[Solved] Spam - straight to delete instead of quarantine?

The place for discussions and decisions about the forum
/a3
Posts: 92
Joined: Sat Jul 02, 2011 4:05 am

Re: Increase of spam - straight to delete instead of quarant

Post by /a3 »

Just to expand on the topic of post moderation:
On phpBB.com they use post moderation, so that users in the Newly Registered Users group have to be approved. This can be done in the User-based forum permissions (I believe) in the ACP.

Only problem is that users seem to get confused over whether they have posted or not. But in the current circumstances it's not a bad idea, could be disabled later anyway. Maybe enable temporarily, and then make a decision later? Anyway, just my suggestion anyway.

EDIT: should also mention that I've seen references to "post bombers before". [1] [2] [3]
Last edited by /a3 on Sun Apr 22, 2012 11:27 am, edited 1 time in total.
LibreOffice 4.2
User avatar
squenson
Volunteer
Posts: 1885
Joined: Wed Jan 30, 2008 9:21 pm
Location: Lausanne, Switzerland

Re: Increase of spam - straight to delete instead of quarant

Post by squenson »

What about temporarily allowing some volunteers to quarantine the spam messages?
LibreOffice 4.2.3.3. on Ubuntu 14.04
/a3
Posts: 92
Joined: Sat Jul 02, 2011 4:05 am

Re: Increase of spam - straight to delete instead of quarant

Post by /a3 »

squenson wrote:What about temporarily allowing some volunteers to quarantine the spam messages?
Or at least ban users? That's probably most important since at least they can't keep posting. Currently the forums are just filled with junk and it makes it harder to use them. If spammers are banned earlier then at least that won't be as much of a problem. All bans are logged AFAIK.


PS. not sure if this helps the moderators at all but I have a list of the suckers to ban. 47 of them. :shock:

http://user.services.openoffice.org/en/ ... le&u=53633
http://user.services.openoffice.org/en/ ... le&u=53673
http://user.services.openoffice.org/en/ ... le&u=53676
http://user.services.openoffice.org/en/ ... le&u=53677
http://user.services.openoffice.org/en/ ... le&u=53678
http://user.services.openoffice.org/en/ ... le&u=53688
http://user.services.openoffice.org/en/ ... le&u=53711
http://user.services.openoffice.org/en/ ... le&u=53713
http://user.services.openoffice.org/en/ ... le&u=53715
http://user.services.openoffice.org/en/ ... le&u=53716
http://user.services.openoffice.org/en/ ... le&u=53717
http://user.services.openoffice.org/en/ ... le&u=53719
http://user.services.openoffice.org/en/ ... le&u=53720
http://user.services.openoffice.org/en/ ... le&u=53721
http://user.services.openoffice.org/en/ ... le&u=53722
http://user.services.openoffice.org/en/ ... le&u=53723
http://user.services.openoffice.org/en/ ... le&u=53724
http://user.services.openoffice.org/en/ ... le&u=53726
http://user.services.openoffice.org/en/ ... le&u=53727
http://user.services.openoffice.org/en/ ... le&u=53728
http://user.services.openoffice.org/en/ ... le&u=53729
http://user.services.openoffice.org/en/ ... le&u=53730
http://user.services.openoffice.org/en/ ... le&u=53731
http://user.services.openoffice.org/en/ ... le&u=53732
http://user.services.openoffice.org/en/ ... le&u=53733
http://user.services.openoffice.org/en/ ... le&u=53734
http://user.services.openoffice.org/en/ ... le&u=53735
http://user.services.openoffice.org/en/ ... le&u=53736
http://user.services.openoffice.org/en/ ... le&u=53737
http://user.services.openoffice.org/en/ ... le&u=53738
http://user.services.openoffice.org/en/ ... le&u=53739
http://user.services.openoffice.org/en/ ... le&u=53740
http://user.services.openoffice.org/en/ ... le&u=53741
http://user.services.openoffice.org/en/ ... le&u=53742
http://user.services.openoffice.org/en/ ... le&u=53743
http://user.services.openoffice.org/en/ ... le&u=53744
http://user.services.openoffice.org/en/ ... le&u=53745
http://user.services.openoffice.org/en/ ... le&u=53746
http://user.services.openoffice.org/en/ ... le&u=53747
http://user.services.openoffice.org/en/ ... le&u=53748
http://user.services.openoffice.org/en/ ... le&u=53749
http://user.services.openoffice.org/en/ ... le&u=53753
http://user.services.openoffice.org/en/ ... le&u=53755
http://user.services.openoffice.org/en/ ... le&u=53757
http://user.services.openoffice.org/en/ ... le&u=53758
http://user.services.openoffice.org/en/ ... le&u=53759
http://user.services.openoffice.org/en/ ... le&u=53763

EDIT 1: a few more:

http://user.services.openoffice.org/en/ ... le&u=53766
http://user.services.openoffice.org/en/ ... le&u=53768
http://user.services.openoffice.org/en/ ... le&u=53769
http://user.services.openoffice.org/en/ ... le&u=53770
http://user.services.openoffice.org/en/ ... le&u=53771
http://user.services.openoffice.org/en/ ... le&u=53772



EDIT 2: another one: http://user.services.openoffice.org/en/ ... le&u=53838
Last edited by /a3 on Mon Apr 23, 2012 3:06 am, edited 1 time in total.
LibreOffice 4.2
User avatar
kingfisher
Volunteer
Posts: 2123
Joined: Tue Nov 20, 2007 10:53 am

Re: Increase of spam - straight to delete instead of quarant

Post by kingfisher »

One of /a3's links led me to a how to thread. Note this paragraph:
Newly Registered Users Group - phpBB 3.0.6 also sees the introduction of the "Newly Registered Users" group. This feature, which may be enabled via the User Registration Settings page of the ACP, allows the administrator to define a minimum post count; if a user is below this limit they will be a member of the Newly Registered Users group. Permissions may be set on this group much like any other group -- an example use is to place the Newly Registered Users group on the moderation queue for all forums. The user is automatically removed from the group when they reach the defined post amount. Be aware that this feature is not retroactive -- users who registered prior to a board's upgrade to phpBB 3.0.5 will not be placed in the Newly Registered Users group, regardless of their post count.
Some of the recent spammers may reach a low minimum fairly quickly because of the rapidity of posting. Genuine users can, presumably, be transferred from the NRU group to ordinary members once their bona fides has been established.

Just btw, I am having trouble at this moment loading forum pages.

P.S. If the infra team or anyone else needs to see the extent and effect of spamming, load the various boards in an RSS reader.
Apache OpenOffice 4.1.9 on Linux
User avatar
acknak
Moderator
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Post by acknak »

Banning is not effective. These guys seem to have an unlimited supply of everything they need to register new accounts: IPs & email addresses.

I have been trying to watch the IPs, and where they repeat (different IDs using the same IP), I ban the IP as well. It's not helping (much).

We have to have a way to stop spammers (people--humans) from registering.
AOO4/LO5 • Linux • Fedora 23
User avatar
r4zoli
Volunteer
Posts: 2882
Joined: Mon Nov 19, 2007 8:23 pm
Location: Budapest, Hungary

Re: Increase of spam - straight to delete instead of quarant

Post by r4zoli »

When we started Hu forum we get a massive spam load from one inner region of China, where not so much Hungarians living.
I used the IP banning using asteriskes in form " 123.456.***.*** " (these numbers only for example, not connected to any real spammers in Hu forum).
If the spammers came from one country, then ban them using this method, for a short time, until no other methods we found.
May be it is hurt not so much users.
AOO 4.0 and LibO 4 on Win 8
Hungarian forum co-admin
thomasjk
Volunteer
Posts: 4451
Joined: Tue Dec 25, 2007 4:52 pm
Location: North Carolina

Re: Increase of spam - straight to delete instead of quarant

Post by thomasjk »

Can we temporarily stop the registration process?
Tom K.
Windows 10 Home version 1803 17134.165
LibreOffice 5.4.7.2
User avatar
JohnSUN-Pensioner
Volunteer
Posts: 876
Joined: Fri Jan 14, 2011 1:21 pm
Location: Kyiv, Ukraine

Re: Increase of spam - straight to delete instead of quarant

Post by JohnSUN-Pensioner »

Today's avalanche of spam is strongly shaken my Christian principles. I guess I'm a bad Christian. But I do not want to substitute the other cheek to these people. I (we) do not have a real opportunity to take revenge on those barbarians. However, I think the problem is not people going to various tricks and treachery in order to paralyze the work of our forum. The problem is people and sites that pay for these acts of sabotage. The addresses of these sites are known. Who knows how easily and quickly organize effective DDoS-attack? Or there are legal methods to influence the owners of these resources?
I may not have a lot to give but what I got I'll give to you...
Apache OpenOffice 4.1.5, LibreOffice 6.4.4.2 (x64) on Windows 7
If you think that I did not answer your question, make allowances for my imperfect English
thomasjk
Volunteer
Posts: 4451
Joined: Tue Dec 25, 2007 4:52 pm
Location: North Carolina

Re: Increase of spam - straight to delete instead of quarant

Post by thomasjk »

As I suggested earlier the mods need to turn off the registration until this can be controlled. We might impact a few new users but right now these forums are not useable anyway.
Tom K.
Windows 10 Home version 1803 17134.165
LibreOffice 5.4.7.2
User avatar
acknak
Moderator
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Post by acknak »

I have disabled registrations temporarily while cleaning up the spam.

I'll try to get the "new user" feature set up, but I'm not that comfortable with making configuration changes and I don't want to make changes that just make things worse (as in wide-open, completely closed or bricked).
AOO4/LO5 • Linux • Fedora 23
User avatar
Hagar Delest
Moderator
Posts: 32627
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: Increase of spam - straight to delete instead of quarant

Post by Hagar Delest »

I'm reluctant to the moderation of new users, if no moderator online, indeed, they will be confused about the message being posted or not.
I've not seen any option in the new users group that would prevent them from posting an url. But I may have missed it. Or we disable the whole BBCode feature for them. Perhaps something to test at first.

Well, let's do some cleaning now.
I agree we should think about promoting some new moderators.

NB: thanks for the profiles, it will spare some time!
LibreOffice 7.6.2.1 on Xubuntu 23.10 and 7.6.4.1 portable on Windows 10
User avatar
acknak
Moderator
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Post by acknak »

Ok, I think that's all the spam gone.

Registration is still disabled--what should we do now?
AOO4/LO5 • Linux • Fedora 23
User avatar
acknak
Moderator
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Post by acknak »

JohnSUN-Pensioner wrote:... I do not want to substitute the other cheek to these people. ...
It help me a lot to remember that the people doing the spamming are not the ones at fault here; as you said, it's the people who are paying them to post.

The odd thing is that I believe that the search engines are already ignoring such links, so it does nothing but annoy and interfere with legitimate forums.
AOO4/LO5 • Linux • Fedora 23
User avatar
Hagar Delest
Moderator
Posts: 32627
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: Increase of spam - straight to delete instead of quarant

Post by Hagar Delest »

I've taken some immediate action (sorry, unilateral but something had to be done to allow new users quickly):
- I've reactivated the registration (by mail for the moment, not by mod)
- I've activated the Newly registered and I'm restricting their permissions, preventing any BBCode
- I've set the limit to 10 posts to get to the Registered status (not sure if it's automatic or not yet)

Perhaps we should see how it works as a test. I think that the spammers do use BBCode for their links. If disabling it is enough, perhaps these basic counter measures will have some effect.

Next step would be the moderation of posts from the Newly registered users.
LibreOffice 7.6.2.1 on Xubuntu 23.10 and 7.6.4.1 portable on Windows 10
User avatar
acknak
Moderator
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Post by acknak »

Hagar Delest wrote:I've taken some immediate action (sorry, unilateral but something had to be done to allow new users quickly):
...
Next step would be the moderation of posts from the Newly registered users.
Sounds good.

My understanding is that the "new users" group means that the first posts go to moderation. Once a moderator approves, then the post goes to become public and only then counts toward the minimum count. That means you can't cheat the limit by posting ten quick posts after registering.

If that's right, then there's no need for more than one moderator-approved post. I'm fairly sure that none of the spammers could (or would bother to) construct a viable post for this board. The only simple hack (I see) for that process would be to copy/paste a previous legitimate question. One way to check would be a quick google search for some chunk of the post, to see that it isn't a direct copy from somewhere else. I guess the process could be hacked by a very short query that would be difficult to verify as unique, but there are enough other clues (user ids/emails/IPs) that I think we could be quite accurate with only one post.
AOO4/LO5 • Linux • Fedora 23
User avatar
Villeroy
Volunteer
Posts: 31269
Joined: Mon Oct 08, 2007 1:35 am
Location: Germany

Re: Increase of spam - straight to delete instead of quarant

Post by Villeroy »

The only simple hack (I see) for that process would be to copy/paste a previous legitimate question. One way to check would be a quick google search for some chunk of the post, to see that it isn't a direct copy from somewhere else.
I have seen this recently on oooforum.org.
Please, edit this topic's initial post and add "[Solved]" to the subject line if your problem has been solved.
Ubuntu 18.04 with LibreOffice 6.0, latest OpenOffice and LibreOffice
User avatar
Hagar Delest
Moderator
Posts: 32627
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: Increase of spam - straight to delete instead of quarant

Post by Hagar Delest »

I don't think the newly registered posts go to the moderation queue automatically. There is an option in that group permission (in the forum's permissions) and it's off by default.
So if the spammer does want hyperlinks, it may abandon the process seeing that it's not parsed. But if he doesn't care, then we have to moderate those new posts.
LibreOffice 7.6.2.1 on Xubuntu 23.10 and 7.6.4.1 portable on Windows 10
User avatar
acknak
Moderator
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Post by acknak »

Hagar Delest wrote:I don't think the newly registered posts go to the moderation queue automatically. There is an option in that group permission (in the forum's permissions) and it's off by default.
So if the spammer does want hyperlinks, it may abandon the process seeing that it's not parsed. But if he doesn't care, then we have to moderate those new posts.
Here's what I was looking at:
http://www.phpbb.com/community/viewtopi ... #p11298505

If the "New member post limit" is >0,
and "Newly Registered Users group to default" is set to "yes",
and the "Newly Registered Users group" is set to require moderation for all forums (I'm not sure where this gets set),
then it should work to require at least one "valid" post before anything goes public.

I guess the spammers could then flood the moderation queue; I don't know if they get paid for such posts.
AOO4/LO5 • Linux • Fedora 23
/a3
Posts: 92
Joined: Sat Jul 02, 2011 4:05 am

Re: Increase of spam - straight to delete instead of quarant

Post by /a3 »

acknak wrote:I guess the spammers could then flood the moderation queue; I don't know if they get paid for such posts.
Not sure of that actually. Normally spammers post for "SEO purposes" (posting links makes them look more popular to search engines) but yesterday's spam was by far the largest I have ever seen.

I can confirm that enabling post approval for Newly Registered Users will only affect users with less than the set amount of posts. Post moderation for everybody would be far too large a task.

The reason why I think it should perhaps be a temporary measure, at least until the spam bombs stop, is because these forums seem to get a lot of new users. Also, it seems to confuse people sometimes, since they don't know when their post will appear.
LibreOffice 4.2
FJCC
Moderator
Posts: 9248
Joined: Sat Nov 08, 2008 8:08 pm
Location: Colorado, USA

Re: Increase of spam - straight to delete instead of quarant

Post by FJCC »

First, thanks to the moderators for all the work they did fighting spam.
I think that the changes put in place are appropriate and also that they are the sort of changes to the forum operation that should be mentioned on the dev mailing list. The huge number of spam messages, when visible, certainly affected the reputation of the forum (and AFS) and the creation of a New Users group is a significant change. Should I try to write something up or would one of the moderators be a more appropriate author?
OpenOffice 4.1 on Windows 10 and Linux Mint
If your question is answered, please go to your first post, select the Edit button, and add [Solved] to the beginning of the title.
User avatar
acknak
Moderator
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Post by acknak »

The problem is that this kind of spamming is not even effective SEO--although I don't know that for sure. This approach (posting spam links in forums) has been poisoning search results for a long time, and I have seen reports that the search engines have implemented filters to ignore it. Maybe, in time, the people paying for this junk will realize that they're getting nothing of benefit and stop paying for it.

PS: I've seen one new spam come in. Maybe it was a previous registration.

PPS: Nope. Registered: 22 Apr 2012 16:28 http://user.services.openoffice.org/en/ ... le&u=53830

Appears in the "Newly registered users" group but still posted a spam.

I can't explain it.
AOO4/LO5 • Linux • Fedora 23
User avatar
Hagar Delest
Moderator
Posts: 32627
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: Increase of spam - straight to delete instead of quarant

Post by Hagar Delest »

Time to go to bed for me so no courage to write anything just now. No problem for me if you write something.
For the record, the appointment of a new admin to replace Terry is under progress on the ooo-private mailing list. I think it will take some time before the new admin can take actions. Especially the installation of phpBB mods against spam.

NB: SEO is not that frequent now. Most of the spam is about streaming (sport, series, ...). Perhaps they should open again MegaUpload for the sake of forums!!!

I've seen that new spam. Has registered after the new measures (but no moderation for that group yet). What I feared is indeed that there is no way to prevent the parsing of HTML. If we can avoid the others who uses the url tags by BBCode, that would help however.
LibreOffice 7.6.2.1 on Xubuntu 23.10 and 7.6.4.1 portable on Windows 10
/a3
Posts: 92
Joined: Sat Jul 02, 2011 4:05 am

Re: Increase of spam - straight to delete instead of quarant

Post by /a3 »

acknak wrote:PPS: Nope. Registered: 22 Apr 2012 16:28 http://user.services.openoffice.org/en/ ... le&u=53830

Appears in the "Newly registered users" group but still posted a spam.

I can't explain it.
The newly registered users group won't do anything until the permissions are set. Anyway, some of it is explained on this: Knowledge Base - How to use the post count to limit forum access.

So if the moderator approval is to be set: go to Forum Permissions for Newly Registered Users and then hit the Advanced tab. Set "Can post without approval" to NEVER (not NO, since the YES of Registered Users overrides the NO Newly Registered Users). Once users leave this group they will be able to post without approval.
LibreOffice 4.2
User avatar
Hagar Delest
Moderator
Posts: 32627
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: Increase of spam - straight to delete instead of quarant

Post by Hagar Delest »

I've not activated the moderation of new posts yet. It's the last thing I want to do for the moment. I hope that spammers won't post more than 10 posts when they see that the url tags are not parsed.
So it doesn't prevent spam, it's just a limit (hopefully).
I agree that if they post more than 10 posts or if they post a simple link (like the user linked above), then it is parsed automatically and the counter measure is ineffective.
If it doesn't work, then I fear that the moderation of the first post will be the only solution.
LibreOffice 7.6.2.1 on Xubuntu 23.10 and 7.6.4.1 portable on Windows 10
User avatar
acknak
Moderator
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Post by acknak »

My guess is that spammers are paid by the post; I doubt that anything else matters. If that's the case, then it won't matter what we do to prevent the post going public, they are going to continue making posts as long as it's allowed.
AOO4/LO5 • Linux • Fedora 23
thomasjk
Volunteer
Posts: 4451
Joined: Tue Dec 25, 2007 4:52 pm
Location: North Carolina

Re: Increase of spam - straight to delete instead of quarant

Post by thomasjk »

Thank you, Hagar and Acknak for all your efforts to clean out the spammers. Unfortunately, I believe that moderation of the the first post and any stronger measures available should be implemented as quickly as possible. I know some legitimate new users will be impacted but the forum was unusable with the recent spam floods.
Tom K.
Windows 10 Home version 1803 17134.165
LibreOffice 5.4.7.2
User avatar
kingfisher
Volunteer
Posts: 2123
Joined: Tue Nov 20, 2007 10:53 am

Re: Increase of spam - straight to delete instead of quarant

Post by kingfisher »

The moderation has to apply to more than the first post and longer than the first day. These people are posting a multitude of posts from the get go.

As far as confusing genuine users is concerned, can one or more of the pages seen in the registration process explain that their posts have to be moderated temporarily because of the need to prevent spam?

EDIT: To give an idea of how this looks to the public, here is a snapshot of what I see near the top of the General board in a reader.

Image

Click on the thumbnail to see the image full size (it was too large a file for this forum).
Apache OpenOffice 4.1.9 on Linux
User avatar
acknak
Moderator
Posts: 22756
Joined: Mon Oct 08, 2007 1:25 am
Location: USA:NJ:E3

Re: Increase of spam - straight to delete instead of quarant

Post by acknak »

kingfisher wrote:The moderation has to apply to more than the first post and longer than the first day. These people are posting a multitude of posts from the get go.
I'm not sure that's how it works.

As I understand it, all posts from a newly-registered user will go into the moderation queue for review by the mods. It doesn't matter how many posts they make, none of them will be public.

Once a moderator has reviewed the posts and decided whether they're spam or not, the posts can be approved or trashed by the moderator. If a mod decides the user is legitimate and the post(s) approved, the posts will go to the public boards. Once a user has enough approved posts, enough to meet the threshold we set, then they automatically get normal user status and no further moderation of their posts is needed.

We've always avoided moderation because of the increased burden for mods, but I can imagine a number of other problems.

However, I don't see any other choice at this point--at least temporarily, as already proposed.
AOO4/LO5 • Linux • Fedora 23
/a3
Posts: 92
Joined: Sat Jul 02, 2011 4:05 am

Re: Increase of spam - straight to delete instead of quarant

Post by /a3 »

Last edited by /a3 on Mon Apr 23, 2012 7:07 am, edited 2 times in total.
LibreOffice 4.2
User avatar
kingfisher
Volunteer
Posts: 2123
Joined: Tue Nov 20, 2007 10:53 am

Re: Increase of spam - straight to delete instead of quarant

Post by kingfisher »

@acknak

Thanks for the information. What about transferring people from NRU to ordinary membership once their bona fides has been established?
Apache OpenOffice 4.1.9 on Linux
Post Reply