What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 122 Stack Exchange communities.

Developers, sysadmins, and users (the holy trinity SO, SF and SU) should know black hat techniques to defend themselves better against them. Posting such instructions on public forums, however, creates the risk of malicious use. Would you answer questions that require black hat knowledge?

share|improve this question
8  
@Pesto thanks for teaching English! –  Jader Dias Aug 5 '09 at 14:27
    
See: meta.stackoverflow.com/questions/3528/… –  Shog9 Aug 5 '09 at 15:57
    
Why the bounty? What answer are you looking for that you haven't got? –  Eric Aug 7 '09 at 17:55
add comment

10 Answers

up vote 8 down vote accepted
+100

Developers tend not to have been taught anything about security (see blog post) I particularly like the quote:

"I start my security training class by asking developers "how many years of development experience do you have?" On average there are about 3-5 years experience. Then I ask "how many people have done a one day software security class?" About one hand will usually go up.

So in class of 30 people, we can expect 150 years of programming experience and about one day of software security training experience! Is it just me or should we really give up on this stuff when we haven't even really started trying seriously yet? "

So if there is a base of knowledge that I can point develoers at and say "Here read this, follow the instructions and test the hell out of your app" then I'd be a little (not a lot) happier that the application may be secure.

Likewise I'd love QA/testers to do the same. Hell I'd love management to take it seriously too.

Ultimately all this knowledge is out there somewhere, and the blackhats are already using it. If we (as whitehats) do not equip ourselves with even the basic knowledge we don`t stand a chance of securing our computers.

If you ban guns, only bad guys will use them...

share|improve this answer
add comment

"Black hat" is based on intent, only. There's no difference between "black hat" and "white hat" knowledge. If it's publicly available info (e.g.-a public exploit, SQL injection), then I don't see a problem with it. Preferably, you leave something explaining how to protect against whatever it is you're explaining.

share|improve this answer
add comment

This question is impossible to answer, because it depends so heavily on specifically what is being asked, and why.

As they say, "It depends."

share|improve this answer
add comment

It is a difficult question to answer definitively. Increasingly there may be legal issues, and I'm no lawyer.

Computers and those that program and even use them have historically been regarded with some suspicion. As As Janet Reno, at the time the US Attorney General, said in 1998: "They have computers, and they may have other weapons of mass destruction."

Many countries, including the UK, log all web sites users visit and the source and destination of all emails, retaining this information for several years.

Several countries, including the UK and Germany, have, to varying extents, made the programming, possession, use or distribution of "hacker1 tools" illegal. Within this there seems to be little understanding of the dual-use possibilities of most software.

It may be that providing assistance in obtaining and using such tools could be seen as a criminal or at least terrorist activity, especially if the advice given did, indeed, lead to criminal use of the tools or methods.

Whether we need to take these possibilities too seriously is hard to know. Do they affect the amount and usefulness of information given in response to genuine queries from sysadmins? Probably yes. At least as worrying is the deleterious effect on dissemination of information about known weaknesses in software and systems and the availability of good tools for testing and evaluating software and systems.

1 Sadly, attempts to retain 'hacker' as a positive term seem long-since lost in the media and political worlds: perhaps we should have copies of Henry S Warren's "Hacker's Delight" on our desks to remind us of a happier use of the term.

share|improve this answer
2  
In Germany it shouldn't be a problem, if you are a white hat. A prosecuter refused preliminary proceedings in one case (only in German): heise.de/ix/… –  Ladybug Killer Aug 5 '09 at 16:01
add comment

Like this?

http://serverfault.com/questions/24464/security-admins-toolkit-whats-in-yours

share|improve this answer
    
many of these tools serves multiple purposes. but it was in a question like this that I learned about some tools that could serve only security experts. –  Jader Dias Aug 13 '09 at 12:30
add comment

Knowing the worst about a piece of code is often the only way to truly understand how to know the best. I would have no objection to posting black hat techniques in response to a question as long as I was satisfied that nobody, including myself, would be vunerable to any sort of trouble from it, that the person was not intending to use such information to no good, and that the information was already readily avaliable and reported to those responsible for fixing said vunderabilities.

If on one hand, I discovered a hole in a particularly important piece of software, I would make it my priority that I make sure I give due notice to those whos busines it is to fix that hole, but on the other hand, I would surely not let it stop me from educating those in the community on best practises to prevent the exploit from affecting them.

Education is prevention, and even black hat techniques can be taught in an education way.

share|improve this answer
add comment

A determined malicious user would surely be just as capable of obtaining these techniques as a 'white hat' user...

share|improve this answer
2  
A determined malicious user, probably doesn't need a public forum to find the answer either. After all public forums leave a trace :) –  dimitri.p Aug 5 '09 at 17:47
add comment

"Black hat" or "White hat" is how the knowledge is used, not the actual knowledge.

The question is then are you writing for a Black hat or white hat audience?

  • If you are writing for a white hat audience include information about how to defend against it.
  • If you are writing for a black hat audience include information about ....
share|improve this answer
add comment

IMHO, no.

Any resourceful programmer can find this information in the usual places; a sufficiently clever one could probably obtain the answers via seemingly-innocent questions... or questions seeking to avoid problems - as Eric notes, the primary distinction is intent...

...therefore, by answering a question written with blatantly malicious intent, you're doing nothing but benefiting malicious programmers too lazy or stupid to achieve their nefarious goals otherwise. You're effectively handing explosives to children. That's not a good idea.

share|improve this answer
    
If I have the intention of invading my own servers, without using any private knowledge such as passwords, as a way to test it's security. Would you classify it as malicious intent? –  Jader Dias Aug 5 '09 at 18:05
1  
Nope. I wouldn't consider that malicious, "black hat", etc. I'd answer. Of course, that'd be a great way for a malicious user to phrase their questions as well... but again, not much we can do to keep determined miscreants from learning this stuff anyway. –  Shog9 Aug 5 '09 at 18:56
add comment

Short answer No Way. Just because it's possible to "---------" to make "--------" unusable by just typing "------" at the "----------" it should not be announced.

That's no different asking your buddy working airport security how to sneak xyz past airport security. I hope they don't tell you. I even hope they don't even know so they can't tell you.

If you know what I mean. If you don't know, sorry, I can't tell you :)

share|improve this answer
    
I wish this information could be posted in public forums, so the airport authorities could take measures to prevent such things to happen again. The same way I think that public forums should contain hacking tutorials so every sysadmin could be aware of how they can protect their systems. –  Jader Dias Aug 5 '09 at 18:08
1  
If people working airport security knows of a weakness, the correct response is for them to fix it, and if not specific to their airport, share the information with other airports' security. In computing, there's no small close group of security teams, because it affects everyone, so to share it means to make it public. –  KTC Aug 7 '09 at 16:36
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .