I know this is not something that we could easily ask SEI to implement, so it's more of a site moderation policy question. The post that inspired this question is here:

Pcap file inspection

Though I haven't reviewed the file myself to know if these particular links fit my concerns, I think we really should have a general (no exceptions) policy about this.

The risk I foresee is that the capture files may contain sensitive personal or organizational information sent over the network in the clear, or in an easily recoverable format. While we obviously cannot be held responsible for the fact that the information was sent over any network in such form in the first place, or that it may exist in capture files uploaded to a third-party hosting site we don't control, or that links to the files are posted on our website, we may be criticized or acted upon (rightly or not) for allowing those links to remain unmoderated.

I suggest our policy be to remove such links on sight, but this is of course a policy that needs to be decided upon by the community - and, particularly, the "Blue Diamonds". Additionally, we should request (as was done not long ago in the case of a web vulnerability link) that SEI mods remove old edit history items which contain those links.

I've already removed the links from the post in question, here. However, they remain (for now) in the edit history in case this decision is reversed by the community and/or our "Blue Diamonds".

add comment

1 Answer

I think we really should have a general (no exceptions) policy about this.

I see nothing wrong with sharing pcap files in principle. You might be looking at one for self learning purposes - i.e. just a boring home network ladada NETBIOS INAMEMYPCAFTERSTARWARSCHARACTERS laadadadaaaa.(*)

That said, there is a potential for an individual to do some form of examination (warranted or not) on a network they do not own and publish the results here, accidentally letting on far more than they intended. There's also potential for an individual to publish a file that is part of a contracted analysis. I mean, people don't hire people who just publish sensitive stuff on the web or write their pentest contracts missing clauses that say "you won't publish what you find or any details of our network that might lead to an attack", do they? Do they? But there's still a potential.

But I think we can come a level down from that. Publishing an entire pcap dump and saying "hey guys, can haz help doing analysis?" is the equivalent of going to Stack Overflow with a 20,000 line perl program and saying "hey, there's an error somewhere in this, please help?!". The typical SO reaction is "we are not doing your job for you".

I suggest we deal with these under the same premise. Exactly what packets are you interested in? Reproduce those in the question, not some pastebin/file upload site I have to go to look at, download, pass through tcpdump. The chances of me bothering to do that are really very remote. I have enough crash dumps waiting on my desk at work...

This has the nice side effect of dealing with accidental leakages via these mechanisms. "We're not analysing your tcpdump for you unless you do some legwork and ask about what you're seeing" also means we'll either just close, edit in or otherwise mask the information.

Blowing away revisions is not something moderators can do. Moreover, the procedure for blowing away data from revisions goes like this:

  • Delete it (question, answer etc) immediately.
  • Contact community with a link to the revision.
  • Wait for the revision to vanish.
  • Undelete if community person didn't.

The reason for the immediate deletion is to halt any further leakage - only 10k+ users can see the revision and only if they have a link. Of course, for the user, unless they requested the removal, this is an inconvenience they may find frustrating ("omg evil mods why did you delete my question?") and result in "unfathomable behaviour" and possibly a "repost condition".

So what I'm trying to say is that one would have to be carefully handled. I'd personally reserve it only for cases where the person asks for it, as it involves the effort of at least one mod and at least one member of SE staff. I know, I'm ARPing on a bit now. Sorry.

(*) Naming your PC after star wars characters is not funny and it's not cool.

Think I'd agree with this. (did you really name PC's after Star Wars characters?) –  Rory Alsop Jul 3 '12 at 21:30
No. Sadly I wasn't allowed, but naming the DMZ "the dark side" and the internal network "the light side" was very tempting. They're just "the orange cables" and "everything but orange or red cables" now. –  user2213 Jul 4 '12 at 7:43
LOL, since Starwars is always related, I've named by open source venture JediCorp. ;D –  Rohan Durve - Decode141 Jul 7 '12 at 17:16
"Naming your PC after star wars characters is not funny and it's not cool." What makes you say that? –  George Bailey Jul 16 '12 at 15:46
@GeorgeBailey Well. It's quite a long story, but it basically boils down to a discussion I had at a previous employer on naming schemes - and more specifically why the server names were so hard to spell. "Star wars naming" was the canonical example for "names all servers using characters from favourite [x]". Don't worry, if you're currently logged into "yoda", I'm not judging you ;) –  user2213 Jul 17 '12 at 13:33
In a previous job, I had all the firewalls named after Star Wars planets - Geonosis, Bespin, Yavin, Alderaan, Kamino etc. You may laugh but when it alerted but the Operations team differentiated the firewalls a lot better than many other servers such wkgaincf01, wkcfbknt01 etc. Important to think about when you looking at a screen of red alerts :) –  Mark Hillick Jul 24 '12 at 19:52
Have to agree here. At my last workplace, we had servers with names that were practically serial numbers, e.g. COMPANYNAME-102-6-2 for room 102, rack 6, server 2. Which is fine, except that, for the most part, people wanted to know what they did, rather than where they were. We switched to descriptive names (including some sci-fi names) and looked up their locations in the assets database when we needed to. Ended up being much easier. –  Polynomial Jul 30 '12 at 12:55
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .