33

In the site FAQ, it is written:

Black Hat vs White Hat - This site is not intended to be a resource for Black Hats, or malicious hackers. While we understand discussion of exploits may require examples, if the question looks too much like a request for attack tools or mechanisms to spread a virus, it may be moderated.

I don't think this reflects our stance on black hat topics very well. The assertion that “This site is not intended to be a resource for Black Hats” seems to be saying that any discussion of black hat topics (attacks, exploits, etc.) is forbidden. Furthermore, while the text actually doesn't say so, it looks like all questions of attack tools or mechanisms to spread viruses are forbidden.

The outcome of meta discussions 1 2 3 4 is rather that broadly speaking, we don't discriminate against black hat content. Quoting from some of the answers with high upvotes on these threads:

We should clarify the FAQ to make it clear that discussions of attacks and exploits is on-topic on this site. We should replace the paragraph quoted above by one that reflects the policies that are effectively applied and the kind of bad content that we want to feel justified in removing.

The script kiddie content can pretty much be moderated by the usual Stack Exchange rules. Things like “How do I hack www.example.com?” or “Join me in a DDoS!” can be closed as not a real question. I would appreciate input from moderators regarding past questions that have been deleted for some black hat-related reason and that were not close-worthy under the general Stack Exchange rules.

I propose to start with this:

Black Hat vs White Hat: Discussions of attacks and exploits are allowed within reason. We adhere to responsible disclosure rules,

What else do we need to say?

5

9 Answers 9

27

I think the biggest problem in the security industry right now is that there are too many stuck up whitehats that are expected to break the exploitation process when they themselves have never written an exploit. So in the realm of security, making any topic taboo makes the process of learning into a vulnerability. After all a blackhat might ask a question where we all learn somthing, ** gasp **...

I am a whitehat, in that I have never Illegally broken into a system and I am paid to prevent such behavior. That being said I enjoy writing exploits and I think that full disclosure is a useful tool if the vendor is not cooperative. This behavior is legal, at least in the US.

Blackhats must be able to solve difficult, intellectual problems in order to be successful, and for that they have my respect. Very few people on the planet can grasp such problems. If anyone is able to ask an interesting question and I am able to provide an answer I will do so. By not providing an answer to a potential blackhat, I don't believe that the internet is a "safer place". After all this community is the sole provider of such information.

I will not answer questions like "How do I hack a facebook account" or other such nonsense. I think that the community is uniformly against such questions. If the OP isn't willing to put in the effort to climb the mountain of information that makes up modern security then I am not willing guide that person through the difficult terrain.

2
  • 3
    "This behavior is legal, at least in the US." even with the DMCA? Good!
    – curiousguy
    Aug 15, 2012 at 0:37
  • 3
    Did you mean After all this community is **not** the sole provider of such information. ?
    – March Ho
    Jul 22, 2018 at 12:45
26

The root of the issue is political correctness. Namely, you are all sissies.

There, I have said it, now the explanations: what "we" want is a serious site with a lot of information and analysis and conceptual stuff; we want to be looked at as a reference. The place to be for the professionals. The meeting place of the higher spirits in the field. What we do not want is to meet villains, especially the low grade ones. Consider the following analogy: if this site was about history of crime and police technics, we would like users like forensics experts at Scotland Yard, and certainly not Jack the Ripper -- even though Jack's expertise would be right on spot and he would certainly have very interesting things to say. It is a matter of image and reputation. We want to attract the "right sort of people".

However, in this world and century, it is considered bad form to select people. Freedom of speech, equality of rights and dignity, haro on prejudice, name your post-70s fantasy here. Users are supposed to be faceless, and we, as civilized people, are socially expected to judge posts based on their objective technical merits only. So, no question of excluding users; we only talk about questions and answers.

This leads us to the usual debate on whether black hat questions are on topic or not. It misses the point, but at least we feel allowed to discuss scope. All the discussions on the darkness of hats turn into byzantine arguments about how a question about virus propagation can be legit and great some times, and totally forbidden in other circumstances. The one thing which makes the difference is whether the asker is someone we want to be associated with, or someone we would prefer never to meet.

The logical, definitive FAQ entry on that subject should read: "Ye who are a pirate, never-do-well or criminal, begone. You stink and we do not want to talk with your sort."

6
  • 20
    I disagree with your conclusion. Ye who are a pirate, teach me. I don't want to meet low-grade villains, but then I don't want to meet well-meaning simpletons either. Aug 12, 2012 at 18:45
  • 3
    @Gilles - i agree with that. Apr 23, 2013 at 10:44
  • 4
    @Thomas, "criminal"? Which justice system does the site adhere to?
    – Pacerier
    May 5, 2015 at 2:03
  • Say what you are saying is "We don't want to ban black hat questions, we want to ban blackhat users? But we are too 'sissy' to do so because political correctness, freedom of speech, and pretending that no one knows you are a dog on the internet"? Jul 13, 2015 at 0:46
  • 3
    Your answer seems to imply that only a Whitehat can be a professional, and that a Blackhat cannot. Apr 20, 2016 at 19:21
  • 3
    I would love to have Jack the Ripper teach me about crime. If I were an investigator, I would die for the opportunity. Now, I'm far from the infosec equivalent of said serial killer (John?), but the "logical" FAQ entry is effectively saying Sec.SE does not want to talk with my sort as I may be labeled as a "pirate, never-do-well, or criminal", but I am under the impression that my contributions have been well received. What I do outside of the site, on my free time, should be completely irrelevant as long as my questions and answers are constructive and helpful to this community at large.
    – forest
    Jan 30, 2018 at 2:13
12

After several discussions in chat, most notably ones involving @Gilles, I've learned a couple key points. To sum up, these add up to say that any truly undesirable or inappropriate "black hat" questions should already be getting handled per existing StackExchange policies.

For the TL;DR version, jump to the bolded paragraph at the end.

  • Any post that appears deliberately aimed at facilitating malicious and/or illegal activity runs afoul of the StackExchange Terms of Service. Particularly, these pieces of Section 4, "Restrictions" (emphasis mine):

... Any fraudulent, abusive, or otherwise illegal activity or any use of the Services or Content in violation of this Agreement may be grounds for termination of Subscriber’s right to Services or to access the Network.

...

Use of the Network or Services to violate the security of any computer network, crack passwords or security encryption codes, transfer or store illegal material including that are deemed threatening or obscene, or engage in any kind of illegal activity is expressly prohibited. ...

  • Most (if not all) other undesirable or inappropriate "black hat" questions should already be getting closed per the regular close reasons. Particularly: Not Constructive, Not a Real Question, or Too Localized. Off-Topic should not be used, because "black hat" in general is not off-topic.

So, for the purposes of setting policy, nothing really needs to be added to the FAQ - in fact, the existing section could be removed and our policy would still be the same. However, for the sake of emphasizing our position against the knowing facilitation of illegal conduct, there should be something in the FAQ to re-iterate or paraphrase the relevant portions in the ToS. Perhaps the existing section could use a thorough re-write, but it should not be done without.

Throughout all these discussions, I came to form an analogy of our community's situation to that of a responsible gun store owner who is operating in a jurisdiction that protects the right to keep and bear arms.

As responsible citizens who are in the business of "selling weapons", we should happily "sell" our "weapons" to anyone - regardless of their intent - up until the point that we actually have a reasonable suspicion (or, and especially, confession) that their intent is malicious and/or illegal. After that point, and only after that point, it is our ethical responsibility to refuse the "sale".

5
  • Okay, now this is an answer I agree with. The ambiguousness of "reasonable suspicion" is exactly what I was looking for.
    – AviD Mod
    Aug 23, 2012 at 7:54
  • One point, I'm not sure everyone would agree - "malicious and/or illegal and/or unethical". To clarify those gray moral issues in countries run by unjust governments, for example.
    – AviD Mod
    Aug 23, 2012 at 7:56
  • 2
    @AviD I think at that point we leave it up to the moral compass of the answerers. If I happen to disagree with the regime in a particular country, then I'm free to provide an answer. If I happen to disagree with OP's moral viewpoint, then I'm free to not answer.
    – Polynomial
    Aug 23, 2012 at 8:00
  • 3
    I agree with most of this answer, including the part where while we can purely rely on the usual close reasons and the terms of service it might be useful to have a mention in the FAQ as well. I don't think the weapons analogy is a good one, however: we're not selling weapons, we're explaining how they're made (“join me my botnet to attack www.example.com” would make us weapons sellers, and that's clearly way off-topic). Aug 23, 2012 at 11:50
  • 7
    There is a problem with the "weapon seller" analogy (all analogies have issues anyway). If I sell a gun to an individual, I am selling it to that guy specifically. If I publish attack details on a public Web site, I am "selling" it to everybody, not just the non-shady-looking guy who happens to have posted the question. I cannot control readership. Using @Iszi's argument, it would be ethical to refuse the "sale" if I have a reasonable suspicion that there is someone, somewhere, with evil intent and an Internet access... which is pretty much always the case ! Aug 23, 2012 at 12:38
5

I think in principle I agree...and in following @Gilles well researched argument on what we have previously removed as Black Hat it does look like we have pretty much only removed ones that are either rubbish questions, or ones that are blatantly aiming to cause 'bad things'

I think I have been quite risk averse (it is instilled into you by the Big-4 :-) so have generally argued for staying further away from Black than this community wants as a whole, but it is a community so we just need to work out what is to be done.

So - a way forward that occurs to me is:

  • We don't use 'This is Black Hat' as a close reason
  • we do use NARQ/Too localised etc
  • when we have edge cases, I think us mods need to be a little more patient and you guys will have to be prepared to give guidance in the form of Close Votes and Flags, and chat in the DMZ.

Oh, and make sure you point out the ne'er-do-well's and pirates, that we may introduce them to the blunt end of the mod-hammer!

2
  • 9
    Thomas made a good point in chat - "What makes the hat black is not the stuff that is discussed, but the intent of the hat wearer and, to a large extent, they way it is discussed". NARQ + TL work on most blackhat questions, because most people asking blackhat stuff on here are, quite frankly, idiots that can't string a sentence together. The only corner cases are when we get someone asking something clearly blackhat, but in a well-written question. I guess it's then about flagging on a per-question basis.
    – Polynomial
    Aug 12, 2012 at 8:51
  • Yeah, I managed to read through the full chat late lay night. I think the arguments do stack up, and consensus definitely seems to be to be more inclusive that way.
    – Rory Alsop Mod
    Aug 12, 2012 at 8:55
5

It's not hard to come up with a real question that's not too localized, that is clearly only for black hat purposes and in my opinion should get deleted. For example:

How do I do an ARP Spoofing Attack: I'm trying to steal my neighbors passwords/credit card numbers. I set up a fake version of a popular shopping website and I can connect on their open wifi network. I think I could do something like ARP spoofing or something to redirect them to my fake site. It would be very appreciated if someone could give me a clear tutorial on how to carry out these attacks or suggest tools or other attacks that will do this for me.

Compare to a similar, but perfectly valid question on the same topic:

What is the threat from ARP Spoofing: How are the attacks done and what can I do to safeguard myself from them?"

I would expect stupid answers to the first question posting links to kiddie hacker scripts with little to no explanation of what's going on so being of no use to white hats, but being immediately useful to kiddie black hats. I wouldn't expect answers to the second question to be such low quality. Instead, I'd expect them to explain the threat (what is ARP, how does level-2 routing work) and ways to prevent it (e.g., secure the wifi network, use https and other secure protocols).

The difference is subtle, but I believe quite important. We shouldn't deliberately assist black hats or people doing blind penetration tests (that cannot be in any way differentiated from black hats). Personally, I would like something to that effect to be present in the rules; otherwise we run the risk of doing illegal things in some jurisdictions, though I am not a lawyer. (Does suggesting ways for someone to do a successful SQL injection attack on a specific application count as abetting a criminal?)

You should not ask questions asking for assistance in doing illegal activities like breaking into a system you do not have permission to use, or searching for exploits in an web application that you did not write and do not have the source code for and we have no way of knowing if the web application's owners have given you permission to legally evaluate its security. However, it is encouraged to ask and answer generic questions about various types of attacks, essentially in the context of how do the attacks work and how to best prevent them from occurring on your systems. A general guideline of questions and answers should be whether this question could be useful to a white hat (e.g., not automated kiddie hacking scripts), but a description of weaknesses in certain weak methods and how they should be fixed.


Long edit in response to Gilles:

My claim is that "too localized" and "not a real question" will not capture all black hat questions. NaRQ can usually be avoided with clear language focused a specific aspect of an attack. Localization can be avoided by asking about an attack relevant to many computers/situations. (And in any case many too localized attacks are less localized than highly-upvoted questions like "I just discovered major security flaws in my web store" ).

I have no problem erring on the side of explaining principles behind an attack to increase the knowledge for defensive measures. Yes, resources on the internet exist for black hats with tools and tutorials, but we don't have to be one of them (asking specific questions could be quite useful to script kiddies even if the knowledge exists elsewhere).

I don't think my belief is unique: let's look at other parts of the four of the five quotes you gave (Graham Lee's answer did want to allow any question asking about how to build malware without regard to intention):

These all seem to agree that intent is important; and the belief that black hat useful only questions/answers should be against our policies.

This is not an academic issue that only exists for trick questions. There have been mod-removed questions that specifically asked how do I do some black hat activity (e.g., how to exploit windows 7 remotely ) that were not too localized and easily could have been phrased as a real question.

Another example is "How can I check whether it's SQL injection? How can I exploit it? I don't have access to the source code but can query it with more requests.". I think questions like that (part of an attack or blackbox pen test) should be deleted, not edited into something resembling a legitimate question. I have no problem with a quite similar question (possibly from a gray/white box pen test) saying "the PHP source code executing the SQL query says pg_query_params($dbconn, 'SELECT * from text_table where plainto_tsquery($1) ', array($user_input); and gives error messages like ... is this vulnerable to SQL injection?". This is perfectly fine as it will be useful to know if you have to fix your weak source code (despite being more localized). Note, the original version of the question had mod-removed answers that basically said "try running this set of SQL injection kiddie scripts".

How about something along the lines of

This site is not intended to be a resource for black hats to ask for assistance in implementing attacks (or doing blackbox penetration tests that simulate a black hat attack). That said educational discussion of insecure practices, including demonstrating example code that bypasses weak security practices is encouraged to enlighten everyone on how to best defend your system against existing attacks. While we prefer to err on the side of more disclosure, questions and answers that focus exclusively on implementation of black hat attacks may be moderated.

15
  • 1
    Your argument doesn't hold much water because both questions' wording is obviously forced. The first question goes out of its way to tell the asker's life story. The second question is barely more than a title, and you've thrown in a second part that makes it even broader. I'd edit out the life story from the first, which would turn it into a good question by your standard (no illegal activity left apparent), and close the second as NaRQ. Aug 21, 2012 at 20:40
  • 1
    Generally speaking, the FAQ isn't there to rule on some strange question that some security expert cooked up to flout the rules. I'm fully confident in your ability to ask a question that is squarely within the letter of the FAQ and yet is obviously nefarious in intent. That is neither here nor there. The purpose of the FAQ (recall that the F is for frequently) is to address common cases. When arguing about the FAQ, please cite actual cases. A lack of actual cases is a good sign that the FAQ should keep silent on the subject. Aug 21, 2012 at 20:43
  • 1
    @Gilles How would you ask that question about ARP spoofing so that it won't be closed? Aug 21, 2012 at 21:09
  • 2
    @AndreyBotalov I'm having trouble asking a question about ARP spoofing because I went and read the Wikipedia article and it answered all my questions about how it works and what tools I could use (a couple of which are included in my OS). Note that the first question could be closed as too broad (→NaRQ) since the answer makes up a whole Wikipedia article. Again, my point stands: let us not waste time arguing about hypothetical questions that are not asked, or about questions that would be closed for other reasons anyway. Aug 21, 2012 at 21:36
  • 1
    "You should not ask questions asking for assistance (...) searching for exploits in an application that you did not write and do not have the source code for and we have no way of knowing if the application's owners have given you permission to legally evaluate its security." -1 I cannot agree with that, ever. I won't ask permission of "owner" (whatever ownership of some bits could mean) for evaluating a few data, ever.
    – curiousguy
    Aug 21, 2012 at 21:38
  • 1
    Again, about illegal activities. How would you know whether it's illegal pentest or not? blackhat != blackbox Aug 21, 2012 at 21:41
  • 2
    @AndreyBotalov - If I see someone needing help trying to break into a house, I'm not going to assist them. Sure, they could own the house or be a locksmith or be testing the security system. But I won't help, unless I know the person belongs in the house. I may recommend closing possible security holes, but that's it. I don't think we should assist with closed-source pentests as we can't easily tell the difference and even if you have been given permission to do a pentest, we have not.
    – dr jimbob
    Aug 21, 2012 at 22:04
  • 2
    @curiousguy - Edited above to change application to 'web application' to make my intended point clear. Its fair to search for security flaws in an application you are running on your own computer. I don't think its fair to search for SQLi attacks on an application that's not running on your own computer that you haven't been giving explicit instructions to attack. People have gone to jail over SQL injection attacks.
    – dr jimbob
    Aug 21, 2012 at 22:16
  • @Gilles - I have a long edit. I believe black hat questions that don't fall under NaRQ/too localized is a real issue (and have been removed by moderators in the past). I believe I am not the only user to have this opinion that intent of the asker/answerer is important, while agreeing with the consensus that it is fair to talk about black hat topics for educational purposes (e.g., to implement better defenses).
    – dr jimbob
    Aug 22, 2012 at 20:31
  • 2
    @drjimbob I disagree even more strongly with you now. “This site is not intended to be a resource for … doing blackbox penetration tests that simulate a black hat attack”??? No way. Aug 22, 2012 at 20:35
  • 3
    @Gilles and I had a long discussion in The DMZ about this the other day. I relate the situation to being a gun shop owner in a jurisdiction that protects the right to keep and bear arms. As responsible citizens who are in the business of "selling weapons", we will happily "sell" our "weapons" to anyone - regardless of their intent - up until the point that we have a reasonable suspicion (or, especially, confession) that their intent is malicious and/or illegal. After that point, and only after that point, it is our ethical responsibility to refuse the "sale".
    – Iszi
    Aug 22, 2012 at 21:09
  • Y'know, I'm not sure why I haven't posted that as an answer yet. Think I'll work that up.
    – Iszi
    Aug 22, 2012 at 23:23
  • @drjimbob "I don't think its fair to search for SQLi attacks on an application that's not running"(...) Fine.
    – curiousguy
    Aug 23, 2012 at 4:26
  • @Gilles - I have no problem with blackbox pentests being done. I do think assisting someone asking "I tried an attack a running web app doing X and the server returns message Y, how do I turn this into a successful attack; PS I don't have the source code, but trust me this is a blackbox pentest". As a community, we risk being trivially socially engineered into helping illegal activities. Like if I see a stranger struggling to access a linux box they don't have an account for. I could teach them how to get to root with physical access, but I won't unless I know they should be there.
    – dr jimbob
    Aug 23, 2012 at 14:42
  • 1
    Here's an example of a real question about ARP spoofing. Aug 25, 2012 at 12:51
3

What about questions like "Hi i wanna hack into my frendz computer plz send me hax tools"? I doubt these questions should be welcomed. It would be nice to be able to close them immediately by referring to a specific FAQ entry instead of arguing about black hat vs white hat at every question.

6
  • I agree. One thing that's been discussed, in chat not here, was that the example you gave would violate the StackExchange Terms of Service., and as such shouldn't need to be in the FAW.
    – Scott Pack
    Aug 15, 2012 at 11:41
  • 1
    Why do you want to argue blackhatness to close such a question? Both not a real question (too vague) and too localized (specific system, the question wouldn't help others) apply. That's part of my point: there's no need to go around looking for an extra reason to close when the existing reasons already apply, and for script kiddie questions, the existing close reasons are enough. Aug 15, 2012 at 12:30
  • 3
    Yep - I would close as NaRQ - incredibly low quality question. Boom goes the mod-hammer :-)
    – Rory Alsop Mod
    Aug 16, 2012 at 19:02
  • @Gilles: If only those two reasons applied, one could deliberately construct such a question which does not violate those two terms. (However, it would be even easier to detect it as trolling)
    – vsz
    Aug 17, 2012 at 5:26
  • 2
    @vsz First, if a question does not violate those terms, is it actually undesirable? Second, if it is, example, please. There's no use protecting against nonexistent threats. The FAQ should only discuss types of questions that people do ask. Aug 17, 2012 at 7:02
  • 1
    @Gilles - I've come up with a real question that's not too localized that I think should be forbidden for being solely of the benefit of black hats, while of no instructive use for white hats.
    – dr jimbob
    Aug 21, 2012 at 20:31
2

In my opinion to be sure that protection mechanisms work, you should know what attacks can be performed against them. Only if you know techniques that can be used to attack you, you can be sure whether you are protected. If you go to Sec.SE asking about attack protection without knowing full attack profile, you can't judge whether those protection mechanisms work. So before knowing protection measures, you should know attack itself.

Based on this, I think that questions asking about how to perform an attack seem to be good for me as this knowledge is needed to be able to judge protection measures.

For example to be sure that my protection measures catching scan anonymizers work, I should know techniques that can be used to anonymize scans.

To figure out how to build smartphone that will be able to notify user in case of attack, I should know how those attacks work.

Arguments like this can be devised in most situations.

I vote to allow content like this to be posted on site.

2

It seems to me that there is quite a bit of time wasted on the assumption that people on here (whitehat, blackhat, grey, yellow...) are actually telling the truth about who they are. Honestly, when I read a question I skim over personal details and all the 'fluff' just to figure out what the actual question or answer is -from an objective perspective.

In fact, I many times edit posts to remove that fluff just so they can be received equally and not judged on some ancillary detail (Like "my mother is..." or " I am a ransomeware author...") that doesnt add value to the post itself.

While this debate over the stance is useful from a philosophical perspective, it is moot in that we cannot reasonably determine if posters are who they say they are. That being the case, why bother getting all flustered about it. Just take posts at face value.

My suggestion would be to (1) add verbage in the policies that encourage objectivity in posting, (2) actively edit posts to remove subjective details -especially credentials that cannot be verified, and (3) encourage users to be tolerant of offensive posts.

0

It is the intent that matters. More often than not, you can tell with reasonable accuracy whether the poster is looking for help to do bad stuff or just trying to find vulnerabilities for purposes of system hardening.

To paraphrase Justice Stewart, I may not be able to define black-hat questions, but I knows it when I sees it. In other words, the only blanket rule you can make is don’t ask for help to do bad stuff, short of that, simply use provided the moderation tools (voting, flagging, closing, etc.) to deal with questions on a case by cases basis as necessary.

(You may think that this creates extra, unnecessary work, but the fact is that regardless of what it says in the rules page, bad guys—especially the less smarterier ones—will post anyway and create that same work anyway.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .