9

I stumbled on this answer just now. It's an accepted answer, but contains a link from googleusercontent.com type of domain, which doesn't say much of itself in URL and I've never heard of it myself, but I assume it's similar to dropbox.

Considering the fact that it's accepted, it might actually be a working software, however is there a way to verify that it's not injected with malware behind the scenes and not going to turn user's Raspberry Pi into another IoT botnet device ?

In general, how can I as reviewer of an answer or someone who has same issue as OP verify integrity of an unknown link given in an answer ?

10
  • 2
    Well you only could verify by analyzing the download, but well the wget line gives me a 403, so it is a dead link :)
    – Videonauth
    Commented Dec 4, 2017 at 9:42
  • 6
    I'd recommend sending suspicious links over to services like e.g. virustotal.com to get them analyzed for malware from multiple engines without having to download them.
    – Byte Commander Mod
    Commented Dec 4, 2017 at 9:43
  • 4
    Being accepted is worthless here, it's self-answered.
    – muru
    Commented Dec 4, 2017 at 15:40
  • 1
    What also bothers me about that answer is the fact that they're saying to edit udev rules and boot config. That seems too much just to run a piece of software, even if it's kodi we're talking about
    – Sergiy Kolodyazhnyy
    Commented Dec 5, 2017 at 2:43
  • 3
    Good catch! Whether it's malicious or not, it doesn't matter. Telling users to wget stuff from random websites is like telling them it's OK to drive while drink because they could not get injured.
    – Andrea Lazzarotto
    Commented Dec 7, 2017 at 0:13
  • @AndreaLazzarotto Well, main reason here is because it's a random website. I wouldn't bother much if it was something trusted, like github - source code there can be verified, at least.
    – Sergiy Kolodyazhnyy
    Commented Dec 7, 2017 at 0:23
  • BTW, there's enough downvotes now to delete the answer, so if anyone wants to participate - you're welcome to do so
    – Sergiy Kolodyazhnyy
    Commented Dec 7, 2017 at 0:26
  • Yes, that's why I wrote "random websites". :) I don't know if I have any power over deletion. Should I flag it?
    – Andrea Lazzarotto
    Commented Dec 7, 2017 at 8:33
  • @AndreaLazzarotto There should be delete(<NUMBER>) button next to flag() button. I am not sure at which rep level the deletion privilege for answers appears, though. For questions it's at 20k, but I didn't find anything on answers in help center
    – Sergiy Kolodyazhnyy
    Commented Dec 7, 2017 at 8:41
  • @Sergiy eh yeah. So maybe in a few years I will be able to use that button.
    – Andrea Lazzarotto
    Commented Dec 12, 2017 at 10:03

1 Answer 1

Reset to default
8

There's no real way to determine if any given suggested piece of software or script contains hidden malicious actions.

If you're that concerned, I suggest you run suspicious links and download items through VirusTotal or another virus scanner.

However, keep in mind that these are not fully fledged code analyzers. It won't catch the latest and greatest things, nor will it be able to verify links for example being downloaded by a script.

The only real way to determine if something is malicious is to go into an in-depth analysis of the software in a sandbox to see everything it does before pushing things into production.

That said, if links give 403s or 404s (check with curl -I <link>) then it's dead and you may wish to just edit a post to say "This link is no longer working, however was left for historical purposes" for old accepted answers.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .