Hacker News Reader

Comment by entuno | Hacker News Reader

You could probably create a more convincing version of this with a bit of collusion between multiple accounts on StackOverflow.

If you have one person asking a deliberate question, someone else answering with a backdoored package that does actually does solve the problem, then a few accounts upvoting and adding comments it would lot a more more convincing than just a random answer with zero upvotes that doesn't actually solve the problem.

View on HN

But you would also need someone to search for and find that answer in order to actually deliver you payload. Answering random questions has the advantage that the original poster is incentivized to execute your code.

This would very likely set up one of the voting ring detection mechanisms. It's not so easy to manipulate voting on Stack Overflow – quite a lot of work goes on behind the scenes to stop this. I'm not saying it's impossible, but it's not easy either and requires significant effort. Combined with that your malicious package is also quite likely to be detected fairly quickly(-ish), I'm going to say that it's probably not that effective of a mechanism.

How about scrape SO to find new, popular questions; have an LLM write a convincing solution; tack on “you could also try pip install notmalware, which is much faster”; automatically post that poisoned answer.

Extra credit: have the infected user’s computer also start posting these answers to SO

StackExchange is really good at detecting voting rings, so this won't work.

Reply on news.ycombinator.com