5

I found a question that apparently contains malicious code, and thus the AV block it. I understand that the question itself might be about that malicious code, but a better idea might be to edit the question and move the malicious code to Pastebin or something, and then add a link instead, so people can select if they want to click or not, unless the question is totally not for Information Security.

How to de-obfuscate a malicious payload?

Maybe a new policy about malicious code should be added so any code, even in source format, that might belong to malicious software or viruses, should be added on a external site like pastebin, and the link be added to the question or answer instead.

SquidClamav 6.10: Virus detected!

The requested URL https://security.stackexchange.com/questions/128317/decypher-malicious-payload contains a virus
Virus name: SecuriteInfo.com.JS.Obfus-185.UNOFFICIAL 

This file cannot be downloaded. 

Origin: 192.168.4.90 / - 

Powered by SquidClamav 6.10.

What do you think? Should there be a policy that any code that might be malicious or come from a virus, should always be added to a external site to prevent AVs from end users from triggering on this site.

2 Answers 2

10

I don't think it would be a good idea to move malicious code to external sites, for the same reason we want normal code to be posted in the questions (and not on JSFiddle) and images to be hosted here (and not at Imgur): If it is hosted elsewhere it might get deleted and then the question (and any answers) will be useless.

Furthermore, if my virus program warns me about a site I would feel much more confident dismissing it as a false positive if it's on SE than if it is on some random paste site.

7

We should keep things hosted on SE for one very good reason: We can control what ends up inside of a script tag here, and if it gets executed VERY easily. If it's on an external site, and hidden behind a short URL then it could be a malicious link. That's bad.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .