Linux Doesn't Care What You Name Your Files (And That's a Security Problem)

Ayesha Abbas — Sat, 04 Jul 2026 06:45:45 +0000

While working through How Linux Works as part of my daily Linux study, I learned something that quietly rearranged how I think about files: Linux doesn't check whether a filename matches its content. At all.

You could rename a shell script to definitely_a_pdf.pdf, and Linux will run it exactly the same as if you'd been honest. The extension is just decoration, a label you're free to lie about.

That's also exactly how a lot of phishing attacks work. invoice.pdf.exe disguised as invoice.pdf. A convincing icon. A victim who trusts a filename instead of checking what the file actually is.

How files are actually identified

Every real file format has a signature, "magic bytes", at the very start of its content, completely independent of the filename:

PDFs start with %PDF-
JPEGs start with FF D8 FF
Linux executables (ELF) start with 7F 45 4C 46

Run file somefile.txt on Linux and it reads these bytes directly, telling you what something actually is, not what its name claims.

So I built a small detector

Instead of just reading about this, I wrote masq_detector, a small Python CLI that scans a directory, checks each file's real content against its claimed extension, and flags mismatches, specifically prioritizing files that are both disguised and directly executable.

pythonif is_dangerous_content and extension_mismatch:
severity = "HIGH"

That and wasn't there in my first version, I originally used or, which meant any executable got flagged, including perfectly honest .exe installers sitting in my Downloads folder. Running it against my real Downloads directory surfaced that false positive immediately, which was a good reminder that testing against real data catches design flaws that testing against toy examples never will.

What it actually does under the hood

It leans on the Unix file command for the actual content detection, no reason to reinvent decades of battle-tested magic-byte parsing. What I built is the layer on top: comparing that output against expected keywords per extension, and deciding what counts as a genuine threat versus a harmless mismatch.

Honest limitations

No ML, no fancy heuristics, just straightforward signature comparison
Linux/macOS only, since it depends on the file command
A learning project, not a production security tool

Why this mattered to me
I'm a CS student working toward graduation in 2028, currently deep in Linux and networking self-study, with cloud security as the direction I'm exploring next and a DAAD-funded Masters in Germany as the long-term goal. Small, fully-understood projects like this one feel like the right way to build toward that, not by making something impressive, but by making something I can actually explain, line by line.

Code: github.com/AyeshaAbbas-engg/masq_detector

What's a Linux "wait, that's how it works?" moment you've had recently? I'm collecting these.

5 Linux Commands Every Cybersecurity Student Must Know

Ayesha Abbas — Sun, 28 Jun 2026 17:28:59 +0000

I'm Ayesha Abbas, a CS student, specializing
in cybersecurity and cloud security. I use Linux every
single day for my projects and studies. Here are 5 commands
that I consider absolutely essential for anyone getting
started in cybersecurity.

netstat | See All Network Connections

netstat shows you every active network connection on
your system. As a cybersecurity student this is goldmine
information.

netstat -tulpn

This shows all open ports and which process is using them.
If something suspicious is listening on a port you didn't
open, you have a problem.

grep | Find Anything Inside Files

grep searches for patterns inside files. You will use
this hundreds of times every week.

grep -r "password" /var/log/

This searches every log file for the word "password".
Useful for log analysis, finding config values, and
security auditing.

chmod | Control File Permissions

chmod controls who can read, write, or execute a file.
Wrong permissions = security vulnerability.

chmod 600 private_key.pem

This makes your SSH key readable only by you. If your
key has wrong permissions, SSH will refuse to use it.

nmap | Scan Networks Like a Pro

nmap is the most famous network scanning tool in
cybersecurity. It maps open ports and services on
any target.

nmap -sV 192.168.1.1

This scans your router and shows every open port and
what service is running on it. Essential for
understanding your network.

Note: Only scan networks you own or have permission
to scan.

ss | The Modern netstat

ss is faster and more detailed than netstat. It shows
socket statistics in real time.

ss -tulpn

Use this to quickly see what's running on your machine.
I use this every morning when I boot up my Ubuntu system.

Final Thoughts

These 5 commands are just the beginning. Linux has
hundreds of powerful tools for cybersecurity. but
master these first and you will already be ahead of
most beginners.

I am currently studying networking and Linux full time
as part of my preparation for international research
programs.

Find my projects on GitHub:
https://github.com/AyeshaAbbas-engg

Stay secure. Keep learning.
— Ayesha Abbas

DEV Community: Ayesha Abbas

Linux Doesn't Care What You Name Your Files (And That's a Security Problem)

5 Linux Commands Every Cybersecurity Student Must Know