76

Since we're programmers, security is absolutely something we should all be concerned with. As such, it's important to understand what vulnerabilities to protect against and watch out for, and why certain approaches to them work or don't. In the course of helping other users understand these issues, we might at times want to provide a code snippet of some kind that exemplifies the security concern.

What guidelines govern the posting of such malicious code? Are there effective alternatives to actually posting something of that nature? What about the issue of posting it merely in source form vs. posting it in runnable form (via Stack Snippets or similar)?

On the last one, I think it's fairly obvious we shouldn't post Stack Snippets to actually run malicious code, but I could also imagine the possibility of certain guidelines (which would pretty much have to be software enforced) allowing for certain demonstrations.

This question inspired by this one.

18
  • What was the point of this question, navel-staring about questions about malware or the actual questions at SO about them? I of course assumed the latter, the navel-staring was already covered well by the instigating question. Commented Mar 3, 2015 at 23:15
  • 2
    Maybe a screenshot of the code would be safer, so the users would have to type it all out themselves, and if they already haven't been paying attention may realize it's malicious as they do so. This isn't completely foolproof as someone can use a OCR program to convert to text. Commented Mar 3, 2015 at 23:16
  • 2
    In my experience, hypothetical discussions about hypothetical questions lead nowhere. Can we have specific examples please?
    – Pekka
    Commented Mar 3, 2015 at 23:54
  • 1
    @Zack Why would someone use an OCR program to convert random images on SO to text and run them as programs? Maybe a really advanced StackSort...
    – KSFT
    Commented Mar 4, 2015 at 1:11
  • @KSFT I always use OCR to convert from image to text, it's just easier (if it's written in type font). Commented Mar 4, 2015 at 1:27
  • 2
    We don't "discuss" anything on SO. Discussions != questions/answers. Information Security might be more flexible on the subject, but that's up to them and their meta. Usually, this type of question ends up being something like "my server just got viraped, here's the code it injects into my pages what is it [PHP]" which suck. Who cares? Your server is hosed. Flush and start fresh.
    – user1228
    Commented Mar 4, 2015 at 14:14
  • 1
    @HansPassant Primarily about SO itself, but in light of the recent Stack Snippet "experiment" at hand, it would also apply in the rare cases where posting code here on meta would be on-topic. The point is simply that this is an issue in computer programming, and I couldn't find any clear guidance of how we should approach it. The fact someone posted code like this in the sandbox suggests that some people think it's okay to post it. Obviously, I don't, so I wanted to get a resource in place for people to look to for guidelines. I couldn't find an existing one.
    – jpmc26
    Commented Mar 5, 2015 at 2:45
  • 2
    @Will Please interpret the word "discuss" more loosely, in the sense of "have a conversation" or "exchange information." If you have a more clear alternative, feel free to edit the title. I would appreciate it.
    – jpmc26
    Commented Mar 5, 2015 at 2:46
  • I just stumbled on something that can server as an example: stackoverflow.com/questions/28870607/…
    – PM 77-1
    Commented Mar 5, 2015 at 5:28
  • 6
    Surely no-one actually runs some random piece of code they found on teh internetz without fully understanding what it does? Oh, wait ... Commented Mar 5, 2015 at 7:57
  • 3
    @Will lolwut? meta.stackoverflow.com/tags/discussion/info
    – BartoszKP
    Commented Mar 5, 2015 at 11:22
  • 3
    I love how so many people get up in arms whenever they see the word "discuss" on this site.
    – Cypher
    Commented Mar 5, 2015 at 22:40
  • @BartoszKP do you understand the difference between SO and Meta SO? We discuss SO here. We answer questions on SO. Come on, keep up. We're not going that fast.
    – user1228
    Commented Mar 6, 2015 at 17:00
  • 2
    @Will 1) You were pedantic before, which was unproductive. 2) You're being rude and insulting now. Additionally, this issue has applications on meta (as exemplified by the inspiration for this post), where you yourself admit "discussion" (as you've very narrowly interpreted it) happens. Please make a greater effort to be more polite and to correctly interpret what you read.
    – jpmc26
    Commented Mar 6, 2015 at 18:23
  • 4
    @BartoszKP My specialty is skimming things and jumping to the wrong conclusions. Welcome, brother, we've been waiting for you.
    – user1228
    Commented Mar 8, 2015 at 19:19

4 Answers 4

90

Honestly, I'm of the opinion that we should post exploit code. BUT I think there are certain guidelines to how we post exploit code:

  1. It should be very clearly marked as exploit code (mark it in bold). That extends to if you're posting a lot of code in your answer, make sure the exploit code is not in the long block (so as to not accidentally run in) but should be separated (and clearly marked) with instructions of how it plays into the longer code block.

  2. Exploit code should be non-destructive. If you're doing XSS for example, alert(1) will do just fine.

  3. Rather than explaining how an attacker could take the exploit and make it malicious/damaging - focus on how it can be fixed. That way we're not furthering hackers of the world, but instead spreading security knowledge.

  4. Don't put exploit code in code snippets.

I think that by following these guidelines we spread security knowledge, but not "malicious" security knowledge. After all, when we learned security, this was at a minimum how we learned - someone pointing out a vulnerability, but focusing on how to fix it. I think not posting exploits/not pointing them out does both the user and ourselves a disservice as we may end up unknowingly using these insecure systems.

26

Post the malicious code with a note saying it is malicious. Avoid posting something in a form that a click-happy user may be tempted to run (e.g. a snippet or a link to a compiled binary or something).

For example, don't link to a fiddle that catches the user's computer on fire; just post the code and say "this will catch your computer on fire if you run it". You don't actually have to trick them into emptying a fire extinguisher on their desk to get the point across (it's true, you don't).

This works because:

  • Those who have sufficient knowledge and motivation to understand why it's malicious don't actually need to experience it in action to get the point (this was the, IMO invalid, argument used by the poster in the OP's linked question).
  • Those who do not have sufficient knowledge or who do not care can at least read the note and know to Not Try That At Home, even if they don't know or care why.
  • Those who do not have sufficient knowledge or who do not care, and who also can't be bothered to read the note, will at least not be presented with something they can click on to trick them.

  • Those who do not have sufficient knowledge or who do not care, and who read the note but can't be bothered to take it seriously, and go through the trouble of putting the code in an executable form and running it, well... we put up the caution tape and closed the elevator doors, and they pried the doors open and threw themselves down the open elevator shaft anyways, so...

An important point is: While you can attempt to make an argument that says "the best way to demonstrate the maliciousness of the code is to immerse the user in the malicious experience", this argument does not hold because the people that it matters to do not need the first-hand experience, and the rest of the people wouldn't benefit from it anyways because it doesn't matter to them in the first place.

So just post, leave note, and post in a way that requires at least some threshold of effort to execute (the latter is important; if a person is going to copy some JavaScript, paste it in a text file, and run it, at some point in that process we have to limit how much we can protect people from themselves - we can provide people with a first line of defense against themselves but that's about it unless we start getting community volunteers to physically stand behind users and look over their shoulders).

0
12

For my money: It's irresponsible to post something that might cause harm, and Stack Overflow should actively remove it whenever possible.

That doesn't mean you can't draft proof of concept exploit code, because there's nothing that really highlights a problem like giving a worked example. But neither do I think it unreasonable to assume that a newbie (I don't necessarily mean 'low rep' users or newcomers to the site, but rather someone inexperienced with the particular language or coding paradigm) might try running something 'as is', with a reasonable expectation that it won't be malicious.

You can try handing back the blame by pointing out that running stuff without understanding it is dumb - and you're right, it is. But I don't think that's a good enough excuse.

So I would suggest:

  • make it very clear that it's exploit code, and what it will do.
  • provide an example what won't 'work' if copied/pasted. (comment out the 'killer' line, whatever)
  • ensure any example - even if it does 'work' doesn't do anything destructive.

I'd use the same sort of guideline for any potentially harmful non exploit code too. (such as anything that includes #rm -rf $variable or similar).

6
  • 32
    "It's irresponsible to post something that might cause harm...rm -rf $variable"
    – KSFT
    Commented Mar 4, 2015 at 1:15
  • 1
    Define "potentially harmful".
    – user764357
    Commented Mar 4, 2015 at 6:04
  • 1
    @LegoStormtroopr "rm -rf $variable" when $variable is undefined is kinda harmfull :P Commented Mar 4, 2015 at 6:08
  • There's a bunch of globbing traps to doing that sort of thing, to do with filenames with spaces in them, and paths and the like. So I'll comment it in code samples I provide and replace it with echo rm etc. Because I hope everyone tests code from "some guy on the internet" but I don't assume that's going to happen.
    – Sobrique
    Commented Mar 4, 2015 at 8:14
  • 5
    If you clearly point out that it's exploit code I don't see why you would need to comment out the killer line, the user knows it's exploit code, if he still wants to run it then he has his reasons (testing in a VM/etc) and we should let him do so. And if the user doesn't read the Warning: exploit code below then he deserves it. URLs leading to malicious pages are a different subject as they may be accidentally clicked, but I don't see how copy/pasting a block of code into a shell and running it can be "accidental".
    – user2629998
    Commented Mar 4, 2015 at 10:52
  • 3
    Takes very little to uncomment the exploit, and removes the risk. What's the harm in doing it?
    – Sobrique
    Commented Mar 4, 2015 at 19:35
1

Since I think the main concern would be preventing people that have absolutely no understanding of this sort of thing at all from taking said code and executing/distributing it I think it would be more responsible to introduce a 'non syntax' error that prevents the code from executing properly that would be obvious to the average programmer who understands said technology properly

for example if discussing a webkit buffer overflow when appending to the document document node with a specific unicode string one could write:

var myDocumentNode = document.querySelector('#document');
var explotString = "\u1234T\uABCD\u1234H\uABCDI\u1234\uABCDS\u1234N\uABCDE\u1234E\uABCDD\u1234S\uABCDR\u1234E\uABCDM\u1234O\uABCDV\u1234A\uABCDLuABCDA";
/// Run Explot Code here
myDocumentNode.innerHTML = exploitString;

(and provide a tag with class document somewhere. ) this way a intricate discussion can occur of said exploit can occur by people with the relevant skills to see through the intentional error injected.

This way 'inexperienced programmers' wont shoot themselves in the foot. and people looking for exploits that dont know what they are doing will get thrown red herrings.

1
  • 5
    Someone will correct your typo for you. Commented Mar 6, 2015 at 0:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .