Blog Security Review Is Not Instantaneous

Blog owners do not always understand the reasons behind the mysterious blog security check (following "suspicious" / "unusual" activity account lock).

We see periodic complaints about deleted blogs and locked accounts - and the inconvenience involved, in Blogger Help Forum: Get Help with an Issue.

I get the security and all - but I don't get how a blog is just deleted.

This blog owner, like so many, does not understand how Blogger is trying to keep our blogs under our control - even after detection of "suspicious" / "unusual" activity.

Blog security check, if immediate and instantaneous, would not be noticed.

Blog security check is an art - not a science - and it takes time.

If blogs could be checked for hacking interference without delay, most owners would not complain. Unfortunately, examining blogs for hacking interference requires intense study - and most security experts do not work on weekends.

One unfortunate issue, about all of this, is that not all "suspicious" / "unusual" activity is malicious. Some of it is a simple result of people unable to use account / blog recovery - being innocently told to try every account name and password that can be remembered.

Owner delay, in requesting account unlock, contributes to security check delay.

In some cases, the locked account / deleted blogs may not be immediately discovered by the owner - and this may lengthen the security check process.

Not all blog owners publish - or even read - their blogs regularly. Nor do they accept the need to intentionally keep their account and blogs under their control.

Some owners are very casual about blog security - until a blog is successfully stolen.

---

Some #Blogger blog owners are not terribly impressed by the need to keep their blogs under their control, until a blog is stolen. The measures taken by Blogger / Google Security staff are considered mere annoyances.

Read More

Please, Don't Try Guessing Your Account / Password!

We see too many problem reports, in Blogger Help Forum: Get Help with an Issue, about locked accounts and deleted blogs.

My Google account was suspended because of 'suspicious activities'. Last month, I realized that my two connected blogs, to that account, were also put offline!

Somebody else was unable to use the supplied account / blog recovery tools - and tried guessing what could not be remembered.

The first would be a blog owner, whose only mistake was having a Blogger account with a name similar to another account, owned by the second.

The second would be someone who could not remember her (his) account name / password, could not use account or password recovery, and who got well meaning advice.

Just do the best you can - try what may be your account name, and any passwords that you can remember!

One blog owner must suffer, because another cannot remember login details.

And owner #1 is suffering, because of owner #2. Owner #1 is now anxiously waiting for action by the security experts (with the blind queue of unknown length) to examine his blogs - and possibly, waiting while not knowing why.

Owner #1 may be seeing this - and not know why.



Password guessing may be necessary, in extreme cases - but it can cause misery - and owner #2 will never realise the pain caused to owner #1. Even if owner #2 recovers access to her / his blogs, innocent brute force attempts can cause account lock / blog security lock, to owner #1.

Protect yourself against the anguish, using Google 2-Step Verification.

The best way to protect against this sort of abuse is to use one or more Google Two Step Verification options. This will leave owner #2 seeing (for instance).

Insert your USB security key, and tap the lighted button.

And having no security key, owner #2 will simply have to try guessing a different account name. It may be an inconvenience (for owner #1), carrying a never used USB security key - but the one time it's needed (and available), it will make up for the inconvenience.

---

One #Blogger blog owner, unable to remember a necessary account name or password, may try guessing what cannot be remembered. Guessing an account name can leave one trying an account that somebody else owns - and can cause account lock and blog deletion for somebody who they will never know.

Read More

Browser Cache, And Blogs Locked After Hacking

The effects of browser cache, upon our Internet life, are not always understood.

Most of us know, by now, to clear cache and restart the browser, after updating a blog, for consistent testing. Some folks know that blog security changes don't always take complete and immediate effect.

Recently, we're seeing a new effect, reported by owners of Blogger accounts locked, after hacking activity is detected.

I got a message mentioning suspicious account activity, when I logged in to Blogger. I provided my phone number, and I received a code on my phone, that I had to enter before I could then log in. My blog was working fine just after I logged in. A short while later, though, it was gone. Why was my blog deleted, because I unlocked my account?

This blog owner is just slightly confused, about the cause and effect here.

Google robotic processes are constantly monitoring account login activity, and watching for signs of hacking activity, such as brute force password entry.

