If You Comment On Blogs Extensively, You Should Consider Using Google 2-Step Verification

One recently identified cause of deleted Blogger blogs appears to involve brute force hacking against our Blogger / Google accounts.

We've known, for some time, about blog owners receiving alerts about "suspicious" / "unusual" account activity. The alerts frequently involve locked or deleted Blogger / Google accounts - and generally include the owner having to change their password, solve a CAPTCHA, and / or provide their phone number (mobile or home phone) to login.

Later, people started reporting that their blogs were being deleted - possibly as a result of having to change their password, solve a CAPTCHA, and / or provide their phone number.

I've been observing - and blocking - an annoying style of comment based spam, which I have termed "nice blog" spam, for some time.

Nice blog. I will keep visiting this blog very often.

This style of spam, from what I can tell, has been published by the millions, in various blog comments, on both Blogger and non Blogger platforms.

The reason for the spam always intrigued me. Observing that the spam was published in the millions, suggested to me that it had a special purpose, intended by its creators. Looking at a typical spam message, in my email (since I moderate before publishing), I could see no consistent type of content.

• Some messages would contain links, others not.
• Some messages would mention what looked like commercial products, other references were obviously imaginary targets.
• Some messages would appear to be mere babble.

Recently, I discovered one strong possibility for the purpose of the spam - a very ingenious form of email address mining. The spam comment is only needed to allow a hacker to subscribe to a given comment stream, using the "Email follow-up comments to ..." option. It's possible that the subscription is not even affected by moderation - whether the blog owner is moderating, either before or after the comment is published to the blog, the hacker remains subscribed to the comment stream.

All that the hacker / spammer has to do is to publish a spam comment, select the "Email follow-up comments to ..." option, and watch while his Inbox fills up with subsequent comments from other Blogger / Google / OpenID account owners. Any comment containing an email address, and linking to a Blogger blog, would go straight into the hackers database.

Later, the hacker could go to work against the Blogger accounts referenced in the comments. In some cases, this would result in successfully hijacked Blogger blogs, which would become part of a spammers blog farm where advertisements of various nature could be hosted. Valuable blogs, with established reader populations, could also be used to serve malware (and more hacking) to unsuspecting readers.

The demographics of some hijacking attacks provide interesting clues. In one episode, we had a significant number of home / personal / small business blogs that had been hijacked by one specific individual. Many of the victim blogs

• Contained details relevant to the owners, which provided clues to passwords used by the owners.
• Were owned by people who used commenting extensively, for networking both with friends, and with business targets.
• Were read (and commented upon) by similar people, who similarly provided password clues in their own blogs.

Having been part of the restore process, both with people who had their blogs hijacked, and who had their accounts locked and blogs deleted, I observed that the former (hijacked blogs) seem to have decreased in volume as the latter (accounts and blogs locked / deleted) increased in volume. I don't think that the relationship is coincidental - or spurious.

My opinion is that the locking of Blogger / Google accounts - and subsequent deletion of blogs - directly results from detected attacks against the accounts in question ("suspicious" / "unusual" activity). Noting that the attacks seem to be more common to people who comment on blogs as a form of networking, it appears that commenting can lead to accounts and blogs being locked or deleted, as Google protects us against hacking.

Considering this possible cause and effect relationship, Google 2-step verification is a good idea. Click here, for Google instructions on setting up 2-step verification.

Use of 2-step verification helps safeguard our accounts against brute force hacking. This will help anybody who is anxious about accounts and blogs being deleted or locked, as a result of "suspicious" / "unusual" activity. If you own a blog which is subject to this threat, you should consider using 2-step verification.

The sanity (heart attack, ulcer) that is saved may be your own.

>> Top

Read More

"Nice Blog" Spam Is Recently Becoming More Obscure, In Content And Style

In 2009, we discovered an odd style of spam comments which, from all appearances, served no purpose.

I recently came across your blog, and have been reading along. I thought I would leave my first comment. I don't know what to say except that I have enjoyed reading. Nice blog. I will keep visiting this blog very often.

When discovered, Google Search suggested that over 22,000,000 copies of these comments had been successfully installed, on various blogs and websites.

A couple years ago, I suggested a possible reason for the spam - and later showed how Google+, and various Blogger security measures, were making the spam less useful.

Last month, we began to see suggestions, from some blog owners, that this "nice blog" spam was morphing, into more obscurely phrased and structured styles.

A lot of spam comments are being published on my blog. This problem started a few weeks ago - though previously, Google almost always put them in my Spam Folder.

Upon examination of examples of the spam comments, we see the same spam style as observed in 2009 - yet more imaginatively phrased.

Today, I spent a couple hours, and scanned through the comments queues on this blog. Both the Awaiting, and Spam, folders yielded some interesting specimens.

This topic is very educational and it took my interest. Hope it will always be alive! And provide productive information to many others.

and

Nice post. I learn something new and challenging on websites I stumble upon every day. It's always interesting to read articles from other writers and practice a little something from other sites.

These were the comment bodies of just two examples which I located - and these resemble others identified by various other blog owners.

The bodies of the comments examined, this week, will sometimes contain embedded links, while other examples will have external links - and some comments seem to contain no links at all, to any payload. The only thing consistent about the comments is their vague and apparently pointless nature.

The comments are both large in volume, and varied in content and structure. Both patience and persistence, from every blog owner moderating the spam, is required. The spam filters must be trained, to recognise the new content and structures - and this will require more effort, from everybody seeing the spam.

Since various reports about the spam have been seen recently, in Blogger Help Forum: Something Is Broken, we added a rollup discussion there, where we are requesting minimally organised details about the comments being observed.

• Are you moderating before, or after publishing?
• What's the average amount of time the spam comment sits in "Awaiting" or "Published", before being moved to "Spam"?
• How often do you check "Awaiting" and "Published", looking for more spam comments?
• How often do you check "Spam", looking for non spam comments?
• How many spam comments do you typically dispatch, in each batch?
• Looking objectively in your personal "Awaiting", "Published", and "Spam" folders, what number of this style of comments do you typically see in each, without your intervention?
• When did you first observe this threat, in your comment folders?

As always, please help here by answering as carefully and completely as possible - and please only post relevant replies. Do not turn the rollup discussion into a chat room.

>> Top

Read More

Use Of Google+ For Networking, And Keeping Your Blogger Account And Blogs Safe

One constant activity in Blogger Help Forum: Something Is Broken involves blog owners whose blogs were deleted - either righteously or spuriously - as part of the ongoing battle against spam, in Blogger blogs. Generally, the problem comes directly from the blog content.

Sometimes, the problem is more subtle.

When I tried to login to Blogger, I got a screen that said my account needed to be verified, due to "unusual activity on my account". Having verified my account, I see that my blogs have been deleted.

This is part of one of the more intriguing episodes, in the never ending fight against hacking and spam, in Blogger.

Some Blogger blog owners participate in comment based discussions, and provide their email addresses there. Some state their email addresses openly, in the body of the comments, for the world to see when viewing the comments. Others post comments using their Blogger accounts, knowing that the blog owners can see their email address in the comment moderation / notification email messages - and can contact them using email.

Spammers use comment based networking, to their advantage. They subscribe to any comment thread, using the "Notify me" option - then wait while blog readers comment using their Blogger accounts. As the email comes in, from blog readers commenting, they scrape the email addresses from the email content. Since most people commenting either openly state their blog URLs in the comment bodies - or link to a list of their blogs - the spammer now has two essential ingredients, to be used for hacking someone's Blogger account, and gaining control of the blogs owned by the account.

Google now provides Google+, where we can network with a designated audience, and avoid spam in our email. Using Google+, our email addresses are not revealed, and spammers have less incentive to use Google+ for email address harvesting. This protects our Blogger accounts and blogs against hacking, and relieves us from email based spam.

For people who update their Blogger accounts to use Google+ based profiles, but continue to network using Blogger comments, Blogger now protects us by using anonymous email addresses in all comment generated email. This leaves people who continue to comment, using Blogger accounts with native Blogger profiles, vulnerable to ongoing email address harvesting, and account hacking.

Blogger account hacking, using email addresses harvested from Blogger blog comments, will typically involve brute force password guessing. Blogger, detecting brute force attempts against a vulnerable Blogger account, will lock the account and the blogs. Once we verify ownership of our Blogger account - and hopefully change the Blogger account password to something less vulnerable to guessing - the blogs owned by a possibly compromised account remain locked, until they can be examined for signs of tampering, by Google security / spam analysts.

We also must consider the possibility that not all brute force password guessing attacks are being detected by Google - and some Blogger accounts are being deviously, and temporarily, hijacked.

People who setup Blogger accounts based on bogus email addresses - or who have accounts based on old email addresses which they can't use - continue to present a challenge here. These people will never receive essential email advising them of a problem in either verifying their Blogger account - or their blogs. This will continue to make our initial spam lock advice relevant.

Can you login to Blogger? Do you have a dashboard link "Deleted blogs"? That's where you start.

You wait 24 to 48 hours after submitting a Restore request - then you post back here, and we take the next step.

>> Top

Read More

Blogger Comments Being Posted Using Anonymity

Some Blogger blog owners use their Blogger blogs as the center of their peer to peer networking life.

Many blog readers are expected to post comments - and to leave their email addresses, as part of their message or profile, to allow direct contact. Long ago, I used the email address of my commenters, as part of an easy "Contact Me" form, on this blog.

Recently, we've been noting that Blogger comments don't always include a useful email addresses - many comments simply describe the commenter as

noreply-comment@blogger.com

Not all blog owners - and readers - appreciate this change.

When I leave a comment using my google profile, it isn't linking my profile with my email address. How do I get my email address properly displayed?

and

Why do so many comments, published to my blog, show the email address of "noreply-comment@blogger.com"? How do I email my readers?

For some time, we've known of the dangers of revealing your email address to the world, in general.

Blogger blog owners have been a known special risk, with their email addresses. Google developed Google+, with the Google+ profile, to allow everybody to network with their friends - both old and new - without the risk of revealing one's email address.

Google+ replaces email completely. You can share comments, messages, photos, and videos with anybody, in a self contained universe - and you can define your own, personal universes. This leaves the need to reveal your email address completely unnecessary (though you can use email, if you wish, without knowing anyone's address - or revealing yours).

After Google+ became popular, Blogger added the option to link our Blogger blogs with our Google+ profiles. Blogger profiles, based on Google+, are cleaner, and use the Google+ displays to update.

To encourage people to use Google+ for peer to peer networking activity, and to make our Blogger accounts and blogs safer, Blogger has eliminated our email addresses from all outside correspondence - including when we publish comments on Blogger (and non Blogger) blogs, using a Google+ based Blogger profile.

If we publish a comment on somebody's blog, and the blog owner has enabled comment moderation or notification, our comment shows up in the email inbox of the blog owner - but with our email address displayed as "noreply-comment@blogger.com".

With email addresses not displayed, this helps protect our Blogger account names from becoming unnecessarily revealed. Blog owner - reader comment communication is still possible - but again, without the email address of the reader being known.

By eliminating our email addresses from our comments, Google is helping to protect our accounts and blogs, while letting us continue to comment on each others blogs - and to eliminate one type of unnecessary spam from our blogs.

Google+, which replaces email for networking, uses a "Friend of a Friend" relationship to let you expand your universe infinitely, with each comment, message, photo, and video that you share. It lets you control the expansion of your universe - if you wish. And, it helps keeps your Blogger blog under your control.

Read More