Hi,

I’m not a lawyer either, but I think it’s OK to reveal symptoms that can be obtained from the data websites return for regular legitimate requests. Such information can only help webmasters and site visitors detect and address the problem (either resolve the issue or keep away from the site that can be dangerous for browsing).

On the other hand, hackers and people with malicious intents who know how to exploit security holes behind those symptoms, already have tools and experience to obtain this (and much more) information without malware scanners.

So limiting access to malware scanners to only verified owners is like leaving those webmasters (not all of them have enough knowlage and skills) without help of the community.

Of course this doesn’t apply to vulnerability scanners like ssm (e.g. that instead of symptoms report real exploitable security holes). Such scans should be conducted of behalf of site owners and responsible exucutives, since not only can such scan reveal real exploitable hole to strangers, they can also effectively DOS sites or corrupt data (in case of buggy site software). So it is important to choose proper time for scans and proper version (try the scan on a development site before scanning your production site). So, unauthorized scans are generally not acceptable.

Denis

I suspect that if StopBadware felt there was a problem with the information sharing that has been a part of this community, since the beginning, that guidelines to prohibit it would have been put in place.

This is a community oriented self-help forum where we all learn from the experiences of others. I feel that the type of assistance that is provided here is critical to the smaller site owners being enabled to help themselves. If they need more assistance, it’s great to have professional services available for them. But, many of them do not want professional services, so the open sharing of information is valuable to them.

For those who offer vulnerability scanning that goes above and beyond the type of assistance that folks come here looking for, it is understandable that you should not do such a scan without proof of ownership and permission. However, in the absence of that permission, surely you can offer assistance outside of vulnerability scanning?

If someone wants that “extra” service … fine … great … offer it and do your due diligence as far as protecting yourself and the site owner. But, please allow the OP the luxury of getting public assistance if they are not interested in vulnerability scanning.

As far as ownership goes, I can’t see that proof of ownership can be obtained by simply providing an email address that matches the site’s domain. How do you know that a disgruntled employee is not the one requesting the scan?

I think it is important that everyone fully understand (without having to access your site) what kind of scanning is actually being offered, and that it is above and beyond what is necessary to identify the malware that is causing them problems.

Offline delivery of your vulnerability scanning results is 100% understandable. No one would expect you to expose the sites’ vulnerabilities in public.

However, since the majority of the hacks we know about, in today’s climate, are often related to compromised passwords on a local machine, I can’t see that there is a great need for secrecy about what is going on with those particular sites.

The specific vulnerability (at this point in time) for those sites, is that the local computer is infected, and the hackers have the login credentials. Unless someone else can get that information from the OP (or the hackers) what more harm can be done by simply discussing the details of what is going on with the site, in public?

Yes … all sites probably have all kinds of vulnerabilities that were not the current cause of their problems, and those could be addressed to avoid potential future problems. But … when we are talking about local computers giving up login credentials … sharing the symptoms and cures seems more helpful than harmful.

Considering that most of the hacks are automated, I really doubt that anyone is sitting around reading BadwareBusters so that they can pick up on a vulnerability on a particular site and cause them more grief.

I will be curious to hear Maxim’s take on the issues.

Disclaimer: I’m not a lawyer, either, so I’m commenting only on ethics and the expected behavior on this site.

I believe that anything that could be observed by visiting a publicly-accessible website, viewing the site’s source code, or watching the traffic to/from the client while visiting the site is fair game for public posting and discussion. This covers quite a bit of territory.

Where I believe someone might cross the line into unethical behavior is if they:

1. Perform full penetration or vulnerability scanning against a site without the owner’s permission, especially if such a scan carries risks to the site or if it requires making requests that are substantially different or much higher volume than those generated by ordinary user visits to the site.
2. Publish or make available to someone without authorization of the site owner a vulnerability in that site that is not widely known and that isn’t the cause of a current compromise.

A reasonable comparison would be physical security of a building on a public street. Suppose someone notices in the police blotter section of a newspaper that my house has been broken into three times. He decides to drive by my house, snap a photo of the front, and publish it in a newspaper column, along with an explanation of why he thinks the house might have been a target (e.g., no exterior lights), the apparent result of the last break-in (the cut screen on the front window), and a few things that could be done to make it safer (install a porch light). That seems well within his (and the newspaper’s) rights, even if somewhat alarming to me as the homeowner.

On the other hand, if this guy started casing my house, tapping on the walls with a hammer, etc., and then published a column about the valuables to be found inside my house, the details of my daily routine, and the fact that I have a key hidden under the doormat, that wouldn’t be okay at all.

As for free online scanning services, I’d say the need to verify site ownership depends on the type of scanning and the results that are provided. When verification is called for, I’d expect the vendor to go beyond an honor system (i.e., asking the user to affirm that s/he is the site owner) and actually verify the user’s credentials, as Google’s Webmaster Tools does by requiring the owner to make a change to the site’s contents.

With regard to BadwareBusters.org, I want to reiterate that the purpose of this site is to encourage open discussion about fighting badware. This requires the members of the community to balance the need for discretion, as indicated above and in Denis’s and John’s posts, with the requirement of transparency. One thing we definitely don’t want to see this site turn into is a marketplace with vendors just hawking their wares to everyone who comes in looking for help. This is why we ask vendors to refrain from soliciting business (paid or unpaid) except as a by-product of providing valuable public guidance to the original poster.