Hacking Cannot Be Detected, Immediately.

When hacking is detected, the detection may not be immediate - so Google protects us by considering the possibility that the hacking could have been successful, and deletes or locks blogs owned by the account under attack. The blogs in question are taken offline, immediately, when hacking is detected.

When a blog is taken offline, blog content may be found in cache.

If a blog owner has just been working on a blog, as is frequently the case, the blog contents will be cached somewhere between the owner and the Blogger servers. Blogger can take the blogs offline, on their servers - but any cache containing the blogs will remain. If the blog owner is working on a blog while the Blogger account is under attack, what's in cache will remain, visible to the owner, until cache expires.

If a Blogger account is attacked, and the attack is detected, shortly after the owner has viewed a blog, what's in cache will be used, until it expires. The owner won't see the effects of the blog being deleted until the cache expires, and the browser tries to retrieve a fresh copy from the Blogger servers.

As cache expires later, the blog owner sees the blog go offline.

The blog owner sees the blog go offline shortly after he verifies account ownership, and thinks that the verification process caused the blog to go offline. In reality, the blog was taken offline before the owner even knew of "suspicious" account activity.

The blog owner has to wait, while the blogs are examined for hacker changes.

Now, the blog owner can do nothing, except wait until the account and the blogs are examined for signs of tampering. In some cases, no notification of progress will be received - and the owner will see the blog(s) returned to service, sometime later.

How much later the blogs return to service will vary widely, depending upon several details - and this variation, added to the uncertainty caused by cache latency, leads to mystery. And less attentive owners may take the delay as revenge, by Blogger, for their lack of attention to their blog(s).

---

Browser Cache, And Confusion About Blogs Locked After Suspected Account Hacking
Browser Cache, And Blogs Locked After Hacking

Read More

Deleted / Locked Blogs Have Several Causes

Many blog owners are occasionally confused, by the effects of various Blogger / Google security processes.

We see the agony, daily, in Blogger Help Forum: Something Is Broken, from those who only want to login to Blogger and work on their blogs.

The side effects of the security processes are similar - and depending upon various owner specific details, can be easily confused for each other. The possibility of confusion requires careful initial analysis, when we are faced with an angry blog owner.

My blog was deleted, by Blogger. How could they do this? I do not publish spam!

This is a typical problem report, which can reflect any one of the processes, each requiring different action in the forums.

There are multiple Blogger / Google security / TOS enforcement processes, which encourage observance of various Blogger / Google requirements.

Each process may cause a Blogger account and / or blog to be unavailable for public access, at any time.

• DMCA Violation looks for copyright and similar violations.
• Hacking detection looks for automated attacks against our Blogger accounts and blogs.
• Malware detection looks for malicious code installed in our Blogger blogs.
• Porn classification looks for blogs with adult content, and with unacceptable advertisements (aka monetised porn).
• Spam blog classification looks for Blogger blogs which contain spammy material or use spammy techniques.
• Repeated offenses can have gradually increasing severity of action taken.
• Owner deletion or rename may be confused with spam classification.
• Team blog ownership will affect blogs owned in common, by that team.

Each different process has a different effect on the Blogger account and blogs owned - and requires different attention by the blog owners, by the forum helpers, and by Blogger Support and Google Security. Not all blogs will be listed in the "Deleted blogs" dashboard inventory.

DMCA Violation

Accounts and blogs can be deleted, for progressive DMCA violations. The DMCA violation process originated with complaints made by the major entertainment industry content enforcement organisations, citing theft of "intellectual property" which they control.

In the USA, this would involve the "MPAA" (Motion Picture Association of America), and the "RIAA" (Recording Industry Association of America). I have been told that similar content enforcement organisations exist in other countries.

In more recent events, private citizens have been known to use the DMCA Violation complaint process, for miscellaneous copyright violation reporting. DMCA Violations have a formal complaint and appeal process.

Hacking detection

Blogger / Google network monitors are constantly analysing account login activity, and looking for signs of brute force password hacking.

When hacking activity is discovered, the Blogger account - and all blogs owned by the account - are deleted and locked, pending account verification by the owner, and blog integrity checking by Google Security.

The blog owner, after changing the account password, solving a CAPTCHA, and / or verifying account ownership by providing various personal details, is left waiting for the blogs owned by the account to be examined for signs of abuse by the hacker.

Until the blog(s) are returned to online status, they appear in neither the "Deleted blogs" or "Locked blogs" dashboard lists. The owner, even when logged in to the right Blogger account, simply sees the dashboard advice

You are not an author on any blogs.

In this case, neither the blog owner nor the forum helpers can do anything useful, except wait, anxiously - possibly, with no notice provided. The blog being offline may not be immediately observed by the owner - and this may cause more confusion.

Malware detection

Blogger robotic processes are constantly checking the various blogs, looking for malicious blog accessories, components, and scripts. When a blog is subject to "Malware" classification, the blog will appear in one of two dashboard lists, in sequence.

1. Initially, the blog will appear in the "Deleted blogs" list. While the blog is in "Deleted" status, the blog owner will be able to do nothing, except request "Restore".
2. Once the owner has requested "Restore", the blog is undeleted, and placed into the "Locked blogs" list. While the blog is in "Locked" status, all authors can access the blog to remove malware - but the blog remains offline, to all viewers. Once all malware has been removed from the blog, the owner can "Request Unlock Review".

If the blog remains in "Locked" status for over 48 hours, the blog owner may report this in the forums, and may request a manual review. The forum helpers, and online viewers, will generally see the blog displayed as "TOS violation".

This blog is in violation of Blogger Terms of Service and is open to authors only

Adult Content / Porn Detection

Blogger will soon classify and delete blogs with "adult content", which host advertisements to commercial porn sites. Like spam classification, this will probably involve both false negatives and false positives.

Spam detection

Blogger robotic processes are constantly checking the various blogs, looking for signs of spam activity and content. When a blog is subject to "Spam" classification, the blog will be displayed in the "Deleted blogs" dashboard list.

The owner can do nothing, except request "Restore". If the blog remains in "Deleted" status for over 48 hours, the blog owner may report this in the forums, and may request a manual review. The forum helpers, and online viewers, will generally see the blog displayed as "Removed".

Blog has been removed Sorry, the blog at xxxxxxx.blogspot.com has been removed. This address is not available for new blogs.

Repeated Offenses

We have recently noted that repeated TOS Violations, involving DMCA, Malware, Porn, and Spam, are being dealt with in increasing severity.

Owner deletion or rename

Mistakes made by the owner can be confused with Spam detection. When a blog is deleted by the owner, it will appear in the dashboard "Deleted blogs" list for up to 90 days.

During the 90 days, the owner (or a team member, when applicable) may "Restore" the blog. After the 90 days expire, the blog will be removed from "Deleted blogs", and will be unrecoverable. Besides being unrecoverable, no other details have been determined.

If the blog is renamed (published under a different BlogSpot URL), the external symptom may be similar to deletion by the owner.

Blog has been removed Sorry, the blog at myblog.blogspot.com has been removed. This address is not available for new blogs.

In this case, the blog will be listed in the dashboard "My blogs" list, under the right Title. The owner needs to setup a stub blog, pointing the readers to the new URL.

Team Ownership

Any blogs owned by a deleted / locked Blogger account may simply disappear from the dashboards of other team members. If the Blogger account is not restored / unlocked, the blogs owned by that account - including any team owned blogs - may remain deleted - and inaccessible to everybody.

The Confusion Accumulates

Because of anonymous blog ownership, loss of account control, team blog ownership, and use of inactive or non existent email addresses, any account / blog which is deleted or locked for hacking (actively / as a victim), malware, and / or spam may not be easily discovered or recovered by the owner.

And, not all scenarios can be easily diagnosed. Besides the deleted blogs, there are blogs that remain online - but have still disappeared from the dashboard of the owner.

All of these issues cause further confusion and frustration.

These scenarios may appear, to the untrained eye, to be signs of fraudulent, malicious, and / or petty actions by Blogger - and are loudly claimed so by spammers with their own agenda. None of these accusations are true - the above processes simply represent Blogger and Google attempting, in the best possible way, to protect everybody against the various hacking, malware, porn, and spam attacks which are constantly in progress.

Read More