1

For context: in Sweden, the "end" of COVID has caused a huge buildup in passport applications, as everybody wants to resume travelling. However, due to the poor performance and general UX of the national Police website, it is very difficult to find a time for application. Thus, a trend seems to have arisen of "script-kiddies" developing python scripts that interact with the website automatically using techniques from front-end testing.

This seems to me as a huge security risk, as non-technical users may download the script, run it blindly, and in this sense actively run potential malware in their system, while even feeding it personal information.

However, as a rookie in the field of information security, it's hard for me to pinpoint the arguments against running this script if it on the surface (i.e. browsing through the code) looks trustworthy. How can I effectively motivate to a layman that they should avoid this kind of scripts, by outlining to them the potential risks?

11
  • Such a script is even being "marketed" in one of the main technology outlets of Sweden. nyteknik.se/digitalisering/… Commented Mar 24, 2022 at 10:57
  • 2
    The issue for a script is the same for any code or executable. It could be a virus, steal or encrypt all your information, steal passwords, etc. What's your question? Whether it is generally dangerous for the general public to run random scripts, or for you, since you are determining that it appears trustworthy?
    – schroeder
    Commented Mar 24, 2022 at 12:17
  • The question is how to motivate in a public forum that this kind of scripts are not safe using simple terms. Commented Mar 24, 2022 at 12:21
  • When I questioned the use of such a script, the counter-argument I got is that "you can just look through the code and see that it does nothing malicious". But I'm still worried that even though you understand the code, there are risks that cannot be accounted for. Commented Mar 24, 2022 at 12:23
  • 2
    I'm not sure that anything unique needs to be said. Security Awareness training and warnings about not running random stuff has been around for over 20 years. You have 20 years' worth of material out there to use.
    – schroeder
    Commented Mar 24, 2022 at 12:38

2 Answers 2

1

However, as a rookie in the field of information security, it's hard for me to pinpoint the arguments against running this script if it on the surface (i.e. browsing through the code) looks trustworthy.

If you're a "rookie" in this area, and you're talking to people with even less experience than you, then the obvious question is: what makes you confident that you could spot malicious code? Unless the scripts that you're looking at are trivial, then it's not necessarily easy to determine whether or not they're malicious.

I've not seen a Python specific version of it, but there have previously been competitions to create intentionally backdoored code in other languages (such as the Underhand C Contest, which can be a good illustration of how hard these kind of things can be to spot. There have been some more formal papers on this subject as well, which give good examples in other languages. And this is before you even get into the realms of dependencies (and the fact that anything outside of the Python standard library should be considered questionable).

Properly evaluating code for security issues is a complex and specialist field, and laypeople are not in a position to do it in the vast majority of cases. If you can show them that they're not as good at is as they think they are (for example, by showing them an example of intentionally backdoored code that they think looks safe) that may make them re-consider their abilities.

How can I effectively motivate to a layman that they should avoid this kind of scripts, by outlining to them the potential risks?

When people are deciding what to do, they evaluate the perceived risk against the reward. They believe that the risk is low (based on an overly optimistic assumption about their ability to identify malicious code). So if you can't change that, the other approach would be to reduce the "reward" from doing this, by providing them with a better alternative.

Laypeople are in a much better position to make this kind of decision based on non-technical factors (such as whether the script is produced by a company, the reputation of the users involved, etc) than by trying to read the actual code.

Rather than "don't use scripts for this", you're much more likely to have success with "use this script that's been properly reviewed and posted by someone trustworthy".

0

The title of your post literally says "a stranger", so I will assume you mean exactly that. You were given a script and you have no idea what is motivating this person.

The obvious argument is that the code may be malicious. Identify theft is a thing and these scripts literally deal with a persons identity. It's a gold mine for criminals.

People may think the code is publicly available so therefore it has been checked by people. That's an obvious fallacy. You don't need peoples permission to post scripts online. And even if malicious scripts are exposed, they can still persist online.

Given that there has been malicious code has been reviewed and accepted by professionals who have a deep understanding of code-bases they are responsible for, it's also dubious that all malicious elements of scripts would be spotted by reviewers.

It's possible that handing over sensitive information to 3rd parties may be in breach of the terms and conditions of using the site. I don't know if you want your passport cancelled because this script screws up some important data that invalidates your passport.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .