Block File Type Mismatch
File type mismatching is a deception technique where attackers disguise malicious executables as harmless documents by manipulating file extensions or metadata. Users believing they're opening a PDF or image file inadvertently execute malware.
Defend With SquareX
Create a file download policy to Block file type mismatch.
Example Policy
Follow These Steps
- Click on Launch Attack Simulation button
- Download "3gp sample file.pdf" file
- With SQRX enabled, file will be blocked
Details
File type mismatching is a deception technique where attackers disguise malicious executables as harmless documents by manipulating file extensions or metadata. This method exploits operating systems' display behaviors to hide dangerous file types behind innocent extensions like .pdf or .jpg. Blocking file type mismatched downloads through file type inspection helps identify when the actual file content doesn't match its claimed extension, preventing users from unknowingly executing malware.
Impact
When users believe they're opening a harmless document but actually execute malicious code, attackers gain unauthorized access to systems and sensitive information. The deception undermines user trust and can lead to cascading security breaches across networks, potentially resulting in ransomware attacks or complete organizational compromise.
Indicator of Compromise (IOC)
- Downloaded files with extensions that don’t match their true MIME type.
- Unusual executable activity from files labeled as documents or media.
- Security tool alerts on mismatched file headers vs. displayed extension.