Should we allow posts to contain links to capture files?

Question

I know this is not something that we could easily ask SEI to implement, so it's more of a site moderation policy question. The post that inspired this question is here:

https://security.stackexchange.com/q/16775/953

Though I haven't reviewed the file myself to know if these particular links fit my concerns, I think we really should have a general (no exceptions) policy about this.

The risk I foresee is that the capture files may contain sensitive personal or organizational information sent over the network in the clear, or in an easily recoverable format. While we obviously cannot be held responsible for the fact that the information was sent over any network in such form in the first place, or that it may exist in capture files uploaded to a third-party hosting site we don't control, or that links to the files are posted on our website, we may be criticized or acted upon (rightly or not) for allowing those links to remain unmoderated.

I suggest our policy be to remove such links on sight, but this is of course a policy that needs to be decided upon by the community - and, particularly, the "Blue Diamonds". Additionally, we should request (as was done not long ago in the case of a web vulnerability link) that SEI mods remove old edit history items which contain those links.

I've already removed the links from the post in question, here. However, they remain (for now) in the edit history in case this decision is reversed by the community and/or our "Blue Diamonds".

Answer 1

I think we really should have a general (no exceptions) policy about this.

I see nothing wrong with sharing pcap files in principle. You might be looking at one for self learning purposes - i.e. just a boring home network 192.168.0.0/16 ladada NETBIOS INAMEMYPCAFTERSTARWARSCHARACTERS laadadadaaaa.(*)

That said, there is a potential for an individual to do some form of examination (warranted or not) on a network they do not own and publish the results here, accidentally letting on far more than they intended. There's also potential for an individual to publish a file that is part of a contracted analysis. I mean, people don't hire people who just publish sensitive stuff on the web or write their pentest contracts missing clauses that say "you won't publish what you find or any details of our network that might lead to an attack", do they? Do they? But there's still a potential.

But I think we can come a level down from that. Publishing an entire pcap dump and saying "hey guys, can haz help doing analysis?" is the equivalent of going to Stack Overflow with a 20,000 line perl program and saying "hey, there's an error somewhere in this, please help?!". The typical SO reaction is "we are not doing your job for you".

I suggest we deal with these under the same premise. Exactly what packets are you interested in? Reproduce those in the question, not some pastebin/file upload site I have to go to look at, download, pass through tcpdump. The chances of me bothering to do that are really very remote. I have enough crash dumps waiting on my desk at work...

This has the nice side effect of dealing with accidental leakages via these mechanisms. "We're not analysing your tcpdump for you unless you do some legwork and ask about what you're seeing" also means we'll either just close, edit in or otherwise mask the information.

Blowing away revisions is not something moderators can do. Moreover, the procedure for blowing away data from revisions goes like this:

• Delete it (question, answer etc) immediately.
• Contact community with a link to the revision.
• Wait for the revision to vanish.
• Undelete if community person didn't.

The reason for the immediate deletion is to halt any further leakage - only 10k+ users can see the revision and only if they have a link. Of course, for the user, unless they requested the removal, this is an inconvenience they may find frustrating ("omg evil mods why did you delete my question?") and result in "unfathomable behaviour" and possibly a "repost condition".

So what I'm trying to say is that one would have to be carefully handled. I'd personally reserve it only for cases where the person asks for it, as it involves the effort of at least one mod and at least one member of SE staff. I know, I'm ARPing on a bit now. Sorry.

_{(*) Naming your PC after star wars characters is not funny and it's not cool.}