[Solved] Spam - straight to delete instead of quarantine?

The place for discussions and decisions about the forum

Re: Increase of spam - straight to delete instead of quarant

Postby /a3 » Sun Apr 22, 2012 10:23 am

Just to expand on the topic of post moderation:
On phpBB.com they use post moderation, so that users in the Newly Registered Users group have to be approved. This can be done in the User-based forum permissions (I believe) in the ACP.

Only problem is that users seem to get confused over whether they have posted or not. But in the current circumstances it's not a bad idea, could be disabled later anyway. Maybe enable temporarily, and then make a decision later? Anyway, just my suggestion anyway.

EDIT: should also mention that I've seen references to "post bombers before". [1] [2] [3]
Last edited by /a3 on Sun Apr 22, 2012 11:27 am, edited 1 time in total.
LibreOffice 4.2
/a3
 
Posts: 92
Joined: Sat Jul 02, 2011 4:05 am

Re: Increase of spam - straight to delete instead of quarant

Postby squenson » Sun Apr 22, 2012 11:22 am

What about temporarily allowing some volunteers to quarantine the spam messages?
LibreOffice 4.2.3.3. on Ubuntu 14.04
User avatar
squenson
Volunteer
 
Posts: 1885
Joined: Wed Jan 30, 2008 9:21 pm
Location: Lausanne, Switzerland

Re: Increase of spam - straight to delete instead of quarant

Postby /a3 » Sun Apr 22, 2012 11:31 am

squenson wrote:What about temporarily allowing some volunteers to quarantine the spam messages?

Or at least ban users? That's probably most important since at least they can't keep posting. Currently the forums are just filled with junk and it makes it harder to use them. If spammers are banned earlier then at least that won't be as much of a problem. All bans are logged AFAIK.


PS. not sure if this helps the moderators at all but I have a list of the suckers to ban. 47 of them. :shock:

memberlist.php?mode=viewprofile&u=53633
memberlist.php?mode=viewprofile&u=53673
memberlist.php?mode=viewprofile&u=53676
memberlist.php?mode=viewprofile&u=53677
memberlist.php?mode=viewprofile&u=53678
memberlist.php?mode=viewprofile&u=53688
memberlist.php?mode=viewprofile&u=53711
memberlist.php?mode=viewprofile&u=53713
memberlist.php?mode=viewprofile&u=53715
memberlist.php?mode=viewprofile&u=53716
memberlist.php?mode=viewprofile&u=53717
memberlist.php?mode=viewprofile&u=53719
memberlist.php?mode=viewprofile&u=53720
memberlist.php?mode=viewprofile&u=53721
memberlist.php?mode=viewprofile&u=53722
memberlist.php?mode=viewprofile&u=53723
memberlist.php?mode=viewprofile&u=53724
memberlist.php?mode=viewprofile&u=53726
memberlist.php?mode=viewprofile&u=53727
memberlist.php?mode=viewprofile&u=53728
memberlist.php?mode=viewprofile&u=53729
memberlist.php?mode=viewprofile&u=53730
memberlist.php?mode=viewprofile&u=53731
memberlist.php?mode=viewprofile&u=53732
memberlist.php?mode=viewprofile&u=53733
memberlist.php?mode=viewprofile&u=53734
memberlist.php?mode=viewprofile&u=53735
memberlist.php?mode=viewprofile&u=53736
memberlist.php?mode=viewprofile&u=53737
memberlist.php?mode=viewprofile&u=53738
memberlist.php?mode=viewprofile&u=53739
memberlist.php?mode=viewprofile&u=53740
memberlist.php?mode=viewprofile&u=53741
memberlist.php?mode=viewprofile&u=53742
memberlist.php?mode=viewprofile&u=53743
memberlist.php?mode=viewprofile&u=53744
memberlist.php?mode=viewprofile&u=53745
memberlist.php?mode=viewprofile&u=53746
memberlist.php?mode=viewprofile&u=53747
memberlist.php?mode=viewprofile&u=53748
memberlist.php?mode=viewprofile&u=53749
memberlist.php?mode=viewprofile&u=53753
memberlist.php?mode=viewprofile&u=53755
memberlist.php?mode=viewprofile&u=53757
memberlist.php?mode=viewprofile&u=53758
memberlist.php?mode=viewprofile&u=53759
memberlist.php?mode=viewprofile&u=53763

EDIT 1: a few more:

memberlist.php?mode=viewprofile&u=53766
memberlist.php?mode=viewprofile&u=53768
memberlist.php?mode=viewprofile&u=53769
memberlist.php?mode=viewprofile&u=53770
memberlist.php?mode=viewprofile&u=53771
memberlist.php?mode=viewprofile&u=53772



EDIT 2: another one: memberlist.php?mode=viewprofile&u=53838
Last edited by /a3 on Mon Apr 23, 2012 3:06 am, edited 1 time in total.
LibreOffice 4.2
/a3
 
Posts: 92
Joined: Sat Jul 02, 2011 4:05 am

Re: Increase of spam - straight to delete instead of quarant

Postby kingfisher » Sun Apr 22, 2012 1:45 pm

One of /a3's links led me to a how to thread. Note this paragraph:

Newly Registered Users Group - phpBB 3.0.6 also sees the introduction of the "Newly Registered Users" group. This feature, which may be enabled via the User Registration Settings page of the ACP, allows the administrator to define a minimum post count; if a user is below this limit they will be a member of the Newly Registered Users group. Permissions may be set on this group much like any other group -- an example use is to place the Newly Registered Users group on the moderation queue for all forums. The user is automatically removed from the group when they reach the defined post amount. Be aware that this feature is not retroactive -- users who registered prior to a board's upgrade to phpBB 3.0.5 will not be placed in the Newly Registered Users group, regardless of their post count.


Some of the recent spammers may reach a low minimum fairly quickly because of the rapidity of posting. Genuine users can, presumably, be transferred from the NRU group to ordinary members once their bona fides has been established.

Just btw, I am having trouble at this moment loading forum pages.

P.S. If the infra team or anyone else needs to see the extent and effect of spamming, load the various boards in an RSS reader.
Apache OpenOffice 4.1.6 on PCLinuxOS
User avatar
kingfisher
Volunteer
 
Posts: 2120
Joined: Tue Nov 20, 2007 10:53 am

Re: Increase of spam - straight to delete instead of quarant

Postby acknak » Sun Apr 22, 2012 2:54 pm

Banning is not effective. These guys seem to have an unlimited supply of everything they need to register new accounts: IPs & email addresses.

I have been trying to watch the IPs, and where they repeat (different IDs using the same IP), I ban the IP as well. It's not helping (much).

We have to have a way to stop spammers (people--humans) from registering.
AOO4/LO5 • Linux • Fedora 23
User avatar
acknak
Moderator
 
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Postby r4zoli » Sun Apr 22, 2012 4:06 pm

When we started Hu forum we get a massive spam load from one inner region of China, where not so much Hungarians living.
I used the IP banning using asteriskes in form " 123.456.***.*** " (these numbers only for example, not connected to any real spammers in Hu forum).
If the spammers came from one country, then ban them using this method, for a short time, until no other methods we found.
May be it is hurt not so much users.
AOO 4.0 and LibO 4 on Win 8
Hungarian forum co-admin
User avatar
r4zoli
Volunteer
 
Posts: 2882
Joined: Mon Nov 19, 2007 8:23 pm
Location: Budapest, Hungary

Re: Increase of spam - straight to delete instead of quarant

Postby thomasjk » Sun Apr 22, 2012 4:30 pm

Can we temporarily stop the registration process?
Tom K.
Windows 10 Home version 1803 17134.165
LibreOffice 5.4.7.2
thomasjk
Volunteer
 
Posts: 4412
Joined: Tue Dec 25, 2007 4:52 pm
Location: North Carolina

Re: Increase of spam - straight to delete instead of quarant

Postby JohnSUN-Pensioner » Sun Apr 22, 2012 7:12 pm

Today's avalanche of spam is strongly shaken my Christian principles. I guess I'm a bad Christian. But I do not want to substitute the other cheek to these people. I (we) do not have a real opportunity to take revenge on those barbarians. However, I think the problem is not people going to various tricks and treachery in order to paralyze the work of our forum. The problem is people and sites that pay for these acts of sabotage. The addresses of these sites are known. Who knows how easily and quickly organize effective DDoS-attack? Or there are legal methods to influence the owners of these resources?
I may not have a lot to give but what I got I'll give to you...
Apache OpenOffice 4.1.4, LibreOffice 5.4.2.2 (x64) on Windows 7
If you think that I did not answer your question, make allowances for my imperfect English
User avatar
JohnSUN-Pensioner
Volunteer
 
Posts: 761
Joined: Fri Jan 14, 2011 1:21 pm
Location: Kyiv, Ukraine

Re: Increase of spam - straight to delete instead of quarant

Postby thomasjk » Sun Apr 22, 2012 7:16 pm

As I suggested earlier the mods need to turn off the registration until this can be controlled. We might impact a few new users but right now these forums are not useable anyway.
Tom K.
Windows 10 Home version 1803 17134.165
LibreOffice 5.4.7.2
thomasjk
Volunteer
 
Posts: 4412
Joined: Tue Dec 25, 2007 4:52 pm
Location: North Carolina

Re: Increase of spam - straight to delete instead of quarant

Postby acknak » Sun Apr 22, 2012 9:36 pm

I have disabled registrations temporarily while cleaning up the spam.

I'll try to get the "new user" feature set up, but I'm not that comfortable with making configuration changes and I don't want to make changes that just make things worse (as in wide-open, completely closed or bricked).
AOO4/LO5 • Linux • Fedora 23
User avatar
acknak
Moderator
 
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Postby Hagar Delest » Sun Apr 22, 2012 9:41 pm

I'm reluctant to the moderation of new users, if no moderator online, indeed, they will be confused about the message being posted or not.
I've not seen any option in the new users group that would prevent them from posting an url. But I may have missed it. Or we disable the whole BBCode feature for them. Perhaps something to test at first.

Well, let's do some cleaning now.
I agree we should think about promoting some new moderators.

NB: thanks for the profiles, it will spare some time!
AOO 4.1.6 on Xubuntu 19.04 and 4.1.5 on Windows 7 (with winPenPack port).
User avatar
Hagar Delest
Moderator
 
Posts: 28558
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: Increase of spam - straight to delete instead of quarant

Postby acknak » Sun Apr 22, 2012 10:19 pm

Ok, I think that's all the spam gone.

Registration is still disabled--what should we do now?
AOO4/LO5 • Linux • Fedora 23
User avatar
acknak
Moderator
 
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Postby acknak » Sun Apr 22, 2012 10:22 pm

JohnSUN-Pensioner wrote:... I do not want to substitute the other cheek to these people. ...

It help me a lot to remember that the people doing the spamming are not the ones at fault here; as you said, it's the people who are paying them to post.

The odd thing is that I believe that the search engines are already ignoring such links, so it does nothing but annoy and interfere with legitimate forums.
AOO4/LO5 • Linux • Fedora 23
User avatar
acknak
Moderator
 
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Postby Hagar Delest » Sun Apr 22, 2012 10:48 pm

I've taken some immediate action (sorry, unilateral but something had to be done to allow new users quickly):
- I've reactivated the registration (by mail for the moment, not by mod)
- I've activated the Newly registered and I'm restricting their permissions, preventing any BBCode
- I've set the limit to 10 posts to get to the Registered status (not sure if it's automatic or not yet)

Perhaps we should see how it works as a test. I think that the spammers do use BBCode for their links. If disabling it is enough, perhaps these basic counter measures will have some effect.

Next step would be the moderation of posts from the Newly registered users.
AOO 4.1.6 on Xubuntu 19.04 and 4.1.5 on Windows 7 (with winPenPack port).
User avatar
Hagar Delest
Moderator
 
Posts: 28558
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: Increase of spam - straight to delete instead of quarant

Postby acknak » Sun Apr 22, 2012 11:06 pm

Hagar Delest wrote:I've taken some immediate action (sorry, unilateral but something had to be done to allow new users quickly):
...
Next step would be the moderation of posts from the Newly registered users.

Sounds good.

My understanding is that the "new users" group means that the first posts go to moderation. Once a moderator approves, then the post goes to become public and only then counts toward the minimum count. That means you can't cheat the limit by posting ten quick posts after registering.

If that's right, then there's no need for more than one moderator-approved post. I'm fairly sure that none of the spammers could (or would bother to) construct a viable post for this board. The only simple hack (I see) for that process would be to copy/paste a previous legitimate question. One way to check would be a quick google search for some chunk of the post, to see that it isn't a direct copy from somewhere else. I guess the process could be hacked by a very short query that would be difficult to verify as unique, but there are enough other clues (user ids/emails/IPs) that I think we could be quite accurate with only one post.
AOO4/LO5 • Linux • Fedora 23
User avatar
acknak
Moderator
 
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Postby Villeroy » Sun Apr 22, 2012 11:14 pm

The only simple hack (I see) for that process would be to copy/paste a previous legitimate question. One way to check would be a quick google search for some chunk of the post, to see that it isn't a direct copy from somewhere else.

I have seen this recently on oooforum.org.
Please, edit this topic's initial post and add "[Solved]" to the subject line if your problem has been solved.
Ubuntu 18.04, no OpenOffice, LibreOffice 6.x
User avatar
Villeroy
Volunteer
 
Posts: 27206
Joined: Mon Oct 08, 2007 1:35 am
Location: Germany

Re: Increase of spam - straight to delete instead of quarant

Postby Hagar Delest » Sun Apr 22, 2012 11:17 pm

I don't think the newly registered posts go to the moderation queue automatically. There is an option in that group permission (in the forum's permissions) and it's off by default.
So if the spammer does want hyperlinks, it may abandon the process seeing that it's not parsed. But if he doesn't care, then we have to moderate those new posts.
AOO 4.1.6 on Xubuntu 19.04 and 4.1.5 on Windows 7 (with winPenPack port).
User avatar
Hagar Delest
Moderator
 
Posts: 28558
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: Increase of spam - straight to delete instead of quarant

Postby acknak » Sun Apr 22, 2012 11:27 pm

Hagar Delest wrote:I don't think the newly registered posts go to the moderation queue automatically. There is an option in that group permission (in the forum's permissions) and it's off by default.
So if the spammer does want hyperlinks, it may abandon the process seeing that it's not parsed. But if he doesn't care, then we have to moderate those new posts.


Here's what I was looking at:
http://www.phpbb.com/community/viewtopi ... #p11298505

If the "New member post limit" is >0,
and "Newly Registered Users group to default" is set to "yes",
and the "Newly Registered Users group" is set to require moderation for all forums (I'm not sure where this gets set),
then it should work to require at least one "valid" post before anything goes public.

I guess the spammers could then flood the moderation queue; I don't know if they get paid for such posts.
AOO4/LO5 • Linux • Fedora 23
User avatar
acknak
Moderator
 
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Postby /a3 » Sun Apr 22, 2012 11:45 pm

acknak wrote:I guess the spammers could then flood the moderation queue; I don't know if they get paid for such posts.

Not sure of that actually. Normally spammers post for "SEO purposes" (posting links makes them look more popular to search engines) but yesterday's spam was by far the largest I have ever seen.

I can confirm that enabling post approval for Newly Registered Users will only affect users with less than the set amount of posts. Post moderation for everybody would be far too large a task.

The reason why I think it should perhaps be a temporary measure, at least until the spam bombs stop, is because these forums seem to get a lot of new users. Also, it seems to confuse people sometimes, since they don't know when their post will appear.
LibreOffice 4.2
/a3
 
Posts: 92
Joined: Sat Jul 02, 2011 4:05 am

Re: Increase of spam - straight to delete instead of quarant

Postby FJCC » Sun Apr 22, 2012 11:56 pm

First, thanks to the moderators for all the work they did fighting spam.
I think that the changes put in place are appropriate and also that they are the sort of changes to the forum operation that should be mentioned on the dev mailing list. The huge number of spam messages, when visible, certainly affected the reputation of the forum (and AFS) and the creation of a New Users group is a significant change. Should I try to write something up or would one of the moderators be a more appropriate author?
Windows 10 and Linux Mint, since 2017
If your question is answered, please go to your first post, select the Edit button, and add [Solved] to the beginning of the title.
FJCC
Moderator
 
Posts: 7300
Joined: Sat Nov 08, 2008 8:08 pm
Location: Colorado, USA

Re: Increase of spam - straight to delete instead of quarant

Postby acknak » Mon Apr 23, 2012 12:04 am

The problem is that this kind of spamming is not even effective SEO--although I don't know that for sure. This approach (posting spam links in forums) has been poisoning search results for a long time, and I have seen reports that the search engines have implemented filters to ignore it. Maybe, in time, the people paying for this junk will realize that they're getting nothing of benefit and stop paying for it.

PS: I've seen one new spam come in. Maybe it was a previous registration.

PPS: Nope. Registered: 22 Apr 2012 16:28 memberlist.php?mode=viewprofile&u=53830

Appears in the "Newly registered users" group but still posted a spam.

I can't explain it.
AOO4/LO5 • Linux • Fedora 23
User avatar
acknak
Moderator
 
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Postby Hagar Delest » Mon Apr 23, 2012 12:09 am

Time to go to bed for me so no courage to write anything just now. No problem for me if you write something.
For the record, the appointment of a new admin to replace Terry is under progress on the ooo-private mailing list. I think it will take some time before the new admin can take actions. Especially the installation of phpBB mods against spam.

NB: SEO is not that frequent now. Most of the spam is about streaming (sport, series, ...). Perhaps they should open again MegaUpload for the sake of forums!!!

I've seen that new spam. Has registered after the new measures (but no moderation for that group yet). What I feared is indeed that there is no way to prevent the parsing of HTML. If we can avoid the others who uses the url tags by BBCode, that would help however.
AOO 4.1.6 on Xubuntu 19.04 and 4.1.5 on Windows 7 (with winPenPack port).
User avatar
Hagar Delest
Moderator
 
Posts: 28558
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: Increase of spam - straight to delete instead of quarant

Postby /a3 » Mon Apr 23, 2012 12:18 am

acknak wrote:PPS: Nope. Registered: 22 Apr 2012 16:28 memberlist.php?mode=viewprofile&u=53830

Appears in the "Newly registered users" group but still posted a spam.

I can't explain it.

The newly registered users group won't do anything until the permissions are set. Anyway, some of it is explained on this: Knowledge Base - How to use the post count to limit forum access.

So if the moderator approval is to be set: go to Forum Permissions for Newly Registered Users and then hit the Advanced tab. Set "Can post without approval" to NEVER (not NO, since the YES of Registered Users overrides the NO Newly Registered Users). Once users leave this group they will be able to post without approval.
LibreOffice 4.2
/a3
 
Posts: 92
Joined: Sat Jul 02, 2011 4:05 am

Re: Increase of spam - straight to delete instead of quarant

Postby Hagar Delest » Mon Apr 23, 2012 12:30 am

I've not activated the moderation of new posts yet. It's the last thing I want to do for the moment. I hope that spammers won't post more than 10 posts when they see that the url tags are not parsed.
So it doesn't prevent spam, it's just a limit (hopefully).
I agree that if they post more than 10 posts or if they post a simple link (like the user linked above), then it is parsed automatically and the counter measure is ineffective.
If it doesn't work, then I fear that the moderation of the first post will be the only solution.
AOO 4.1.6 on Xubuntu 19.04 and 4.1.5 on Windows 7 (with winPenPack port).
User avatar
Hagar Delest
Moderator
 
Posts: 28558
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: Increase of spam - straight to delete instead of quarant

Postby acknak » Mon Apr 23, 2012 12:34 am

My guess is that spammers are paid by the post; I doubt that anything else matters. If that's the case, then it won't matter what we do to prevent the post going public, they are going to continue making posts as long as it's allowed.
AOO4/LO5 • Linux • Fedora 23
User avatar
acknak
Moderator
 
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Postby thomasjk » Mon Apr 23, 2012 1:11 am

Thank you, Hagar and Acknak for all your efforts to clean out the spammers. Unfortunately, I believe that moderation of the the first post and any stronger measures available should be implemented as quickly as possible. I know some legitimate new users will be impacted but the forum was unusable with the recent spam floods.
Tom K.
Windows 10 Home version 1803 17134.165
LibreOffice 5.4.7.2
thomasjk
Volunteer
 
Posts: 4412
Joined: Tue Dec 25, 2007 4:52 pm
Location: North Carolina

Re: Increase of spam - straight to delete instead of quarant

Postby kingfisher » Mon Apr 23, 2012 2:09 am

The moderation has to apply to more than the first post and longer than the first day. These people are posting a multitude of posts from the get go.

As far as confusing genuine users is concerned, can one or more of the pages seen in the registration process explain that their posts have to be moderated temporarily because of the need to prevent spam?

EDIT: To give an idea of how this looks to the public, here is a snapshot of what I see near the top of the General board in a reader.

Image

Click on the thumbnail to see the image full size (it was too large a file for this forum).
Apache OpenOffice 4.1.6 on PCLinuxOS
User avatar
kingfisher
Volunteer
 
Posts: 2120
Joined: Tue Nov 20, 2007 10:53 am

Re: Increase of spam - straight to delete instead of quarant

Postby acknak » Mon Apr 23, 2012 3:43 am

kingfisher wrote:The moderation has to apply to more than the first post and longer than the first day. These people are posting a multitude of posts from the get go.

I'm not sure that's how it works.

As I understand it, all posts from a newly-registered user will go into the moderation queue for review by the mods. It doesn't matter how many posts they make, none of them will be public.

Once a moderator has reviewed the posts and decided whether they're spam or not, the posts can be approved or trashed by the moderator. If a mod decides the user is legitimate and the post(s) approved, the posts will go to the public boards. Once a user has enough approved posts, enough to meet the threshold we set, then they automatically get normal user status and no further moderation of their posts is needed.

We've always avoided moderation because of the increased burden for mods, but I can imagine a number of other problems.

However, I don't see any other choice at this point--at least temporarily, as already proposed.
AOO4/LO5 • Linux • Fedora 23
User avatar
acknak
Moderator
 
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Postby /a3 » Mon Apr 23, 2012 3:55 am

Last edited by /a3 on Mon Apr 23, 2012 7:07 am, edited 2 times in total.
LibreOffice 4.2
/a3
 
Posts: 92
Joined: Sat Jul 02, 2011 4:05 am

Re: Increase of spam - straight to delete instead of quarant

Postby kingfisher » Mon Apr 23, 2012 4:10 am

@acknak

Thanks for the information. What about transferring people from NRU to ordinary membership once their bona fides has been established?
Apache OpenOffice 4.1.6 on PCLinuxOS
User avatar
kingfisher
Volunteer
 
Posts: 2120
Joined: Tue Nov 20, 2007 10:53 am

PreviousNext

Return to Forum Governance

Who is online

Users browsing this forum: No registered users and 3 guests