In this discussion I got the comment: "Trying to understand virus code is beyond the scope of the site. At this point, I do not think there is a SE site that handles this type of question."

Would it make sense to have a "Software Security" site as the "Information Security" site seems to have an implicit slant towards network security. By software security I mean as defined in the book Software Security.

  • I'm struggling a little with these responses. I gave what I believe is a succinct and accurate description of what that code does. I would think that clearly demonstrates that I am not asking for how to reverse engineer the code. My question is about why is it doing what it's doing i.e. what vulnerability might it be trying to exploit. What is the correct place in SE for that kind of question if not "Information Security"?
    – JimmyJames
    Oct 22 '15 at 20:40
  • Clearly I'm confused. I asked as question, told it was out of scope by a highly decorated user and that there was no SE site for that. Then I asked should a new site be created, and was told no that this site was about security and/or there other sites that were already relevant. But they aren't, as I have explained. So is the answer that my question is in scope?
    – JimmyJames
    Oct 22 '15 at 20:50
  • OK, that's helpful. The 2 comments I got on my question were not helpful and one suggests it's off topic. Want to look at my real question ;)
    – JimmyJames
    Oct 22 '15 at 21:15

You have a couple of bits in there I want to answer:

First off - no, this site really doesn't have an implicit slant to network security at all. Some consider it very process focused. Others see it as business/compliance focused. Yet others have different points of view. It is an Information Security sure, as per our [about] page.

Trying to understand virus code is not necessarily about security at all. We have various sites on code, code review, reverse engineering and other similar disciplines. Additionally, anti-malware vendors have paid teams to do this sort of thing so they are likely to be well ahead of any amateurs.

  • What make you think I am an amateur? This is absolutely part of my work and career path. I think you are not aware of what software security means. The whole point is that you cannot outsource or buy security. It's a discipline that needs to be built-in to the processes every organization that is developing software. One of the keys to "building security in" this is understanding exploits. See the book above for a more detail. This kind of attack clearly falls under architectural risk as it appears to be attempting to subvert (potentially quite effectively) a vendors security solution.
    – JimmyJames
    Oct 22 '15 at 20:19
  • 1
    @JimmyJames Re the implicit slant, I would go further than what Rory said, and point out that this site was originally, in its very first iteration as an Area51 proposal, an application security site, and the rescoping happened during the private beta.
    – AviD Mod
    Oct 23 '15 at 6:53
  • 3
    @JimmyJames The issue is that understanding what a virus does is NOT about software security, it's about virus research - and specifically, this particular virus. It is rarely an architectural issue, but about a specific bug (or sometimes, not even that). On the contrary, architecturally speaking it does not even matter which vulnerability, or what virus, etc, which is why we usually don't accept that type of question "what does THIS virus do".
    – AviD Mod
    Oct 23 '15 at 7:01
  • @JimmyJames No, you just misunderstood him: he has NOT accused directly, indirectly or in any way of being amateur. This is said, I confess I am amateur in 99.999999% of aspects of life, there is nothing wrong with that.
    – user45139
    Oct 23 '15 at 10:06
  • Jimmy - as Begueradj pointed out, I didn't say you were an amateur at all. My comment was leading more towards the fact that virus analysis professionals are most likely to do the job for pay, not for free on SE, so asking for someone to analyse a virus here is unlikely to get professionals providing you with an answer.
    – Rory Alsop Mod
    Oct 23 '15 at 11:39
  • 2
    Additionally, yeah, I think I am only too aware of software security, and some of the meanings different organisations hold for it. Building security in does not necessarily require any understanding of exploits. It does require good software development practices - and these are on topic here.
    – Rory Alsop Mod
    Oct 23 '15 at 11:41
  • How do you suppose that developers and system architects are supposed to prevent creating vulnerabilities or eliminating them if they do not know what they are. Again, I didn't ask what the virus was doing, I explained what is was doing. I was looking for information on what type of attack this might be and how to defend. With all due respect, your statement that "Building security in does not necessarily require any understanding of exploits" directly contradicts expert opinion on the subject.
    – JimmyJames
    Oct 28 '15 at 16:13
  • Here's an example: preventing SQLi: we know how to code to prevent this. 100%. Rules can be given to devs to remove this. They don't need to understand SQLi. Yes, I hope they would in this basic case, but do you see what I'm saying to you?
    – Rory Alsop Mod
    Oct 28 '15 at 17:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .