20

Every so often we get questions about someone having found malware and wanting to know what it does. Essentially they are asking us to analyze the malware and tell them what it is. The latest one is here, about boring and awful PHP black hat SEO malware.

In my opinion, those questions are mostly useless:

  • there is an infinity of possible malware variants, so an answer wouldn't apply to anyone else, unless they find the exact same malware (which is getting rare as crooks use different obfuscators)
  • the author won't learn much just by reading someone else analysis. Maybe a canonical question "how to I reverse engineer X malware?", where X being the general category of malware (Windows, Linux, web, etc).

We should probably close those broad questions and only leave those asking more specific questions that could potentially have value to someone else later on (questions about a specific exploit, obfuscation method, etc). What do you think?

2
  • 1
    Every so often we also get this very kind of question. Short: We are not a service. We are people wanting to help. Abuse does show up, yes - but most of users' participation in Stack Exchange is legitimate. (This comment is directed to the SE community at large, rather than to this question's author).
    – Marc.2377
    Sep 30, 2016 at 4:02
  • 3
    @Marc.2377 the issue is, I believe our help capacity is limited and I'd rather see us spending it on content that will help other readers, rather than reverse-engineering an unique piece of malware that does nothing interesting. Also having those questions around would incite others to post their crappy PHP malware and expecting us to do all the work.
    – André Borie
    Sep 30, 2016 at 14:04

4 Answers 4

Reset to default
15

Mark Buffalo worked up some canonical PHP malware answers with the process for analysis for the sole purpose of addressing this issue. We should point people to these questions (my internet on vacation is way too slow to search for them).

3
  • 3
    Is this the one you are refering to? Just read it quickly, but it looks like a good dup target to me. security.stackexchange.com/questions/115461/…
    – Anders
    Sep 19, 2016 at 18:50
  • 3
    I don't think it's a dupe of the canonical malware-deobfuscation question. The code in security.stackexchange.com/questions/136966/… wasn't really obfuscated in the first place, and the OP did the work of analyzing what the malware was doing. His only remaining question was "What does the malware gain by doing this?"
    – Josh Townzen
    Sep 20, 2016 at 22:45
  • 5
    I'm Mark Buffalo, and this is my favorite answer on the Citadel.
    – Mark Buffalo
    Sep 22, 2016 at 6:39
13

It seems to me as though the answers in that question are actually really useful, particularly to anyone else facing a similar issue.

So what is the actual harm to this community?

If people can get value from the question and answers and there are people happy to provide clear answers, shouldn't this be encouraged?

I agree though that if a question is too broad to be able to provide a useful answer, then we should at least encourage the OP to reword the question.

3
  • 11
    The problem is that the pattern of "what does this random, uniquely generated, obfuscated malware script fragment do?" is not useful to anyone else. The harm is that we end up with a catalogue of randomness, which lowers our overall quality. Plus, it's not a security question, but a code review/interpretation question (so, off-topic). That's why Mark created a very detailed, wonderful answer on a process for someone to analyse code themselves.
    – schroeder Mod
    Sep 19, 2016 at 20:56
  • 2
    Ah, OK. That explains the answer which certainly was helpful ;) It's just that I certainly learned something from the question (well the answers I guess but they wouldn't have been there without the question). Maybe just a reminder from me that usefulness is not always obvious to a small subset of people no matter what their experience?
    – Julian Knight
    Sep 19, 2016 at 21:58
  • 1
    Remember that this isn't one of the ways security.SE set out to be useful, though. Your argument is a point in favour of allowing some code-analysis questions, but isn't sufficient on its own. There are exceptions to every rule, though. Over on SO, I've certainly argued in favour of some sepcific questions that bent the rules. But when there's a pattern of similar questions, it's less clear that security.SE needs more than one or two.
    – Peter Cordes
    Sep 22, 2016 at 3:19
10

I think the question @schroeder recommended is a great canonical question.

But, and this is a big but: Just because we got ourself a fancy new hammer, we should not be fooled to believe that every question is a nail and hit the close button without thinking twice about it first:

  • Is the question not about what the malware does, but what should be done with the server once it is infected? Then there is another dup target for that.
  • Is the question about a specific problem with deobfuscating malware code, that is not covered by the canonical question? Then it is not a duplicate.
  • Is the question about why the malware does the things it does (and not how you deobfuscate it and read the code)? Then it is not a duplicate. I think this was the case with the one linked in this meta question. Closing that one would have deprived us of a good answer.

So please do not close just because you see an obfuscated code dump.

3

I'm finding lot of new stuff on daily basis about security through stackoverflow questions. Definitely I will not search for these stuff unless I've an issue since that is not my field.

However the links like those referred in your question pops up in Hot network questions and helps me to be understand and aware of security methods need to be taken care during application design.

Also it may be a variant which is not found in other answers, but I agree if it is a answered and duplicate question, should be closed with a link.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .