A renamed exe automatically running

Question

We are currently developing a web app that allows users to upload files to act as attachments to information they provide.

Obviously allowing users to upload any file types is very dangerous, therefore we're adding steps to stop certain files.

Primarily exe and zip. But the thought has occurred that a user could simply rename a .exe and give it another extension. So now we're thinking about checking the header file to ensure it's actually the file type it says it is, but is this actually necessary? Would there be a way for a user to change the extension and still have the file as malicious or auto running? Surely the change of extension would mean it was handled incorrectly by windows?

Answer 1

Obviously allowing users to upload any file types is very dangerous

Anything a user uploads is just 0s and 1s until you actually decide to do something with it. Executing such files would be a bad idea, yes.

Executable programs don't automatically run unless you tell them to, though. If you are wondering about the autorun behavior of certain storage media this is now restricted to only cds and dvds in modern versions of Windows and has nothing to do with your web app.

If you have a clear set of file types you are expecting, i.e. only images then it would be easy to build a whitelist of expected file signatures.

Building a blacklist of "bad" files is a complete waste of time in my opinion.

Excluding .exe files or changing their extension would prevent users from downloading files and shooting themselves in the foot but with a bit of social engineering malicious files can be hidden and used in very creative ways. See 4chan.js which was uploaded as a valid gif file for an example.

For that reason I wouldn't bother taking it much further than banning .exe extensions. This is not something that would be a problem for your web app directly and you're only responsible for protecting users up a point. You can't be expected to bubble wrap them from across the internet.