10

This question asks about a "stealth keylogger" recommendation. Now, there is a small chance this person is only using it to spy on his kids or something of the sort. But from the fact that he want's it completely undetectable, it makes me feel they're going to use it for malicious purposes. Now obviously it's not our job to be the morality police, but helping someone with a task that could turn out to be, somewhat of a malicious task, is that something we should answer here in our community?

My thought on this, and why I'm asking, is because maybe I'm not seeing something in my logic. Where do we draw the line on what we recommend? What kind of programs do we not recommend because they could be used for false purposes, and what one's do we let slide? I'm just throwing my thoughts out there, I'm not asking for answers to multiple questions here.

8

helping someone with a task that could turn out to be, somewhat of a malicious task, is that something we should answer here in our community?

“That could turn out to be (…) malicious” is not a reasonable criterion. Any question could turn out to have a malicious purpose. As an example, let me take a random question¹: E-tender system Gee, a tender system. This could be used to handle bids for a criminal act. Should we ban that question on this basis? Of course not!

I presume that you really meant “a task that is likely to be malicious”. The problem is, how do you determine that a task is likely to be malicious?

You can't rely on the asker's intent. You can't rely on their intent because you can't know what their intent is, only what they've stated. And even if the intent was clearly stated and you believed them, it wouldn't be relevant — maybe the next visitor who browse that question will have a different intent.

Stack Exchange used to have a site about firearms. (It closed due to lack of traffic.) A firearm is fundamentally designed to cause harm. Now firearms can surely be used for good, but that's the decision of the person wielding it. Any firearm recommendation would be likely to run afoul a “likely to be malicious” criterion, since it could be used straightforwardly to kill someone.

So we have a clear precedent that “likely to be malicious” isn't the right line to draw. Rather, the line is something like “unlikely to be useful for benign purposes”.

Challenge: find an otherwise suitable question for this site that is unlikely to be useful for benign purposes.

Where can I find a stealth keylogger for Windows? demonstrably does not fit the bill: the question explicitly lists a benign purpose — “I would like to test detection of a stealth keylogger …”

On Security Stack Exchange, “black hat” questions, i.e. questions on how to attack a system, are permitted. This is not surprising since many of the active users there are professional penetration testers — people whose job is to look for vulnerabilities in IT infrastructure and report it to said infrastructure's owner. But this isn't the only reason. I'm an application developer, and the products I make are security sensitive. My job is pretty fundamentally white hat: a big part of my job is to make a product that resists attacks. In order to do that, I need to understand the attack techniques! The black hat content on Security Stack Exchange is useful to me because I'm a white hat.

I have no idea whether the asker of the keylogger question is, in fact, testing its detection. But this is the sort of question I might ask (mutatis mutandis, I don't work on Windows administration). So I personally see this type of questions as useful, precisely because my intent is not malicious².

¹ Methodology: I drew random numbers between 1 and 26555 (the latest question as I write) until I found one that was the ID of an open question (i.e. excluding answers, closed questions, tag wikis, etc.).
² Or isn't it? For all you know, my job is to protect weapon control systems used by <insert your most-hated dictator here>.

  • In addition, there is stil you personal 'gut instinct'. If you think/feel it is probably with malicious intent, don't answer it. But do not downvote or vote to close. – Jan Doggen Nov 27 '15 at 14:50
0

Almost all software can be used for malicious intents – every medal has two sides. But in this case I fully agree (finally it was me bringing it up in a comment there): As soon as it becomes clear it definitely is bad intent behind the question, the line has been crossed. Such a question should not be answered then, and best be closed/deleted.

As we do not have an appropriate close reason specific to that, and users with "not enough rep" are not able to close-vote at all, this leaves two options:

  • if you can, close-vote it for being "off-topic" (I'd say helping on such an intent can be seen such) – or close-vote it with custom reason
  • if you cannot close-vote, flag it for mod attention
  • when in doubt, just leave a comment on the question (maybe OP can clarify) – and optionally bring it up in chat (with a link), so it's not forgotten even if OP does not clarify.
  • “As soon as it becomes clear it definitely is bad intent behind the question”: first of all, that's not the case here — the question ostensibly states an intent which is surely not bad, namely to test a malware detector. But anyway, intent is applicable, since you'd need to know not only the intent of the asker but also of all the visitors who'll read answers in the future. – Gilles Nov 19 '15 at 18:17
  • @Gilles "the question ostensibly states […] to test a malware detector": I didn't see that – but now you've brought it up, one might indeed interpret it that way. But it needs some fantasy to get that idea – or sitting in a boat sailing under a related flag, like in your case ;) – Izzy Nov 19 '15 at 18:31
  • 1
    Why the downvotes? It seems like a perfectly cromulent answer to me (+1) – Mawg Nov 23 '15 at 9:05
  • @Gilles: wait, so while you state the intent is not bad and in your own answer state one cannot tell with certainty, the malware detector is meant to detect it as malicious? Something here doesn't compute :) – 0xC0000022L Nov 30 '15 at 7:18
  • @0xC0000022L I'm sorry, I don't understand your comment. If this wasn't a rhetorical question, please clarify. – Gilles Nov 30 '15 at 7:25
  • @Gilles: Oh it was purely rhetorical, don't worry. I'm just wondering how a program is supposed to make the decision "malicious" when a software is inherently dual-use. – 0xC0000022L Nov 30 '15 at 8:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .