Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [file-types]

The tag has no usage guidance.

1
vote
2answers
172 views

How does an OS execute code from a PNG file? [duplicate]

A recent bug in Android allows a hacker to execute code that is contained within an image file. Here is the quote from the Android Security Bulletin, The most severe vulnerability in this section ...
0
votes
2answers
58 views

Can I file download server specify what logo the file will have on the user's computer?

Is it possible for a download to specify it's own icon (as a file in the GUI)? So for example, if I download a file called foo.dmg can I make it show up (in the download bar or in the explorer) as a ...
0
votes
2answers
184 views

File carving JPG exif data files

So I'm very new to info sec overall but I would say I am least experienced in Digital forensics, anyway I recently had the opportunity to work with professionals and we did manual file carving. This ...
-5
votes
3answers
203 views

Difference between phpp, php, and phP? [closed]

I came across a ctf challenge where php file upload was restricted but phpp and phP were not. What other formats can php be uploaded in and what is the difference?
-1
votes
1answer
84 views

Can mp3 files be malicious? [duplicate]

I have an old computer that I don't use for anything important or sensitive. I occasionally download music on this old computer and transfer the mp3 files from a usb onto my primary computer. These ...
1
vote
0answers
31 views

How to assign not-PDF file by digital certificate?

XML, EPUB, etc. formats need also to be signed by digital certificate, like in the PDF's certificate-based signatures. There are reliable open-standards and open-source software to accomplish it? PS: ...
4
votes
1answer
632 views

What is the format of an X9.62 key?

RFC8292 contains this gem: The "k" parameter includes an ECDSA public key [FIPS186] in uncompressed form [X9.62] that is encoded using base64url encoding [RFC7515]. There is an example of the use of ...
2
votes
1answer
82 views

What kind of encryption is this file using? It used to be plain text

I was collecting data and building a database from a mobile game on Android. Here's an after/before image. If I do CTRL + A and copy paste on the left side, all information gets copied to clipboard ...
1
vote
0answers
2k views

Can .mp4 files contain viruses? [duplicate]

An .mp4 file is a common file extension which wraps movies, video clips, etc. Can this file contain viruses? Or, to rephrase the question, if I open it with a common video player (such as Windows ...
0
votes
1answer
492 views

EML file type analysis

I'm working on finding infection points in EML file format. Want to know on what grounds does a scanner declare an email as spam or attachment as malicious? I mean does it scan by MIME content or any ...
0
votes
2answers
214 views

Why are .URL and .WSH files considered dangerous?

Why are windows files with the extension ".url" and ".wsh" considered dangerous (e.g. blocked by many mail filters)? The way I see it: .URL: you can link to a malicious website which serves an ...
2
votes
1answer
40 views

What is an electronic document in the context of encryption?

I'm reading about a Public key certificate: In cryptography, a public key certificate, also known as a digital certificate or identity certificate, is an electronic document used to prove the ...
1
vote
2answers
797 views

Changing file extensions in PHP file upload to prevent code execution?

I think in a PHP file upload it is a best practice to store files outside of the document root with a randomly generated file name and telling the server to make them non-executable, so the file will ...
0
votes
3answers
209 views

Can a file named “agreement.execds.pdf” really contain an executable file?

What can anyone tell me about a file named "agreement.execds.pdf"? My email filter will not let this file pass because it blocks incoming EXE files. Is this an executable file? The file is actually a ...
5
votes
1answer
189 views

Is there a need to scan images with real-time scanners anymore?

Historically, there were some exploits for certain types of image files, notably JPEG images. Consequently, many real-time malware scanners (antivirus included) started scanning every JPEG image (as ...
1
vote
2answers
648 views

Various questions about file compression and encryption regarding hacking (zip, rar, 7z) [closed]

So I'm curious about a few aspects of compressed files (Zip, rar, 7z, etc), and how they impact hack-ability. There is enough on this subject that I'm not clear about (since this isn't a career of ...
3
votes
1answer
539 views

Is there a ransomware variant that checks for file's magic numbers to encrypt?

Is there a known ransomware-variant (Cryptolocker, Cryptowall etc.) that before encrypting the files checks for their magic numbers? Lets say that there's a Word file, that had its file extension ...
1
vote
1answer
464 views

Blacklisting accepted file extensions: how careful do I need to be

Currently working on a web application which allows users to upload files onto one of our Windows servers. The application is built in ASP.NET MVC with a MySQL backend. The uploaded files are not ...
2
votes
2answers
728 views

Can you trace someone through picture header information?

I learned that jpg, png, bmp and most image files contain headers and plain text in them. I decided to open a jpg file in Notepad and saw a bunch of information and I was wondering if there was a way ...
21
votes
4answers
6k views

Is VLC on Linux vulnerable to an attack from .wmv files designed to install viruses? [duplicate]

I was stupid and did not check a video file I downloaded from an untrustworthy source. It was .wmv file with no readable properties of the video. I know that .wmv videos can download viruses. What I ...
0
votes
4answers
716 views

Forensic analysis of file metadata

Suppose I have received a file (doesn't matter what it is - document, image, video, audio, etc). I know that the operating system and also programs that create the file like Office, and even hardware ...
2
votes
2answers
2k views

Beside GIFAR are there any other known polyglot files? [closed]

A GIFAR file is a polyglot file with a fancy name. It can be "opened" both as a valid GIF file and a valid JAR file thus leading to security issues under certain circumstances. Definition of a GIFAR ...
9
votes
4answers
3k views

Making a Blacklist of filetypes to protect PHP application

I'm working in a PHP system where the user can upload files. I'm trying to protect the system from malicious codes, so I'm thinking about some type of blacklist of files that I've to block from ...
0
votes
3answers
82 views

Amateur society - What file type to use in email?

Suppose there is a small, non-profit, organisation; say a church or music society. They want to communicate with members, for example to distribute minutes of meetings. The members are have varying ...
2
votes
1answer
169 views

Thousands of files (png, pdf, tex, java, cpp, etc.) deleted on Mac OS X Yosemite

Yesterday, I noticed that, starting at 12:40, many thousands files had been automatically deleted from my drive. The computer is a Macbook Pro with a recent version of Mac OS X Yosemite. Since many ...
15
votes
8answers
2k views

Is it possible to prevent a file type from being determined in a Linux system?

I have several files on my Ubuntu system, which are LUKS encrypted partitions. For my own shame up to this day I thought that simply changing binary file's extension will be enough to hide what a file ...
7
votes
1answer
3k views

What are the security risks associated with PDF files?

What are the security risks associated with PDF files? There is, of course, the general risk associated with any type of file: that whatever application is used to read it will have a bug that can be ...
0
votes
1answer
304 views

Can I test/determine all decryption types on an unkown filetype. I do have the password [closed]

I have a file that's nearly 200Mb. It was reportedly packed/encrypted with Kruptos 2. But it has a .~enc extension. The header of the file is pure gibberish. Running file says it's data running ...
16
votes
6answers
12k views

Is there a way to check the filetype of a file uploaded using PHP?

I don't want it to just check the extension of the file as these can easily be forged even MIME types can be forged using tools like TamperData. So is there a better way to check file types in PHP ?
8
votes
5answers
3k views

Using PDF instead of doc(x) or html: safer?

Similar to the recent question about why we lock our computer, many people send documents as PDF file instead of a doc or html page because it would protect editing the document. And yes, it does add ...
5
votes
3answers
1k views

Why are PDFs less secure than other document formats?

My email client will flag up PDFs as potentially insecure, but won't do the same for other document formats such as PPTs. Why is this?
8
votes
5answers
2k views

How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?

My website will be hosting documents for end users and I would like to make this as secure as possible. Question Assuming that I have a need to share documents on a website that may contain hostile ...
9
votes
2answers
3k views

Why should I restrict the content type of files be uploaded to my site?

We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
19
votes
4answers
2k views

Is it safe to store and replay user-provided mime types?

If a user uploads a file but modifies the request by setting the mime-type to something arbitrary, like "superdangerous/blackhatstuff", is it safe for me to send the same mime type back to a different ...
25
votes
3answers
7k views

How can I be protected from pictures vulnerabilities?

I've just read this question What is the corrupted image vulnerability? How does it work? (GIFAR, EXIF data with javascript, etc..) I'm asking myself how can I protect myself and my website's users. ...
2
votes
1answer
1k views

My MP3 file is blocked, but still playable?

My computer is telling me that my MP3 file is blocked: I have no problems playing the song, so I was wondering what exactly does it mean for my MP3 file to be blocked?
15
votes
3answers
5k views

Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?

We allow users to upload a number of files, all of which we either send over to scribd (doc, xls, ppts, etc) or display as a video ourselves (flv, mov, mp4, etc in flowplayer). To avoid users ...
4
votes
1answer
849 views

Do you know any .xry reader for MacOS/*BSD or Linux?

I am looking for a .xry reader (software) that works on mac/*bsd/linux in order to perform a forensic analysis. Can you suggest one?
21
votes
4answers
8k views

What is the corrupted image vulnerability? How does it work?

What exactly happens when someone injects malicious binary code into an image file (on Windows)? How is that done?
12
votes
1answer
1k views

Which files are more insecure than others?

Regarding the fact (in case it's not always the proven fact, then an opinion) that there are types of files more safe for handling them after getting from the Internet than the other, i'd like to ask: ...
9
votes
3answers
491 views

How to open a file from the Internet in a secure way?

Sometimes I have to open files (doc, zip, txt, pdf and some other) downloaded from the Internet (from unproven sites) on my computer. How could I mitigate the risk and open them in a more or less ...