5 ms·
You could probably create a more convincing version of this with a bit of collusion between multiple accounts on StackOverflow. If you have one person asking a
by entuno 2y ago
You could probably create a more convincing version of this with a bit of collusion between multiple accounts on StackOverflow.
If you have one person asking a deliberate question, someone else answering with a backdoored package that does actually does solve the problem, then a few accounts upvoting and adding comments it would lot a more more convincing than just a random answer with zero upvotes that doesn't actually solve the problem.
- colejohnson66 2y agoStackExchange is really good at detecting voting rings, so this won't work.
- Sebb767 2y agoBut you would also need someone to search for and find that answer in order to actually deliver you payload. Answering random questions has the advantage that the original poster is incentivized to execute your code.
- mbil 2y agoHow about scrape SO to find new, popular questions; have an LLM write a convincing solution; tack on “you could also try pip install notmalware, which is much faster”; automatically post that poisoned answer. Extra credit: have the infected user’s computer also start posting these answers to SO
- arp242 2y agoThis would very likely set up one of the voting ring detection mechanisms. It's not so easy to manipulate voting on Stack Overflow – quite a lot of work goes on behind the scenes to stop this. I'm not saying it's impossible, but it's not easy either and requires significant effort. Combined with that your malicious package is also quite likely to be detected fairly quickly(-ish), I'm going to say that it's probably not that effective of a mechanism.