Linking to malicious code

Question

I asked a question about obfuscated javascript - the javascript in question is malicious, and contains code to exploit various browsers. In a comment, DCoder asked for the actual obfuscated code.

I would normally be against posting such code in a public venue, but in this case it is relevant to the question - and I'm sure this is a situation that will happen in the future.

There has already been discussion of where to find malware samples, though most of those sites are laden with warnings - which is a bit different than linking to a gist / pastebin with malicious code.

So what's the policy here?

Answer 1

This is a massive gray area.

When someone is looking for a specific example or piece of code, I would say a gist or pastebin of malicious code (the Java 0day exploit, for example) would be the appropriate method.

As far as posting links, especially those known to contain malicious content (even if the content is only plaintext links to malicious code), I think the best policy would be to make all such links in plaintext so that inexperienced or unwary users don't just follow a link that would take them somewhere harmful. This is adapted from WOT's link policy in their forums:

When posting websites and links

Please do not post live links when referencing a website. We do not want anyone to accidentally visit a dangerous site.

Use simple domain names in a format like this:

example.com
example.org
example.co.uk
example.de
127.0.0.1

If you are referencing a URL, change the HTTP to HXXP. For example:

hxxp://www.bad-malware-site.com/images/phish/virus.html
hxxp://127.0.0.1/exp/botnet/phish.php

Perhaps it would be a good idea to use a similar policy as far as linking to known malicious content. Links to non-malicious content would still be fine.

In addition, when a user posts links to actual files containing malicious code, such files should be in a compressed folder protected by a password (many security firms use this policy). The user who downloads the file would therefore become liable because he/she would have to take the extra steps necessary to run the code. If the link had led them to a file that would execute upon download, or even if the file would only executed when the user actually issued a command to execute, that could lead to liability issues. We need to take as many steps as we can to minimize the damage to users' computers, especially where Stack Exchange could be considered responsible.

It would also be a Bad Idea to assume that all users know what they're doing when they visit sites to intentionally download and execute malicious code, even though being a part of the site kind of implies such knowledge. It could be stated that Stack Exchange network is not liable for anything that goes wrong due to someone clicking a malicious link (to avoid legal liability for damages, if applicable).

Of course, I'm probably missing something that would help with a better solution to the problem.

Answer 2

I don't know of any policy, but here is what I would recommend for this site.

• If linking to live malware (that is, if you go to a website and your browser is actively attacked)
  
  • Don't use an actual url. Post the link in plaintext using hxxp or hxxps as opposed to http. Also, any use of this kind of url should have an explicit warning that this link is malicious.
  • If possible, post the content to pastebin or a similar site. This will prevent losing the content in the case where the original url goes down or is changed. Again, warnings should be present within the pasted text.
• If linking to malicious file
  • Malicious files should, when possible be zipped with a password (usually 'infected'). This will prevent users who do not understand what they are doing from accidently running a link they click on.
  • If the linked file can not be zipped, then the url should be posted as plaintext using the hxxp format with necessary warnings about the malicious content.