File Upload Security: Stopping Ransomware with Magic Bytes

Magic-byte analysis lowers ransomware risk in file uploads, but it does not stop it alone. It confirms what a file really is, instead of trusting its name. Below you will see how it works, where attackers bypass it, and which layers to add.

Why a file name tells you almost nothing

Most upload forms check the extension and move on. A file named invoice.pdf passes, even if it is a script or an executable renamed in two seconds.

The same applies to the content type your browser sends. It comes from the client, so an attacker controls it. Treat both values as hints, never as proof.

Ransomware rarely arrives as an obvious program. It often travels inside documents, archives or macro-enabled files that a person later opens on a work machine. The upload form is simply the door.

What magic bytes are and how the check works

Many file formats begin with a fixed sequence of bytes at the start of the file. This sequence is called a magic number or signature. A PDF starts with the text %PDF, and a PNG image starts with a specific eight-byte pattern.

Magic-byte analysis reads the first bytes of the uploaded data and compares them to a list of known signatures. If the file claims to be a PNG but begins with the signature of a Windows executable, you reject it.

The check is fast and needs no heavy tooling. Reading a small header is enough, so it adds almost no delay to the upload.

Where signature checks fail

A signature only describes the beginning of a file. An attacker can prepend valid image bytes to a malicious payload, creating a file that passes the check and still does harm. These are often called polyglot files.

Container formats add another gap. A ZIP archive or an Office document is a valid container, yet it can hold macros, scripts or nested archives inside. The outer signature looks perfectly normal.

The most common mistake is stopping here. Teams add the check, see rejected test files, and assume the problem is solved. It is one layer, not a defence.

Comparing the common validation methods

Each method catches a different kind of problem. The table shows what you gain and what you still miss with each one.

Layers that belong around the signature check

Start with an allow-list. Accept only the formats your business needs, such as PDF and JPEG, and refuse everything else by default. A short list shrinks your attack surface more than any clever filter.

Then scan the file with an up-to-date malware engine. For risky formats, open them in an isolated environment before anyone sees them. Strip macros from documents unless you truly need them.

Finally, store uploads away from the web root and rename them on arrival. Never let the server execute anything from the upload folder.

• Allow only the formats you actually use
• Verify magic bytes and compare them with the extension
• Scan every file with an updated malware engine
• Rename files and store them outside the web root
• Set a maximum size and block executable permissions

Limiting the damage if something slips through

No filter is perfect, so plan for failure. Keep uploaded files in a location with minimal permissions, so a compromised process cannot reach the rest of your network.

Backups matter most against ransomware. Keep copies that are offline or immutable, and test restoring them. A backup you have never restored is only a hope.

Log every upload with the user, time and result. When something odd appears, these records tell you who sent it and which files to isolate first.

Documents need an owner and a trail

Upload security is easier when files live in a managed system rather than scattered folders and email attachments. Clear access rights, versioning and approval steps reduce the chance that an unknown file reaches the wrong desk.

If your team handles quality records and controlled documents, a structured platform helps. You can see how Filezonia for quality and document management organises access and document flow.

Even then, keep the technical checks in place. Good process and good validation work together.

Audit your upload form this week

Open your current upload flow and test it. Rename a harmless text file to .pdf and see whether it is accepted. If it is, your validation relies on the name alone.

Next, add an allow-list, a magic-byte check and malware scanning, in that order. Move storage out of the web root and confirm that backups restore correctly.

Repeat the review whenever you add a new file type. Each new format brings new risks, and the check should grow with it.