Spam

Yeah… Spam… RSS Search

2015-07-21 Spam AI

Wow, I was involved in a conversation with a bot or a spam agent. I got a suspicious email the other day:

I was on the alexschroeder.ch website over the weekend doing some research on behalf of my son, and I noticed a broken link. Can you forward this email to the person who deals with the website?

I use your site a lot so hope this helps and also if you are open to resource suggestions please let me know as I have found a few that hellped me and I think they would help other people too.

Page with broken resource link: http://alexschroeder.ch/wiki?action=tag;id=Censorship and the site that is not working anymore is http://www.number-10.gov.uk/

I decided to check nevertheless and sure enough, there was a broken link. Still expecting shenanigans, my reply was curt.

Thanks. I’ll change that link to point to http://www.yorkshirepost.co.uk/news/main-topics/local-stories/mps-back-bid-to-outlaw-the-glorification-of-terrorism-1-2604480

And I got a reply back! But… w00t?

Happy to have helped as I know keeping control of all external links can be a tough job.

The resource I would like to show you could be a great addition to a resource suggestion page in your site as it is very different from any other data resource of its kind.

It helped my son with visualising data in a different way and I found it to be a real eye opener.

Have a look and let me know your thoughts, if you add it great and if not thank you for your time and the help your site has given us.

https://www.trucklocator.co.uk/uk-and-global-transport-facts/

https://www.farmmachinerylocator.co.uk/farming-data-in-the-uk/

“truck locator”? “farm machinery locator”? You’ve got to be kidding me!

Update: The mysterious person found this page and sent me another email:

Alex, I am very much a real person with real feelings and was only helping you with a broken link, In which you were able to find and fix and then I suggested some resources my son wanted to share! I don’t understand why you would class that as spam or a bot and create a post on your site that has my personal details on it. I would really appreciate it if you can remove that as I don’t want to crazy emails from people that use your site.

I won’t be helping people on the net again as it’s not worth the hassle and people like you don’t appreciate the help.

OK, that sounds like a human. Could be a canned response, I guess. But I was intrigued. Bot or not? I was so convinced that this had been a bot sending me mail. Suddenly I felt like I had insulted a call center agent just doing their job. How does this work? Is this mysterious person working from home? I decided to write back.

This makes no sense. “truck locator”? “farm machinery locator”? You’ve got to be kidding me! Why did your son think such links would be of interest? Don’t worry about crazy emails. Your last name and your email address have been withheld.

And the mysterious person writes back again!

I have no idea why my 12 year old son even likes reading your site to be honest but he does and he had asked for me to email you and that’s what I have done. I just wanted you to know that I am a real person and not a spam bot. My friend is a moderator on Blaskhat world and he was the person who let me know about your post on your site. The whole internet thing is something I would like to get more into but it’s a scary place when things like this happen.

I can’t think of anything on my site appropriate for 12 year olds, but who knows. Perhaps he’s a D&D aficionado and reads my RPG posts. What about this “moderator on Blaskhat world”? Typing the name into Google, I get the following:

https://farm1.staticflickr.com/313/20113713451_cba77ae809_o.png

“BlackHatWorld is a fully moderated SEO Forum dedicated to dispersing Internet Marketing techniques.” Sounds like Spamdexing to me. So, Spam is correct, AI probably not. Or we’d be a lot close to the Singularity than I thought possible. Having just finished reading a book from Culture series by Ian Banks, I’m not so sure anymore. :)

Sadly, the exchange continued. The mysterious person said I should take all of this down, that I was insulting them, that I should remove the link to the Yorkshire Post, that I should remove the reference to Black Hat World, that they would hand this issue over to somebody else if I didn’t do that. Also: “If not he will contact you personally is that is what you would like?”

Tags: RSS

Comments on 2015-07-21 Spam AI

This mysterious person should be scared of their son, not the Internet. :D

– AlexDaniel 2015-07-29 14:56 UTC

Add Comment

2015-03-10 Fighting Wiki Spam

I recently wrote something about fighting Emacs Wiki spam on Google+.

Wikis

Lauren said “I’m hoping we can stay focused on practical processes and solutions that are workable at very large scales.” This post is about a wiki that is popular but not as popular as Wikipedia.

I’ve been running Emacs Wiki for a while now. It’s definitely not “at very large scales” but it was certainly a step up from all my previous wiki efforts. I got started back on the Portland Pattern Repository and Meatball Wiki and so I kept trying to live up to Soft Security. That’s why Emacs Wiki still doesn’t have logins and passwords for ordinary users. There are passwords for roles that allow you to lock pages and to edit locked pages, for example.

Rollback

The first line of defense I added was rolling back edits. The first wiki I used allowed you to edit an old revision and save it (click history link, click good revision, scroll to bottom, click edit link, scroll to bottom, click save button). I wanted to speed up the clean up. Now you you click history link and click the rollback button.

The remaining features are reserved for administrators.

→ Wiki Spam

Banning URLs by regexp

We are mostly getting link spam. Therefore I soon introduced a list of regular expressions (on a locked page that I could edit together with my co-administrators). In order to speed this up, I added some code to rollbacks. If the rollback removed URLs from the page text, those are listed and you automatically get a form where you can write a regular expression based on the list you’re seeing. Clicking the submit button will add this regular expression to the ban list.

→ Banned Content

Banning IP numbers

This is a very crude measure. Luckily enough, it still works often enough. Perfect for defense in depth. I added more code to rollbacks. After a rollback, administrators are presented with a link to “ban contributors”. If you click on it, you’re presented with the editors of recent page revisions, together with a note indicating whether they have been banned or not. You can check the IP numbers of the contributors not yet banned and click a button to add an appropriate regular expression to the list.

→ Banned Hosts

Banning key words

This is also a very crude measure. It’s our last automatic defense. We’ve added a few regular expressions to this list such as the Russian word for porn because we were getting vandals that posted links to forums and the like, together with some keywords, and those forum posts would then contain the link to the material we wanted to ban. The indirection via forum, URL shortener and the like circumvented our earlier ban mechanisms. This was our solution.

→ Banned Regexps

Mass Rollback

If we’re under a large scale attack, we can always lock the wiki and wait. Once the damage is done, however, we can reset the wiki to a particular edit, generating the appropriate rollbacks for every page (i.e. these rollbacks are all regular edits and can again be undone by other administrators).

There are also other defense mechanisms unrelated to banning.

CAPTCHA

We only ask for a CAPTCHA once. Answering the question sets a cookie that bypasses the CAPTCHA. Clearly, this only works for a low profile site.

→ reCaptcha Extension

Surge Protection

If you load too many pages in a short time window, the wiki will start responding with error messages, assuming that you’re a bot and not a human.

→ Surge Protection

Missing features

There is currently no way to automatically ban the entire IP range given an IP number.

There is currently a semi-automatic expiry process for bans. It would be better if this was automatic. These days I have to run a whois query, type the two IP numbers into my little Python programm, and type the result into my .htaccess file.

There used to be a ban network sharing those regular expression lists but it was brittle and so I abandoned it.

Tags: RSS RSS

Comments on 2015-03-10 Fighting Wiki Spam

Great post.

There is one thing about Soft Security that makes me feel worried. What if some insane person wants to terrorize the wiki? That is, a directional attack, without links, without keywords, from different IPs. And all that stuff is mixed with minor edits, impersonation and malicious rollbacks. The only way to undo this mess it to restore the content from a backup (which is rather easy to do with the git extension I use, but it is still a pain).

The only thing that prevents this is the lack of motivation (which is somewhat associated with the absence of competition), but I’m not sure if that applies to all other wikis out there.

AlexDaniel 2015-03-10 23:55 UTC



Alex Schroeder
Here are my disorganized thoughts on the limits of Soft Security.

I think we can talk about two different kinds of attacks: a long term infiltration under the radar and a massive attack on multiple levels. Both attacks need to be stopped by fish-bowling the wiki: making it read-only.

In order to detect long term infiltration, you need constant peer review. I myself have bookmarks for my wikis, obviously. They all look like this: ...wiki?action=rc;showedit=1;days=3;rollback=1;lang=;css= or similar. I want to see rollbacks and minor edits! This is important.

Clearly, Soft Security does not work as well if the community is small, visits rarely, or if there are long periods of inactivity.

In order to defend against sudden onslaughts, the ability to lock the wiki needs to be available to a lot of people that are constantly watching. You also need the ability to mass revert the vandalism. If your site does not provide this, restoring from backup will be necessary.

  1. Do you know how to lock the wiki? It must also be easy to unlock—easy enough for your friends to do it, hard enough to prevent the vandals from doing it.
  2. Oddmuse has the ability to mass revert vandalism, but only up to the “keep days” window (14 days by default). This time window is important: Do you check at least once in this window? Including holidays and business trips?
  3. Do you have backups from various points in time?

In a way, for small communities using Soft Security, defense in depth now means defense in time.

For Campaign Wiki, for example, there is a way for people to lock and unlock a wiki. The setting is easy enough to find (I hope) but hidden well enough to elude casual spammers.

There are limits to Soft Security, however. Looking at the abuse Anita Sarkeesian endures every week makes me think that perhaps Soft Security wouldn’t work for her. Then again, perhaps we would learn that many more people support her, defending her site against the trolls?

– Alex Schroeder 2015-03-11 09:47 UTC

Add Comment

2011-01-24 Spam

Wow, what a spam storm! I rolled back all those changes and locked the wiki for the moment. There’s no fighting a bot manually. :)

I’ll look into what allowed this to happen later today and hopefully enable page editing and commenting again. ;-)

Update: IP number blocked, lock removed. That was weird. :vee:

Tags: RSS RSS RSS

Add Comment

2010-09-20 New Spam

Wow, spammers are learning about role playing games…

Generic Viagra has left a new comment on the post “The Dismal Depths”:

you have a special talent to design map for role games, maybe you can design a map that I need to my quest, I don’t have the talent that you posses, my map is about a adventure in one of the dangerous island of the world, R’lyeh the rest place of the great old one Cthulhu. Buy Viagra Cheap Viagra.

Post a comment.

Unsubscribe to comments on this post.

Posted by Generic Viagra to Sham’s Grog ‘n Blog at September 20, 2010 1:25 PM

I still hate spammers, of course. But I have to confess, an adventure “on the most dangerous island of the world, R’lyeh, the resting place of the great old one, Cthulhu.” Just, wow! Or woe, I guess.

Tags: RSS RSS

Comments on 2010-09-20 New Spam

Somehow I’d expect the spammers to know all about Cthulhu. And Nyarlathotep, of course!

RadomirDopieralski 2010-09-20 20:20 UTC


That is kind of awesome. But also terrifying, in a “from a time beyond space” kind of way.

– Adrian 2010-09-20 21:27 UTC

Add Comment

2009-07-29 Best Essays Spam

I’ve started to note a particularly nasty kind of spam for the Best Essays website. They don’t only add links to the wiki pages. At first they posted entire new pages that are on the topic of writing essays to CommunityWiki. But lately they’ve been using my username (!) to make edits. I assume they’re trying to sidestep peer review. I’ve just silently rolled back any changes they made, but today I saw another edit using my username, and when I investigated I found how they had experimented with the rollback function themselves and linked to an old revision containing a spam link to Best Term Papers. There must be real humans at work.

How annoying.

Tags:

Add Comment

2009-06-06 Spam Makes Sending Mail Harder

Here I am trying to send mail using some Perl module. But most of them seem to be written for the last millenium. They work best with a local SMTP host. For my own needs, that no longer works. The webhost doesn’t have a sendmail binary available. The SMTP hosts I can reach require SSL and TLS authentication. Now I’m slowly digging into MIME::Entity, Mail::Internet, Mail::Mailer, Net::SMTP, Net::SMTP::SSL, Net::SMTP::TLS… :( :sucks:

After experimenting with the four or five mail accounts I have access to, I was finally able to get the following to work:

my $from = 'kensanata@gmail.com';
my $to = $from;
my $host = 'mail.epfarms.org';
my $user = 'alex';
my $password = '*secret*';

use MIME::Entity;
my $mail = new MIME::Entity->build(To => $to,
				   From => $from,
				   Subject => 'test',
				   Path => '/Users/alex/test.html',
				   Type => 'text/html');

use Net::SMTP::TLS;
my $smtp = Net::SMTP::TLS->new($host,
			       User => $user,
			       Password => $password,
			       Debug => 1);
$smtp->mail($from); # sender
$smtp->to($to);     # recipient
$smtp->data;
$smtp->datasend($mail->stringify);
$smtp->dataend;
$smtp->quit;

Tags: RSS RSS

Comments on 2009-06-06 Spam Makes Sending Mail Harder

Well, theoretically at least it should now be possible to subscribe to comment pages!

AlexSchroeder 2009-06-06 16:43 UTC


Guess not, because the webhost doesn’t have Net::SMTP::TLS installed. :sucks:

AlexSchroeder 2009-06-06 16:58 UTC


I think it works after all! Luckily I wrote my script such that it gets the page content and subscriber list via ordinary HTTP requests, so the cron job that sends out emails can run anywhere on the net. This one is running on a server hosted by Eggplant Farms.

AlexSchroeder 2009-06-07 13:25 UTC

Add Comment

2008-01-12 Yahoo Spam

Often I log on to my various instant messaging networks (→ Contact) and some dummy Yahoo account will send me spam. Something like the following:

11:58 twilaja
w<#988621>ant t<#D20057>o kno<#313821>w m<#010152>e bet<#216765>ter? check webs<#652542>ite o<#c76105>ut <#562571>http:<#d01016>//w<#947328>ww.JAC<#c41284>KIE<#e00611>-WE<#F00257>BC<#124045>AM<#A67748>.COM

Tags:

Add Comment

2007-10-29 Microsoft Spam Filter

Back at work… got over 10’000 spam emails in my Junk folder, and about 300 mails in my Inbox with a 50:50 mix of spam to ham. Not too shabbby and lots better than in previous years! :)

Tags: RSS RSS

Add Comment

2007-10-09 Goole Mail Spam

I switched to GMail a long time ago because I felt that GMail had superior anti spam measures in place. These days I’m not so sure. I have less mail in my Spam box (4065 right now), and yet I have to manually mark about a dozen mails as spam every day. Are other users poisoning the spam filters? Maybe inactive accounts gathering spam negatively affect the filters…

Tags: RSS

Comments on 2007-10-09 Goole Mail Spam

I find that too. I think the evil spam zombies are getting clever, that’s all.

Give it time and gmail with fix that. Until next time, of course. :(

greywulf 2007-10-10 12:08 UTC


I’ using gmx and are very happy with it. SPAMs only at the beginning and in the last couple of months N O N E !!! Maybe I’m just not using the mail enough… :-)

– Belfin 2007-10-11 01:34 UTC


Yeah, my email address is all over Usenet – and has been since 2003.

AlexSchroeder 2007-10-11 09:15 UTC

Add Comment

2007-04-24 Wiki Spam By Idiots

Well, I’m being hit by spam of the form

gdufty upibhmf fknwvl aixqf gumi pqrjxfb ntscbzoyp -- [http://www.icxjrg.yamfw.com krwfuq qeysb] 2007-04-24 15:27 UTC

or

egzp supbvqnf qbgtfnyv bmilfzo ewfhl xospqz rtmxfbajo http://www.mvuh.meptrc.com -- [http://www.google.com mvny vqahjngdu] 2007-04-24 15:28 UTC

How stupid is that?

Unfortunately, that means you’ll have to answer a question when you try to post to this site. :(

Tags: RSS RSS

Add Comment

More...

Other stuff

Comments


Please make sure you contribute only your own work, or work licensed under the GNU Free Documentation License. See Info for text formatting rules. You can edit the comment page if you need to fix typos. You can subscribe to new comments by email without leaving a comment.

To save this page you must answer this question:

Please say HELLO.