71

Has the posting of malicious code ever been an issue? Code that looks as if it answers your question, but also has something malicious hidden inside of it.

14
  • 12
    Yes, the possibility for people to add malicious code to a post is possible. But remember many different sets of eyeballs are looking at the post. Ultimately though, the decision is up to you. You could get all your code from a book (though the argument is still true there, the author could make you write a virus on your own computer).
    – gunr2171
    Commented Aug 4, 2014 at 19:33
  • 3
    @gunr2171 Are there any examples of this every happening on StackOverflow?
    – kingsfoil
    Commented Aug 4, 2014 at 19:37
  • 5
    Certainly erroneous have been posted, and occasionally some tongue-in-cheek code that would not behave as the OP desired (thought it might match his description of what he desired). But aside from code which does, in effect, erase all on your file system, it's pretty hard to hide malicious function in a dozen or two lines. And certainly you're not going to get "infected" by browsing, assuming you have reasonable anti-virus protection. You're far safer than when browsing on Facebook, et al.
    – Hot Licks
    Commented Aug 4, 2014 at 19:50
  • 38
    As @Akshay suggests, if you are using SO properly you study the answer and learn how to apply it to your problem. You do not simply blindly copy the code.
    – Hot Licks
    Commented Aug 4, 2014 at 19:54
  • 8
    @HotLicks Oh how I wish all users were like that! The amount of "Why didn't your answer work?!" responses that result from poor copy-paste jobs is mind-boggling.
    – Akshay
    Commented Aug 4, 2014 at 20:06
  • 1
    @gunr2171 - Crowd sourcing or "many eyeballs" does not equal secure. I'm fairly certain there is a paper and some empirical data floating around somewhere. The model does excel at allowing us to learn from past failures. It also means the more we depend on X, the more we need X to be open sourced. See Dan Geer's excellent essay Heartbleed as Metaphor.
    – jww
    Commented Aug 5, 2014 at 16:29
  • 8
    If she doesn't understand the code well enough to know it's not malicious, then I think she should probably do a bit more research before using that code in a real application.
    – Ajedi32
    Commented Aug 5, 2014 at 16:34
  • 5
    Her approach doesn't sound very effective. If you see a piece of code, and do not know what it does, you should be asking what the code does, rather than assume it is malicious because "all code posted on the internet is often malicious". It is the same pessimistic approach that some people take on the world in general.
    – MxLDevs
    Commented Aug 6, 2014 at 5:16
  • 1
    A much bigger issue is that including code licensed under CC-BY-SA in a project is legally problematic since the license requires derivative works to be licensed as CC-BY-SA as well which is rarely what you want. Commented Aug 6, 2014 at 8:24
  • 2
    Every answer in php related to mysql that advises use of the mysql_* functions could be regarded as malicious, from a certain perspective. I echo what everyone else here says: know what you're doing, and if you don't, learn. Seek multiple sources. Commented Aug 6, 2014 at 20:40
  • 2
    From the way you explained the origin of her concerns, it appears to me that actually she misinterpreted whatever she was reading. I believe whatever she read was referring to scripts and source code such as sample projects one downloads form github or code project, and not small and isolated pieces of code which are characteristics of the most SO answers. However i think it lead to a great question, cos you can never be to careful and it is always better to be safe that sorry.
    – Ferox
    Commented Aug 6, 2014 at 20:58
  • 2
    I think that almost the only time this could be a problem is when someone asks a "gimme the codez" question. In that case, well, i'd almost say the asker deserves it. For other questions the asker should have an understanding and spot most issues himself. Commented Aug 7, 2014 at 8:39
  • Code on SO isn't to copypasta into your project. It is there to illustrate a point. Then you understand it, and replicate its behaviour. Very little potential for malicious code slipping in there.
    – PlasmaHH
    Commented Aug 7, 2014 at 8:55
  • 1
    I've never seen any malicious code (i.e. code that looks intentionally insecure) but I've certainly seen code with security bugs. See e.g. this answer which appears to have a SQL injection vulnerability (that was also present in the question).
    – dbc
    Commented Jan 17, 2020 at 21:44

9 Answers 9

83

Most of the code people post on SO is so short that for the most part it should be very easy to check it for anything suspicious and also very difficult to conceal anything malicious.

Furthermore, if you actually understand the problem and solution after reading an answer there's no reason you have to copy and paste what was posted. You could just fix the code yourself and be guaranteed that there's nothing harmful.

Also one of the great things about this site is that you can get multiple answers to a single question. If one answer involves using some sketchy operations or libraries that you don't trust, and none of the others do, you can just go with the safer solutions.

5
  • 25
    and also there are people on SO downvoting and upvoting the questions as well as answers,they will not let the malicious code to live for a single day and will point it out... :)
    – nobalG
    Commented Aug 5, 2014 at 12:42
  • 2
    @DividebyZero That is, if it's not in WhiteSpace language. I suspect no one will ever find a WhiteSpace virus hidden in a regular program.
    – Sifu
    Commented Aug 6, 2014 at 20:29
  • 13
    However, a whitespace virus embedded into a program of another language is completely safe provided the person doesn't decide (for one reason or another) to run their code through a whitespace interpreter. Commented Aug 6, 2014 at 20:39
  • 1
    Agree with @DividebyZero It's actually a blessing in disguise that people are often hell bent on finding something to complain about in an answer. That way, they would downvote/comment pointing out the same
    – asprin
    Commented Aug 7, 2014 at 7:21
  • On the other hand, most answers to password verification / XSS checking / email address verification questions are of the "enough rope to shoot yourself in the foot" kind. Just provide whatever the OP asks for, with no thought towards why it's silly / idiotic / insecure / dangerous.
    – tripleee
    Commented Aug 7, 2014 at 9:01
37

Other than the occasional fork bomb, I'm not aware of anyone successfully embedding malicious code in a Stack Overflow post. The community here is pretty quick to spot and delete anything that looks suspicious.

Regardless, you should always be wary of copy/pasting code you find on the Internet. No matter how much you trust the site, the community here is large enough that you can pretty much guarantee that not everyone is trustworthy. If you work to understand the code you read here so you don't have to resort to copy/paste solutions, trust becomes a non-issue.

7
  • Yesterday I copy pasted an iframe demo from an answer into jsfiddle. While I was not able to verify that the code caused the outcome, the jsfiddle webpage itself became compromised as a result of seemingly hidden script. It affected the localstorage for the page and even included some very strange side affects such as causing the mouse to ping the page when clicking. I didn't think much of it at the time, but the whitespace idea seems fascinating. This was the answer stackoverflow.com/a/16019605/1026459
    – Travis J
    Commented Aug 6, 2014 at 20:24
  • Since you mentioned a fork bomb... I read the wiki link you posted and now I'm genuinely curious. How would an author of an intentional fork bomb test his code?
    – splungebob
    Commented Aug 6, 2014 at 21:12
  • 3
    @splungebob In a VM? Commented Aug 6, 2014 at 21:22
  • 2
    @splungebob if the computer crashes, it worked!
    – nhinkle
    Commented Aug 6, 2014 at 22:11
  • 4
    @splungebob I've seen it done on a university computer in a lab. It just crashes the computer. No permanent harm is done.
    – Bill the Lizard Mod
    Commented Aug 6, 2014 at 22:45
  • 4
    I remember doing an accidental fork bomb back at university and it actually crashed the whole Solaris network, not just my computer... still not sure why, but I suspect it was related to something else my computer was doing at the moment. Those ancient Solaris machines didn't need a lot of encouragement before they decided to crash & burn.
    – Lundin
    Commented Aug 7, 2014 at 8:25
  • 1
    @Lundin One of my friends did the same thing. He didn't just crash his own desktop, he crashed the main CS server. He was pretty embarrassed and expected to get some form of punishment, but I guess the university expects that to happen at least once a semester. :)
    – Bill the Lizard Mod
    Commented Aug 7, 2014 at 11:06
13

If you don't understand the code that you copy off of the internet well enough to know better, than you might assume that it's malicious.

What's probably more likely is that the code is incompatible with your existing code base, and simply copying and pasting it into your program will cause bugs, which isn't exactly good either.

2
  • 21
    Or even more fun, the code unintentionally contains dangerous security vulnerabilities, and you end up opening up your entire production website to SQL-injection, cross-site scripting, or Man in the Middle attacks.
    – user456814
    Commented Aug 4, 2014 at 21:29
  • 2
    @Cupcake: for that matter, the code might intentionally contain a dangerous vulnerability without "doing anything" itself. It's questionable of course whether the person who posted the code can complete the circle by attacking apps that use the flawed code. But at least in principle, people might maliciously put dodgy code out there. For that matter there could be malicious answers that don't even contain any code, just describe things in a way that the author hopes will lead to exploitable errors. Beware of those recommending strncpy ;-) Commented Aug 5, 2014 at 17:08
6

Your question text focuses only on security concerns due to malicious code - i.e. people posting code which is intentionally designed to do harm. The other answers so far have mostly focused on that, too. But the question title, "Are there security concerns with code posted to Stack Overflow?", is more general: if you are copying code from Stack Overflow into your project, malicious code is not the only potential concern. In practice, code often has security problems despite the author's intentions. Those users who answer so many Python questions with "use eval" are misguided, but probably not malicious.

The Stack Overflow blog has an article describing independent research on vulnerabilities in code on Stack Overflow, titled Copying code from Stack Overflow? You might paste security vulnerabilities, too. Out of 2,560 distinct snippets of code, the researchers found that 69 of those had a security issue in at least one Common Weakness Enumeration category, and that those snippets had been copied into over 2,800 projects found by searching GitHub for the code.

So the answer to the more general question is yes, according to research there are security concerns with a not-insignificant proportion of code posted to Stack Overflow.

1
4

I also suggest not to just copy and paste the code. Read and Understand the logic. Research about the objects/functions on the code. Check also other user's comments. :)

2

real vulnerability is to posters

There is a huge possibility of new users posting code that has passwords or other information that could be used to attack the poster. If code is placed in a basic text editor and hidden characters shown, I don't see how it could have hidden code attacks.

blame the code snippet when the real issue is bad overall design

Poorly planned codebases are vulnerable by there very nature. Getting help on certain issues from a website can not change the amount of thoughtfulness placed in the rest of the codebase. Best Practices need to be followed in all the layers of an architecture.

2

I was very disappointed when I came across this question, and found that it had received 100,000+ views, had many upvotes, and yet every single answer created a security vulnerability. So while you don't really have to worry about copying and pasting a virus, you do have to worry about copying code that opens up a vulnerability in your application. I would recommend studying the basics of security so you can at least spot and avoid the most common security issues.

1

While SO enables millions of other people to review answers and possibly flag malicious code, you certainly have no guarantee that anyone has done such a review. You should assume that nobody else with sufficient expertise has vouched for the code. As is the case everywhere else on this site, you need to do your own homework.

1

I've actually posted Base64-coded binaries on Stack Overflow before, and I think people have run them.

Heck, I even told people I had semi-obfuscated one of them just for the fun of it, to the point that I certainly could have posted a virus and caught a few people off-guard if I'd really wanted to -- most people wouldn't bother figuring out what those binaries were doing. It wouldn't have lasted long, but it did make me wonder how much people trusted the code I'd posted.

Ultimately, it depends on your trust and common sense. I think it would be possible to catch a handful of people off guard, but it's unlikely many people will be affected before a virus is taken down, if someone manages to somehow make it non-obvious.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .