3

Today I encountered a user who has asked two questions, the second of which was deleted.

The second question was a code dump of obfuscated Python code with a vague debugging request. After the fact, I de-obfuscated the code and determined that it did indeed have malicious intent. Specifically, it seemed intended to download and run a bootstrap .bat from a GitHub repository, which would then download and run other executables from that directory after first attempting (in a way that I don't think would have worked) to obtain root privileges.

The question would likely have been downvoted and closed even without any sign of obfuscated or malicious code, because it was "noisy" (ranting about money paid for the code) and vague about the problem. However, it got me curious.

I looked into the user and found one other question. It was asking (in an obviously too-broad way) how to use Python to download and automatically execute files. I voted to delete that (since then, it has also successfully been deleted), and also raised a custom flag to point out the pattern of behaviour and suggest a ban.

The flag was declined.

Does the site tolerate the presence of users who clearly only want help with being "script kiddies"? How should I handle such cases in the future?

7
  • Related? Should questions about programming viruses and malware be allowed?
    – BDL
    Commented May 31, 2022 at 20:48
  • Those are useful related links, but I am asking about the user, not the question. Because of the two questions that were asked, I anticipate a particular pattern of behaviour going forward. Commented May 31, 2022 at 20:51
  • Upon consideration, given the answers that were provided, it seems as though the distinction does not actually matter. I will accept this as a duplicate. Is there a more general Q&A about users who look like they will cause trouble in the future? Commented May 31, 2022 at 20:53
  • 6
    I think this is a slightly different case than the linked questions. In this case, the question was not asking how to program viruses or malware; it gave no indication whatsoever that the code was malicious. It was disguised as debugging question and the obfuscated code itself would cause harm if ran by an unknowing user. I agree that we should not be enforcing or policing users from asking questions about hacking, viruses or malware. I think that's a separate issue to a specific user spreading malicious code in hopes that people run it.
    – Henry Ecker Mod
    Commented May 31, 2022 at 20:58
  • 4
    We require the asker to set the evil bit, of course. Commented May 31, 2022 at 21:49
  • What users do you think this was targeted at? (Not a rhetorical question.) Commented Jun 1, 2022 at 10:29
  • 1
    @PeterMortensen I don't think it was targeted. I think it was hoping to compromise random people who tried to help out with the question (by naively running a "MCVE" locally in order to understand the "problem"). See also meta.stackoverflow.com/questions/407049/… which describes a similar attack. Commented Jun 1, 2022 at 10:32

0

Browse other questions tagged .