I asked this question and was quickly down-voted and redacted. In that question I included the DNS domain names, javascript files and the link to the malicious payload.

Question

Since this previous Meta.SE question says it's OK to post exploit code, why did I get downvoted and have the exploit code I linked to redacted?

Should I have downloaded and embedded the malicious code?

My rationale

I included the URLs for 6 reasons

  • The links were not "clickable". No http:// prefix and I formatted them using code view.

  • The URLs are common in this instance of the attack. This could enhance SEO for anyone searching for anything similar.

  • Perhaps there is a Whois search type where I can find a common registrant and block all their domains

  • The meta discussion I linked to above says exploit code is conditionally permitted. A hyperlink is one degree of separation. Does this imply I should have pasted the actual code of the target?

  • The "real" malicious code has been taken down and responds with a 503 gateway down error.

  • I included instructions on how to safely view the contents of the URL using Malzilla, with a hyperlink.

In this case I was asking for specific, not general assistance and took every possible precaution. It seems inconsistent that we permit the detailed posting of exploits that happen within a computer program, but disallow linking to URLs that are the same. I think this type of question will become more relevant over time as the web-based APIs become more popular.

share
3  
If they're on a Security.SE site and there is a potentially malicious website posted they should be at least smart enough to sandbox the website. –  ekaj Nov 28 '12 at 4:34
add comment

2 Answers

up vote 5 down vote accepted

Why were you downvoted? Who knows? Only the down-voter can answer that. People are able to down-vote for any reason they like, including personal whim or because they were feeling grumpy that day or because they don't like you. I know it can be annoying. I don't have much more to say on that, so let's move on to the policy question, of what this site ought to encourage/discourage:

The policy question. I don't think it's necessarily wrong or impermissible or inappropriate to post exploit code or identify malicious sites. I think it depends upon the circumstances. I do think there are some good practices you should follow if you are going to post links to malicious sites or snippets of malicious code:

  • Ask yourself, is it really necessary to post this information? Is it really very likely that this information will help someone provide a better answer, or is it just window-dressing?

  • Ask yourself, am I putting people at risk? For instance, including a clickable link to a known-malicious site is not a good idea, as people might accidentally click on it and get pwned. If you really need to identify the site, you can still provide a URL without making it clickable. Also, if you know that the link is malicious, provide a prominent warning next to it.

  • Ask yourself, am I making the question more useful to others, or less useful? One of the purposes of this site is to create archival-quality answers to questions of broad interest. (In other words, it's not just about helping you -- that's one goal, but another goal is to document answers that may help others.) Posting a specific malware link/sample risks making your question a lot narrower in scope and more localized in time. So, ask yourself: will posting the link increase the odds of getting general answers that will be broad utility to lots of other users, or will it have the effect of reducing the utility of answers by tending to make people focus in narrowly on a single malware sample?

    Malware comes and goes. I expect that in most cases, it is more helpful to generalize and ask the general question, rather than to post a question about a single malicious site/malware sample. Thus, if you find yourself wanting/needing to post a malware link, that's a red flag that should trigger you to ask yourself whether your question might be too narrow and whether you can generalize your question.

In general, I would be reluctant to post malicious links in most cases. I certainly accept that there might be some situations where they are appropriate ... but I also expect that, for the reasons listed above, in most cases you won't need to post malicious links and indeed removing the malicious links may lead to a better question.

Your specific post. I don't think you did anything wrong in the way you posted some malware links. You did take steps to avoid putting people at risk, and that's laudable. You did exactly what I would want people to do, if they were going to post malicious links. And no, I don't think you violated any site policy or site rules, at least not as far as I know.

That said, I think your question is a better question after the edits to remove those links. It was a fine question as you originally posted it -- but it's an even better question, now that you've removed the links. Why? Because now the question has broader applicability. It addresses the general situation of how to report malicious URLs, which is something that is likely to be of broad interest and pops up all the time, not just your personal situation with this particular spam campaign (which is probably a very time-limited event and not likely to be of lasting interest to others).

I know when you get downvoted, it's easy to feel like you got spanked or punished for no reason. I hope you won't feel that way. I think you've contributed a great question to the site, and one that the process has helped make even better, so you should feel proud that you've contributed something good to the world. I appreciate it, and I'm sure other visitors will as well. I upvoted your question, and I expect others will as well.

share
2  
+1 I really like this answer and in particular the part about generalising the question to be more broadly useful. The only thing I might change is the downvoting reason "because they don't like you". Pretty much any other reason goes, but this one doesn't - serial downvoting is reversed, for example, and I believe long term patterns of abuse get picked up too, although I've no source for that. So basically the voting reason should be about the post, not the poster. –  user2213 Nov 26 '12 at 22:46
add comment

Maker- the question you linked to does not say exploit code is okay. It actually spins off a range of answers and discussion.

The upshot seems to be that it will depend.

If we host exploit code which is used in an attack there could potentially be legal issues, so functional exploit code is a risk.

Exploit fragments or false, POC code is much more likely to be fine.

update in looking at the question you posted, there was just no need to post any malware at all, or include links, so I understand why it was redacted

share
1  
Thanks for clarifying the exploit code issue, but I think this still leaves the part about linking to compromised or known-malicious sites open. –  Iszi Nov 19 '12 at 18:08
    
Agree with the update completely. There was absolutely no need for the URLs or domain names. –  Polynomial Nov 19 '12 at 18:23
    
" There was absolutely no need for the URLs or domain names." - That might be a bit harsh. I'm more sympathetic to makerofthings7. I can totally understand why someone would want to post all the information he/she can (under the principle of, maybe it'll help someone). In this case, I think it's a better question without those links ... but I also think makerofthings7 was asking in good faith, and I can completely understand why he/she might have posted the links in his/her original question. See my answer for my views. –  D.W. Nov 19 '12 at 22:02
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .