Should we allow malware authors to weigh in on questions?

Question

The title is perhaps more inflammatory than the reality, but I can alter it later.

Concerning this answer: https://security.stackexchange.com/a/120775/6253 to the question "What should you do if you catch ransomware mid-operation?"

There has been a lot of controversy and a ton of flags. I am choosing to keep the answer in place.

1. It is the only answer that suggests that interfering with the encryption process might damage the data
2. The author discloses the conflict of interest

From a technical standpoint, it has validity. From a conflict of interest perspective, all cards are on the table. People have the info they need to make an informed decision.

This specific malware author is not benefitting from this specific instance: the topic and answer are generic, it's not about this author's own malware. So, there is only potential tangential personal benefit to the author from people following the advice.

If the answer had more direct benefit to the author, then things would be different.

Answer 1

We should judge each answer on its own and whether it provides valid advice. The fact that the author is a malware developer is irrelevant. If the advice is good, then upvote it, if not, then downvote it.

Answer 2

I don't think we should lock it. I fundamentally disagree with the poster's immoral stance. But see, in the information security field, this is what we're up against: people who don't care who they hurt. They'll justify it all they can.

That answer is a good reminder of what we face daily, and it's technically correct anyway. It's also a good reminder to have proper, unattached backups.

Answer 3

This reminds me of this question and my answer. Basically, you have an answer which is technically valid, informative, and fully honest in its disclosure of conflict of interests; and yet, it comes from an author with which "we" (the so-called SE community) would not like to be associated. It kinda forces us to make a clear decision.

I suppose that if that answer came to appear before the eyes of a journalist who is out of news fodder, or the chaste eyes of a SE moderator (not a community-elected moderator), then thorough smiting may occur. In that sense, keeping that controversial response visible is really a question about how much you are ready to defend it. But this is just an unsubstantiated prediction of mine, of course.

Answer 4

In regards to the question https://security.stackexchange.com/a/120775/6253, how can we even validate that the poster indeed is a malware author?

As I mention here it seems there is an undue amount of time focusing on the philosophical implications of assuming online profiles can be trusted. So what is the point? At the end of the day, our site should be a professional resource, yes? If so, then why get hung up on minor details that can not be verified?

My advice would be to simply edit that question to remove the disclaimer that the kid is a malware author with the justification that this cannot be verified and due to it's inflammatory nature does more professional harm than good and therefore is nothing more than perceived trolling...

And a gentle reminder to all to just be objective and tolerant.

Answer 5

The real answer lies in the question

Is this disclosure an example of a conflict of interest?

This case: Not really.
The case by case basis is the rule of thumb for this for a reason. This disclosure is showing that the person just writes such types of software and has experience with them. It does not bound into the conflict of interest range since it does not recommend something that is a true interest in benefit to the answer writer. Their answer really only points out one thing, and that is in that doing something wrong is just as bad, if not worse, than doing nothing and that it is really easy to do something wrong. That's not really a conflict of interest, just a statement of experience from such and such place.

The problem comes in that people are miss viewing it and raises a few more questions

Is the FAQ/Rules about conflict of interest clear enough?

The answer to that is a little trickier since I can't see the votes themselves(yet). If this is a bunch of close because of conflict of interest, then maybe it does need to be written in a better manner that shows what a conflict of interest REALLY is.

If the votes to close it are We don't want to associate with this person then you run into the question of

Should we worry that people who write malware browse our SE?

But the answer to that is an astonishing No because they could go to a library and with enough research find the SAME EXACT information, and by trying to block them we run into the larger ethical problem of

Who do we ban in advance based on speculation to keep us running the way we want to?

which is a bombshell I'm sure NO ONE wants to jump onto.

Answer 6

I repeat the message I put in the flag: "Advise locking this post. Deleting is silly and probably counterproductive."

In the days where CNN runs articles on the inside of criminal or near-criminal institutions, erasing their voice altogether is pointless; it will just appear somewhere else.

Answer 7

Ok, so let me clarify my stance on this one. The answer is two fold:

The best thing to do is nothing. Doing something stupid might lead to data loss or corruption.

This part, I am totally fine with. It's a valid stance and is worth discussing regarding restoration of data if the process can be reversed.

Then comes the second part:

Let it finish and then contact the people listed there, pay the ransom and you are good to go. We are professionals and will help you get your files back. Disclaimer: I am a ransomware developer.

This part is potentially harmful as malware owners will most probably:

• get a copy of your data in the process
• get your money and not give you your files back

Both of these being harmful to the user, even if he is honest with his business. Not calling out the potential risk while kind of advertising for the service is detrimental to someone looking for answer for this particular problem, especially if it's ongoing.

The disclaimer is error prone at best, malevolent at worst. It is not really possible to know whether the author claims that malware authors like him are professionals that will help you get your data back, or if he is posing as a security expert, knowing about malware, that will help you recover your data the right way. I'm not yet sure which understanding is intended.

There is some refining to do here to avoid any confusion.

Answer 8

The author discloses the conflict of interest.

Disclosure doesn't necessarily make every conflict of interest acceptable. If somebody posts, "how do I do X" and somebody answers, "just buy product Y, disclaimer: I am author of product Y," then we would not accept that as a valid answer.

Furthermore, other posters in this thread are talking about this disclosure like its some altruistic attempt at transparency. You really think a criminal cares about the SE rules? My guess is that he discloses his affiliation because it's the only way to support his answer. He can't show any code or point to any documented examples, so instead he says, "I know because I created it."

For these two reasons, I assert that the disclosure is totally worthless and should not be considered a mitigating factor in this poor quality answer.

This specific malware author is not benefiting from this specific instance.

He doesn't benefit directly from this one answer, but in the same sense that industry associations lobby for policies beneficial only to their members, this criminal is lobbying for an answer to the question that benefits members of his industry — himself included.

It is clearly in his interest to convince people not to try to defeat ransomware. Especially if he can convince security experts on this site, then those security experts take that knowledge back to their coworkers, friends, and family.

Could you picture him providing an answer that undermines his business? "Suspending ransomware is a really good way to mitigate the damage, and I know because the ransomware I wrote is utterly defeated by this tactic!" Of course he wouldn't say this. He's not going to undermine his own business. Ergo, telling people not to suspend ransomware is a way of supporting his own business.

People have the info they need to make an informed decision.

How does this answer inform the reader? It is absurdly brief, provides no explanation, and offers no citations to support its points. It is the shortest of all 8 answers for that question. The next shortest answer is about twice as long, and the average answer is probably 5-10 times as long, which suggests something about the amount of information in this answer.

From a technical standpoint, it has validity.

I see no evidence of this. Many technical questions have an easily verifiable answer, e.g. run some code and see if it works. Answers that are difficult to verify directly should cite some authoritative source (documentation or source code). An opinion-only answer or a "just trust me" answer is not a good fit for SE.

According to InfoWorld, there are many instances where paying the ransom simply doesn't work at all.

In this case, letting ransomware run to completion is exceedingly unlikely to benefit the victim:

1. Files that were not yet encrypted could have been backed up.
2. Files that were already encrypted were conceivably recoverable under a number of plausible scenarios (weak encryption, failing to overwrite plaintext, etc.).
3. A file that is in the process of being encrypted could conceivably be corrupted, but not if the ransomware writes the complete ciphertext before overwriting the plaintext. And if a file is corrupted in this way, the probability that it is an important file is # of important files / # of files, which could be a very low probability — much, much lower than the probability that some of the unencrypted files are important.

Given the OP's scenario of not being willing to pay the ransom, points #2 and #3 aren't even on topic.

Should we allow malware authors to weigh in on questions?

6 upvotes for a comment saying you're a "sissy" if you disagree, but when it comes to the bad guy, nobody wants to call him names! "Malware author" is a generous characterization of what he does.

He's a criminal.

His ilk are extorting hospitals, potentially leading to interrupted medical care and resulting in illness and death. Even if his opinion was technically valid (it's not) and answered the question (it doesn't) and didn't serve his own interests (it does), he still shouldn't be given a voice in this community.

I'll shut up now.

Answer 9

The question is about whether we should apply a moral basis to answers. I think the answer is a resounding "no". If we went down that path, the question becomes "who's morals?".

Morality is personal, cultural, and often ambiguous. Personally I believe malware authors are scum, though some may disagree. But what about some kid that hacks Facebook in some relatively harmless, but clever way? What about someone who offers an answer about getting past "the great firewall of China?" Many people would approve of that here, unless you're a Chinese official.

If you start down the path of limiting certain people because you don't agree with them morally, where does it stop? There's rarely clear guidelines, and unclear guidelines create self-censorship.

Keeping an open culture allows open discussion. Trying to clamp down on people for crossing your own moral line (but still providing useful information) only clouds the issue, and creates an atmosphere of silence.

Answer 10

The fact that a person is malware developer does not bring the person's full intent into perspective by itself. Just as hackers can be good or bad malware developers can be good or bad. Penetration testers develop malware all the time (whether it is automated or not i.e. msfvenom). Unless a user is specifically saying that he/she is trying to rob a bank or spy on their ex, we as a community shouldn't jump to conclusions that the intent is malicious. Therefor, should not attempt to censor questions relating to malware.

Answer 11

I think we should weigh all pros and cons. Speaking about Ransomware is actually like suggesting to enter personal data on a phishing site.

Assume I have never heard of Ransomware. If a pop-up shows up asking to pay to retrieve my data, I will probably not pay.

However, if the pop-up shows the message "You have been caught by Ransomware" and I previously know what Ransomware is, there's a slight chance I will pay (eventually using a throwaway credit card) if the asked money is not so much and I don't want to reinstall everything on my machine.

Questions and answers on Ransomware helps Ransomware builds a reputation, which turns in money for Ransomware developers. Isn't strange already the burst of traffic on that question? I've also had some discussion in comments which was extended into a chat discussion about that.

However that question is invaluable because it makes present that encrypting data may eventually cause the loss of the data (bugged crypto routine, or simply a 1 bit error: if you have a 1 bit error somewhere in your source code it will just turn into a compiler error, which is easy to fix, however 1 bit error in encrypted data turns into a permanent loss of all data).

Personally, I would not delete that question in particular, but there are other questions that maybe should be deleted (however given a lot of blogs already speak of Ransomware, this should be done only if SE gives to malware writers much more visibility).