The Stack Overflow podcast is back! Listen to an interview with our new CEO.
22

You want PHP's Fileinfo functions, which are the PHP moral equivalent of the Unix 'file' command. Be aware that typing a file is a murky area at best. Aim for whitelist ("this small set of types is okay") instead of blacklist ("no exes, no dlls, no ..."). Do not depend on file typing as your sole defense against malicious files.


22

It is not clear from your description why you want block these files exactly. I see the following possibilities: You want to block files that might infect the server itself. Unfortunately this can be about anything: shell, perl, python, awk, ... and of course compiled binaries. But to get these files executed without explicitly calling them with an ...


20

I have some suggestions: Use a separate domain. Host the images on a separate domain that is used only to host user-provided images. This will ensure that many browser-level attacks can have only limited effects. For instance, suppose the user's browser is vulnerable to content-type sniffing attacks, so it is possible to upload an image that some browsers ...


20

Video files by themselves can not contain a "virus" in the classical sense but they can be used to exploits bugs in the media players (or sometimes even the OS) when handling the file formats and codecs. By using these exploits they can then execute code. Like most video players vlc also has/had lots of bugs which could be exploited, including in the ...


16

Warning. The steps you describe are not enough to be safe, if those files are available from your servers. Explanation. Because browsers do content-sniffing in a variety of circumstances to guess at the appropriate MIME type, there are a variety of subtle cross-site scripting attacks that remain possible. The general category is sometimes known as content-...


16

What you're looking for is called deniable encryption. There are two forms of deniable encryption. The first sort is "information-theoretic" deniable encryption: encryption where no mathematical analysis an attacker can perform can prove that a file is encrypted data and not a collection of random bytes. The second sort is "real-world" deniable encryption:...


14

Don't block any specific MIME types. Block any kind of execution of the uploaded files. A simple way is to store uploaded files outside of the web root and serve them via scripting. If that's not possible, store files in a subdirectory and configure your server not to execute any scripts in that directory. Remember to do this for any scripting language that ...


13

No, you shouldn't reply the user-supplied MIME type to the user. The simplest attack that you're exposing your users to would be to upload text/html file with arbitrary Javascript code e.g. in [script] elements. Users given the uploaded file URL would have the Javascript executed, resulting in XSS. This can be somewhat mitigated by serving the files with ...


13

Yes, VLC can be hacked. Here you can check CVE list of VLC. But don't panic, just because your VLC freeze, that doesn't necessarily ​mean that someone hacked you. Make sure that your VLC is up to date. Can you submit that file to this website Cuckoo Sandbox and then paste the report here, just out of curiosity let us see, what will happen when that file is ...


12

Files have signatures or "magic numbers" embedded in them, usually near the beginning of the file. libmagic is a library which extracts a files signature and looks it up in a signature database. This is the way Unix type systems determine file types i.e. if you save a text file without an extension on Linux it will still automatically open with a text ...


10

The short answer: It is not safe. Allowing the user to specify the MIME type and the contents of the file is a self-inflicted XSS hole. A malicious user Mallory could specify the MIME type text/html, and provide a HTML document that contains malicious Javascript. When you serve that document to another user Alice, Alice's browser will execute the ...


9

The reason PDFs are preferred isn't security so much as a combination of technical capability and user expectation. The security of PDF and Word read only modes is about the same (which is to say, not very good, but good enough to prevent casual use.) Both files require a viewer on the other side, and there is both a Word and PDF viewer app for free, while ...


9

It must be noted that a file does not have an inherent "content-type" per se. A file is a bunch of bytes, and has a name. When you download a file from a Web server, the server infers a content-type (such as "application/pdf") from whatever clues it can find, mostly the so-called "extension" (the few letters at the end of the file name; e.g. ".pdf" is ...


8

Typically the problem is not due to uploading, but hosting and same-origin/malware issues. Imagine the following scenario: Alice uploads a file which is served from https://example.com/alice/foo. Bob uploads a file which is served from https://example.com/bob/bar. Charlie downloads .../alice/foo, and later downloads .../bob/bar. Alice and Bob are sharing ...


7

There are lots of examples for such polyglots, i.e. documents which are several file formats at the same time. Some examples apart from GIFAR are combining GIF and Javascript or Flash and JavaScript but there are lots and even more variants. A very good source for such stuff is Corcami and also the PoC||GTFO documents are known to be multiple kinds of ...


7

Where metadata is stored will be up to the OS and the file that created it (as you say about Notepad and Word docs). Some file types even create a separate file just to hold the metadata. Because of #1, there is no free "give me all the metadata" tool. There are tools that can find the metadata of a wide range of well-known file types, though. Because of #1, ...


6

PDF's can be locked to prevent editing. Docx can be protected. html - not so much. Sure, there are ways of getting round even the best copy protection, up to and including taking screenshots or even dictating the comment, but protecting PDF's pretty much works. At least in a business environment. I don't think that is why tech people think pdf is better. ...


6

Well, that's really a question for the makers of your email client to answer, but in general if software blocks every file attachment of a particular type then it is for one of four reasons: The file is directly executable, and so might have a virus in it The file is indirectly executable - e.g. a Word document might contain Macros that execute when you ...


6

One possible solution would be to re-write the file as a simple known format before displaying the image on the site. e.g. someone upload an image (possibly with an exploit), immediately, the server read the image in a secure way and write a new image. If the program/script that used to read the uploaded image read only color data, the new image can only ...


6

Are there any other filetype that I also should block? It doesn't matter, as finfo_file can be bypassed, see for example here: Encoding Web Shells in PNG IDAT chunks. mime_content_type doesn't seem to be more reliable either. You need to check for file extension in addition to the mimetype check, as it is a lot more reliable, as file names are a lot less ...


5

I assume when you say "image" you mean something like a JPEG or a GIF. The answer is that older software has bugs such that when they display the image, they can get confused. For example, images have comment fields inside them that are usually not displayed, but can contain things like the GPS coordinates of the iPhone camera that took the picture. Typical ...


5

The screenshot indicates that the Windows Attachment Manager has identified what it considers a possibly dangerous file from an external source and marked it. See http://support.microsoft.com/kb/883260 for information on what the Attachment Manager is and how to configure it. The Windows Attachment Manager will mark many types of files that could possibly ...


5

As a site owner, there is only so much you can do about it. The primary responsibility for protecting users from malicious documents lies with the software vendors who make the document viewers (e.g., Adobe, Microsoft, and potentially browser vendors). They are the ones with the opportunity to best help their users; your leverage is more limited. That ...


5

It sounds like you are concerned about viewing documents from an untrusted source (e.g., concerned about the risk that a malicious document might exploit a vulnerability in your PDF viewer, or in Word, or the like). That's a reasonable concern. If that's the concern, one way to mitigate it is to use Google Docs to view the document. Google Docs provides ...


5

Reading at your answers, what you want is called deniable encryption. It's done by hidding an encrypted container in another encrypted container. That is because when you encrypt, the cipher text looks like random if you don't know the key. Just by searching random in your harddrive, someone can have a good guess that you have encrypted some data and ask ...


5

The attack listed in the referenced question certainly would not work with VLC or Linux. VLC does not support the obscure Windows Media Player DRM it utilizes (at least not to my knowledge), and even if it did, the purpose of the attack is to trick you into downloading and running some Windows executable files. That being said, a different kind of attack is ...


4

There is no conception of file type. In computer world everything is a bunch of 0/1 and whether it is and image or a lot of random characters depends on how do you interpret your zeros and ones. File type (as an extension like .docx, .png) are just for the convenience of the user to be able to do an educated guess of what can it be and to open it with a ...


4

When I've had to tackle this before I've converted the file from it's source format into another and sometimes then to a third format. If Open/LibreOffice supports your document format you could just call it with --convert-to pdf. Then you can take that PDF and manipulate it further, eg using ImageMagick: convert source.pdf source-page-%d.jpg convert -page ...


4

I guess it depends on perspective? From the end-user standpoint, to protect against exploits (esp memory/buffer overflows) from images or any other source (again, that exploits buffer overflow vulnerabilities) would benefit from making sure memory protection features are fully enabled. In Windows, mechanisms like DEP (based on NX/XD) and ASLR among others ...


4

Probably not safe. There are various attacks that trick the content type sniffer into believing a file is the wrong content type. Here's a particularly infamous example: http://adblockplus.org/blog/the-hazards-of-mime-sniffing The suggestion of the previous poster is good for protecting your server from malicious scripts: move uploaded files outside of the ...


Only top voted, non community-wiki answers of a minimum length are eligible