These people really did go to far too much work...

[jducoeur]

Digging through the Rolls logs, I find that the spammers went to some real effort. They bothered to put real data into many of the fields -- they hooked the name fields up to name generators, location fields up to location generators, the whole nine yards. They even generated fake email addresses for the email fields. Clearly, they thought that there were automated mechanisms here doing data validation on the fields. And all completely to no avail: I still think the entire exercise was pointless, and the spam entries just look different from real ones, so it doesn't actually slow me down in deleting them.

(Although I'm not quite sure what they were thinking when they kept putting "square coffee table" into the Interests field...)

Comments

[rickthefightguy.livejournal.com]

What, square coffee tables aren't interesting to you? You round-ist, you.

[lakshmi-amman.livejournal.com]

Wow. It sounds like either someone with an ax to grind with the SCA who takes some stupid glee in being destructive.

Or just nutty people with way too much free time.

[jducoeur]

No, no -- it's clearly commercial wikispam. Most of each entry is just noise: the meat is the URL field. What they're trying to do is drive up the Google rank of these URLs by spamming links into every open wiki they can find -- and unfortunately, the Rolls look enough like a wiki to fall prey to it.

My guess is that the Rolls got discovered by a small-scale spammer months ago: I'm finding isolated spam entries, clearly created by hand, going quite a ways back. Somewhere along the line, the big spammers found out about it, and hooked their automated machinery in; there's a distinct point where the volume of the spam goes way, way up, beginning to swamp the legitimate traffic.

So odds are that these guys don't even know what the SCA *is*. Certainly anyone with even a shred of clue could have done a better job masquerading as real entries. This all looks like it's hooked up to fairly dumb automatons.

(Oh, and speaking of Google rank: we should put in some more work on the Baronial homepage there. For reasons I'm not sure of, we're still not showing up on the first page of hits, and that's weird. I suspect something is still subtly wrong; I'm concerned that Google may still think that it's a no-index zone for some reason, or something like that...)

[cvirtue.livejournal.com]

I don't know from real databases, nor do I understand the full extent of the Rolls. Is asking people to put their own info in again (starting from scratch) not a reasonable option? It sounds like a massive amount of work you'll need to do, to restore it.

[jducoeur]

Eh; it's the difference between me spending a few man-days on it, or ten thousand people spending a few minutes each. I'd rather not have to inconvenience that many people, and the overall cost is lower for me to do it in bulk.

Besides, most of the work isn't cleaning up the damage. The hard part's going to be updating the systems so that this can't happen again, which will require some significant overhauls to how the Rolls work...

[fairdice.livejournal.com]

Could this also be explained by them doing too little effort? If they were already set up to do bulk wikispamming, they doubtless have existing random name/location/email generatots just sitting around. And a script that retrieves pages, asks to edit them, and fills in those randomly-generated values into fields with likely names (or maybe a human looks at the edit form once and tells the script which generator to query for each field's value).

By this logic, of course, you should protect the Rolls by using whatever captcha your research shows is the least popular: your goal is to pick one such that it hasn't been worthwhile for the scripties to write a decoder.

[jducoeur]

Possible, and you're right that a more obscure captcha is theoretically better. Actually, though, at this point I think the principal line of defence probably has to be a degree of moderation. If the data goes through an approval round, that pretty much stops the spam cold -- workflow defenses are usually more effective than technological ones.

It's possible that they could still inconvenience us by foolishly trying to hook their machinery up, even if it's going to fail, thus overwhelming the moderation process. But it's almost trivial for me to tweak the locations of the scripts if they do so, significantly less effort than it takes them to hook it up. So I believe I can make it entirely not worth their while to bother...

[alexx-kay.livejournal.com]

a more obscure captcha is theoretically better.

Only along some axes. The well-known ones now at least *attempt* to incorporate accessible alternatives for the visually-impaired. Mind you, they don't actually *work*, but it's at least a start...

[jducoeur]

Hmm. Good point -- the better-known ones are likely to be more mature in ways like that. Of course, I've begun to rethink the captcha idea in general, on accessibility grounds. I'm currently hoping that moderation plus some other tweaks will suffice...

[patsmor.livejournal.com]

The thing I don't get is why -- what kind of a threat could this pose? or even just a notch on the CD tray....

[cvirtue.livejournal.com]

People that get their jollies doing this are "differently-brained." The "why" is likely to not make sense to any other type of person.

[jducoeur]

Oh, it's not about threats. You're too focused on security in this case. The point isn't threatening anybody *directly*, although there may be indirect threats.

Wikispam works by stuffing public sites (mostly but not entirely wikis) full of links to honeypot sites; the theory is that, by putting these links into deeply-interlinked sites of this sort, it will drive up the Google scores of the target sites. These honeypot sites are sometimes semi-legitimate businesses, but are often virus and malware traps for the unwary -- naive users who are seeking plausible keywords Google over to these sites, fall into one of the usual IE traps, and get their machines taken over.

I doubt it's as effective as the spammers would like to believe, but they clearly think it's a worthwhile tack. And that's why the spam entries here are mostly filled with plausible keywords, mostly relating to sex or particular kinds of high-ticket commercial goods. (With a particular focus on saws and other such power tools -- not sure *what* that indicates.)

Sadly, I've learned altogether more than I'd like about this subject over the past couple of years. Every wiki that isn't completely locked down suffers from this crap. That's why all of my wiki sites *are* completely password-protected...

[crschmidt.livejournal.com]

Not all of them -- the Open Guide to Boston has only suffered from one spammer, and he didn't even bother to create text, he just put a 0-height div with a couple thousand links in it (along with a comment: "Excuse me for this, my children need food to eat, please forgive me.")

I think this is a factor of the fact that the Open Guide is still relatively small (though growing an average of 200 visits/week), but other smaller/less popular Open Guides have gotten much more spam, so some of it may be the fact that I have been very good at making sure any spam that does get through goes away almost instantly.

Just some thoughts.

[jducoeur]

It's a combination of factors, to be sure. The size is certainly an advantage -- it can simply take a long time for the spammers to notice you. Indeed, one thing I've found in my logs is that the spam ramped up quite gradually but steadily, from just a trickle at the beginning to a flood recently; my guess is that there's an underground publicity network where they talk about sites that are working well for them. (Based on the fact that, by the end, there are clearly at least five or six different attackers.)

But yes: if you kill the spam very persistently, I'm sure it makes you a less appealing target. They prefer easier targets that don't fight back...

[umbran.livejournal.com]

(Although I'm not quite sure what they were thinking when they kept putting "square coffee table" into the Interests field...)

Well, you've seen our square coffee table, right? Is it not... interesting? :)

[gyzki.livejournal.com]

We have a hexagonal coffee table. Should I feel slighted, or smug?