding which kind of files are safe, one can make two distinctions. In practice, files like zip, txt, jpg, png, etc are safe. Files like .exe, .msi, .com, .bat, .vbs, etc etc are unsafe. However, there is one big issuge with "safe" files, it is ...


8

Much more common than a buffer-overflow type bug that @Zian mentions (though I think there was a WMF vuln of this sort in Windows as recently as 4-5 years ago), is something like GIFAR (also search on SO): a file that is both a valid image file (e.g. GIF), and a valid ZIP file (e.g. JAR (compiled java bytecode)). This is possible because of the way these ...


7

Typically the "insecurity" of files comes into play when they are accessed, not just by having them downloaded. Downloading a file unopened and having it pwn your computer is the stuff of Hollywood and science fiction (as far as I know, though there may be research into this too). Thus, to understand the problem, the real question is not about the file ...


7

There are lots of examples for such polyglots, i.e. documents which are several file formats at the same time. Some examples apart from GIFAR are combining GIF and Javascript or Flash and JavaScript but there are lots and even more variants. A very good source for such stuff is Corcami and also the PoC||GTFO documents are known to be multiple kinds of ...


6

Well, that's really a question for the makers of your email client to answer, but in general if software blocks every file attachment of a particular type then it is for one of four reasons: The file is directly executable, and so might have a virus in it The file is indirectly executable - e.g. a Word document might contain Macros that execute when you ...


6

One possible solution would be to re-write the file as a simple known format before displaying the image on the site. e.g. someone upload an image (possibly with an exploit), immediately, the server read the image in a secure way and write a new image. If the program/script that used to read the uploaded image read only color data, the new image can only ...


6

PDF's can be locked to prevent editing. Docx can be protected. html - not so much. Sure, there are ways of getting round even the best copy protection, up to and including taking screenshots or even dictating the comment, but protecting PDF's pretty much works. At least in a business environment. I don't think that is why tech people think pdf is better. ...


5

I assume when you say "image" you mean something like a JPEG or a GIF. The answer is that older software has bugs such that when they display the image, they can get confused. For example, images have comment fields inside them that are usually not displayed, but can contain things like the GPS coordinates of the iPhone camera that took the picture. Typical ...


5

The screenshot indicates that the Windows Attachment Manager has identified what it considers a possibly dangerous file from an external source and marked it. See http://support.microsoft.com/kb/883260 for information on what the Attachment Manager is and how to configure it. The Windows Attachment Manager will mark many types of files that could possibly ...


5

It sounds like you are concerned about viewing documents from an untrusted source (e.g., concerned about the risk that a malicious document might exploit a vulnerability in your PDF viewer, or in Word, or the like). That's a reasonable concern. If that's the concern, one way to mitigate it is to use Google Docs to view the document. Google Docs provides ...


5

Reading at your answers, what you want is called deniable encryption. It's done by hidding an encrypted container in another encrypted container. That is because when you encrypt, the cipher text looks like random if you don't know the key. Just by searching random in your harddrive, someone can have a good guess that you have encrypted some data and ask ...


5

Are there any other filetype that I also should block? It doesn't matter, as finfo_file can be bypassed, see for example here: Encoding Web Shells in PNG IDAT chunks. mime_content_type doesn't seem to be more reliable either. You need to check for file extension in addition to the mimetype check, as it is a lot more reliable, as file names are a lot ...


5

The attack listed in the referenced question certainly would not work with VLC or Linux. VLC does not support the obscure Windows Media Player DRM it utilizes (at least not to my knowledge), and even if it did, the purpose of the attack is to trick you into downloading and running some Windows executable files. That being said, a different kind of attack is ...


4

As a site owner, there is only so much you can do about it. The primary responsibility for protecting users from malicious documents lies with the software vendors who make the document viewers (e.g., Adobe, Microsoft, and potentially browser vendors). They are the ones with the opportunity to best help their users; your leverage is more limited. That ...



Only top voted, non community-wiki answers of a minimum length are eligible