14

The kind of question I am referring to is a little bit like this one :

Malwares source repositories. Where?

Question that are around the subject of "How can I make virus/malware/exploit/etc." are going to be asked. The question is if we want that kind of question or no ? In other word should the community be white hat, grey hat, black hat or whatever you have on your head is fine ?

22

The thing is that knowledge of how to build malware can be used by three groups of people:

  • those who want to build malware
  • those who want to defend against malware
  • those who want to find out who's trying to build malware

I say we should allow such questions; people can use their own judgement on whether to answer them and similarly can judge how to use the knowledge imparted in the answers.

By way of analogy, encryption can be used by criminals who want to hide evidence of their crimes. But I doubt you believe that we should not permit discussion of encryption.

  • +1 Thanks for a thoughtful answer, and not a 1 sentence answer with vague meaning. – Mark E. Haase Jul 1 '11 at 15:40
  • 1
    Yes. This is the proverbial, guns don't kill people, people kill people. – Chris Marisic Aug 23 '12 at 21:15
8

Definitely OK to answer questions like this.

Knowledge is meant to be shared, one way or another.

If we did not educate people into building exploits we would have a lot of unknown holes in our software which only "cyber gangs" (is that even a term??) know about. Many exploits and 0days out there today is found by white hat hackers.

  • 1
    +1 for the mental image I get from "cyber gangs"... – KnightOfNi Apr 15 '14 at 20:31
6

I think it's OK to answer those questions as long as it's for educational purposes.

  • 6
    I agree, but think we need to define "educative" (or better, "educational" ;) ) better. I.e. should be around explaining principles, so as to better protect against, rather than providing food for script kiddies. – AviD Nov 14 '10 at 0:55
  • So... we should accept the question only if the asker has written some "This is for educational purposes." -disclaimer? Seems bit silly to me... – Ilari Kajaste Nov 25 '10 at 8:46
  • 1
    @Ilari Kajaste: I think common sense is good enough to distinguish script kiddies from the good guys. In other words, no need to include a disclaimer. – Olivier Lalonde Nov 25 '10 at 16:02
  • I agree with @AviD and @Olivier-lalonde. It's hard to word this, but I'd welcome clearly written descriptions of "hacking" in the old-school sense (figuring out how to do stuff) since we have lots to learn from that kind of hacker. But providing recipies to 1337-speakers would just take us in a really uninteresting and unhelpful directions. See e.g. security.stackexchange.com/questions/1457/… Rather than that question, I'd love to see a discussion of best practices for backup, and common pitfalls. – nealmcb Jan 5 '11 at 2:42
  • 3
    There's no way for us to know the intention of the poster. We should assume that high water raises all ships -- in other words, dissemination of knowledge is nothing to fear. If good guys and bad guys both have equal access to it, then the good guys win (because they know the bad guys' tactics and how to stop it). – Mark E. Haase Jul 1 '11 at 15:42
3

I think is appropriate to have such questions. You address malware itself often by reversing it. I would imagine some question would not be appropriate not because of what they ask, but because they would be better maybe on stack overflow or on crypto, if they get that technical. There are plenty of tutorials on how to work with IDA, overflow the stack, write brute forcing algorithms, etc.

By not allowing this topics, that is buying in to security through obscurity. By making this information more difficult to find or trapped in niche books not available online, we are not increasing anyone's safety. If anything, I would imagine that governments could always trace a script kiddie's efforts back here, and work with SE to get the IP information and bust someone who goes super evil black hat.

If it's a good question, with detail on a specific issue or technique asking to accomplish some specific goal, it is most likely a good fit and should be addressed.

-1

I always answer these questions very carefully and try to leave the answer informative from an academic perspective, but intentionally just vague enough to still be difficult for someone who is trying to actually make a practical attack.

I see it as kind of similar to answering questions that appear to be school assignments. You want them to have enough information to figure it out on their own if they have business knowing about it, but don't want to give the answer out in a way it is easy to abuse.

  • Making questions vague is harmful to those on a real quest for knowledge. Making an attack practical is helpful because then they can attempt it on their own systems to see things such as the attack signature, and to get a real "feel" for the attack. The same applies to homework questions. Maybe OP is asking for homework, but the next thousands of people who may view the question likely are not. – forest Aug 14 '18 at 8:17
  • @forest - I don't think you understand what I mean. There is a difference between saying "the answer to 2+2 is 4" and answering with an explanation of how addition works and how to solve the problem. The chances of anyone else having the exact same homework question are effectively zero, but a good explanation of how to solve it provides a generally useful answer that also ensures the OP learns what they need to know. – AJ Henderson Aug 14 '18 at 16:34
  • This answer was taking a similar tact with exploit questions. If someone has legitimate business learning about signatures and such, it should not be hard for them to fabricate from a technical explanation, but someone who is just looking for a quick abuse is not going to have the ability to fabricate. There might be some who won't be able to fabricate that are interested in something like signatures, but if they can't fabricate, they aren't going to get very far on signatures either. – AJ Henderson Aug 14 '18 at 16:35
  • There have been times when I had a question and the only answer was to a homework question and the horribly unhelpful answer was of no use to me. Once I created a new question but it was (naturally) closed as an exact duplicate due to being, well, an exact duplicate. Not fully answering homework or related questions poisons the Q&A resources as a whole. If someone wants to learn how to perform an abusive exploit, they should be taught how, not given vague answers that help no one but OP himself. – forest Aug 14 '18 at 20:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .