10

I asked this question recently which got a lot of votes and people thought was interesting, as well as some very interesting answers. It could have been the start of a very interesting discussion, except it was oddly closed for being "too blackhat".

This is ridiculous.

I asked only what techniques may exist to do so, not for advice on actually doing so.

I would think that question is not so different from other bypassing questions on this site, such as how to bypass ASLR.

The question is, to what extent do you determine a question is blackhat? Simply asking about an attack scenario is not enough, as there is nothing inherently blackhat about discussing potential attacks.

Now, if someone is asking for specific tools or instructions for a scenario, then that could be considered blackhat. In this case however I asked about potential attacks, with the question and level being similar to what would be presented at any security conference.

I would propose that simply asking how things can be bypassed, or what the potential attacks may be in a scenario should not be considered blackhat, as ideally good questions will be abstracted enough where it is possible to determine motivation.

It only makes sense for questions which are obviously blackhat to be considered blackhat. Thoughts?

8

I didn't get involved in moderating your original question, and will not defend or decry the position taken by another mod. However, I will say that my evaluation of that question is that it's overly vague. "How can a network's captive portal be bypassed" depends on the implementation of the captive portal, its integration into the host network and how much access an attacker has. Even if a good answer using assumptions based on today's common practice were provided, that answer could quickly become outdated or may not apply to the situation you're asking about.

I would prefer to see a question that details the situation you're working with, and asks for discussion of the residual risk and remaining attacks against that situation. Honestly, whether you intend to use that information for evil is unimportant to me for the purposes of deciding whether you get a good answer (though of course I would frown on evil applications, and remind you to check the legality of any actions you take). My reasoning is that even if you choose to use the site's powers for good, someone else will not.

  • 3
    I agree for the most part. Also @Sonny, I had left you a comment requesting more information, if it is a valid question, to make it answerable - or if your intent was simply to bypass a 3rd party's portal. Since you didnt bother responding or modifying your question appropriately, even after a few days, the moderator took action. As he said, if you clarify your question and comply with the FAQ, he'd be glad to reopen. – AviD Jun 13 '11 at 9:34
  • @Avid I kept the question vague as it wasfor a hypothetical scenario, as I was interested in various tools and techniques specific to no single scenario. The FAQ is not specific to enterprise security as Rory states, and as of the moment my question is complying with the FAQ. How exactly would you suggest I clarify it while keeping it general? – Sonny Ordell Jun 14 '11 at 0:41
  • @Sonny, well as some of the comments asked, a specific scenario or risk profile would be required. Also as much specific (+technical) information as possible, to be able to answer your particular question. – AviD Jun 14 '11 at 0:48
  • @Avid, I want to keep it general, not specific to any particular scenario or implementation. Is there anything inherently wrong with asking a general question to get an overview? It doesn't make sense for it to be closed at the moment, as the question has already been answered quite well. How would reducing the scope of the question help? – Sonny Ordell Jun 14 '11 at 11:41
  • @Sonny, not necessarily reducing the scope, but focusing it on the risk profile that is relevant here. Anyway, I'm not the one that closed it, just trying to explain what might be his rationale. You might be better off trying him directly. – AviD Jun 14 '11 at 11:51
5

Thoughts?

There is no such thing as black and white, only shades of gray.

After that deep philosophical bombshell: it's a subjective call. Any information can be used both constructively and destructively. I think the difference is in the impression of intent. The ASLR question, for example, says:

How effective is ASLR in preventing... How hard is it for an attacker

For a start, you're not asking: "how do I bypass ASLR?". Secondly, the question is posited as an evaluation of the defence and the threat. None of the answers actually detail any mechanisms.

What would be some hypothetical ways to bypass a captive portal? How could you bypass this?

I won't pass judgement as to whether you intend to use this or not. Likely you don't, as you're here on meta, but see how it looks? What if it was:

I have a wireless network with two separate LANs, one isolated to ensure all users sign our AUP with a restricted set of services, and one for users who have signed it. Is it possible for a malicious user to circumvent this and if so how do I prevent it?

Pretty much the same question, but looks totally different in terms of intent. If I were to draw the line in the sand, I would say the key in my version would be that you're coming at it from a defence angle too.

Do I think it should have been closed? Don't know. Moderators are only other human beings and they sometimes make mistakes, but I can see what their reasoning might have been.

  • 4
    I get that, but if specific interpretation is required for my question to be considered blackhat, then I don't think it should be considered so. – Sonny Ordell Jun 12 '11 at 22:53
5

The reason I think this issue is important is because it will affect how the site is viewed by the most savvy and potentially helpful white-hats out there. I want them to get involved here. If the site has lots of questions that would appear shady to a first-time googler, they are simply less likely to want to associate themselves with it. So how things are worded is important, not just the technical content.

Beyond that, I think that setting a constructive tone of voice is also an important element of how to word questions here, so that even when they technically are useful to both extremes, they are slightly more helpful to the white hats and at the same time are less attractive or helpful to the script kiddies. Though I also am not generally a fan of "politically correct" language, I think we should try to move the questions and answers here in the direction of being "professional".

One aspect of that is that in cases like this one, questions be worded to ask for help with mitigating any weaknesses, as well as avoiding explicit exploit code.

I'll also agree, as Ninefingers notes, that there is indeed a lot of grey in between white and black. Unfortunately this introduces more room for "subjective" interpretations which can easily get out of hand. This can easily lead to jumping to conclusions and being rude with each other, and I urge folks to recognize that and try to avoid it.

0

Got to this meta question quite late, but I'll try and articulate my thoughts on the matter:

A key difference between black and white hats is that white hats try to help, to fix, to find the problems and teach the admins how to remediate.

So in my opinion providing education so that security professionals can not only learn how to break, attack, exploit etc. but also to detect attacks, identify issues, fix problems and protect assets is what can make a question or answer white hat.

So let us not just ask for exploits, or tell people how to break in, lets provide guidance on how to keep the bad guys out!

  • So you would consider a question blackhat if it is asking about certain attacks, and not asking about prevention against such attacks? – Sonny Ordell Jun 15 '11 at 3:54
  • 3
    Not necessarily - this is a big grey area (sorry) which is why we are all having so much trouble with it. All of us want to progress research, improvements, protection etc, without making it easy for the black hats. The downside is the black hat community has far greater resources than the white hats, so leaving things out is really only a negative to the good guys. So what can we do to help - provide guidance and solutions etc. At the end of the day it is often an experience/judgement call, and mods are only human too - just trying to make the site positive for security professionals. – Rory Alsop Jun 15 '11 at 8:44
  • 2
    At the end of the day any question can be used for good or evil, so why not consider only blatant blackhat questions as blackhat? Otherwise it is relying on a subjective interpretation which is where things start to get tricky. – Sonny Ordell Jun 15 '11 at 13:40
  • 1
    @Sonny, as a rough guide, I think it is often possible to phrase the question in a way that focuses more on how to defend against the attacks. For instance, you edited your original question in exactly this way, and I think that helps a lot. It is not clear that an exhaustive list of exploit methods is always needed, to defend your system; sometimes there is one defense that cuts out a broad swath of attacks. If your goal is to protect your system, I would suggest asking for defense methods, and asking what the residual risk is or what attacks might still be possible. – D.W. Jun 20 '11 at 4:23
  • @D.W. The problem is that there was nothing wrong with my original question and it was not against the FAQ in any way. Simply asking what the threats are is not inherently blackhat, and I don't think questions should have to be phrased to be obviously whitehat. We should be able to discuss threats and attacks without having to imply a disclaimer each time. – Sonny Ordell Jun 21 '11 at 3:16
  • @Sonny - if you look at @nealmcb's answer, as well as comments like @D.W.'s and others you can see the problem. It isn't so much a 'requiring interpretation to look blackhat' - we need to actively be whitehat if we want to attract more of the individuals we want: professional security folks. – Rory Alsop Jun 21 '11 at 8:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .