mainSavannah Administration - Support: sr #106304, Bug spam from logged in spammers?

 
 

sr #106304: Bug spam from logged in spammers?

Submitter:  Bob Proulx <rwp>
Submitted:  Fri 14 Mar 2008 05:27:08 PM UTC
Votes: 100
 
Category:  Savannah trackers - bugs, tasks, etc. Priority:  5 - Normal
Severity:  3 - Normal Status:  None
Privacy:  Public Assigned to:  None
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Fri 05 Feb 2010 11:41:54 PM UTC, comment #40: 

- looked like the standard sort of savannah spam to me.  maybe we've been targeted by only one spam farm so far.

- i like the idea of hold-for-moderation. no clue how it can be implemented in savane, though.

- i don't see a voting scheme as a requirement. could just hold the junk and let the project admins deal with it.  same as we do for mailing lists, basically.

- an "originality" filter sounds like an interesting idea.  we reject a ton of spam on mailing lists based on duplicate posts.

- i guess this is mostly off-topic for this issue, but ...: sylvain mentioned recently about eventually supporting email for the bug trackers. then some kind of hold-for-moderation seems necessary to me, else the (email-based) spam would be overwhelming.  (personally, the only email feature i would really like is to be able to reply in email instead of using these horrible browser textareas to compose text. i'm happy to use the web interface to do other stuff with the trackers, although of course not everyone is happy with that.)

best,
karl

Karl Berry <karl>
Site Administrator
Fri 05 Feb 2010 04:16:23 AM UTC, comment #39: 

I haven't run across the new spam yet.  Have we attracted more creative spammers or are they still doing many lines of "<URL> GarbageGarbageGarbage"?

More generally, how difficult would it be to implement a "hold-for-moderation" mechanism?  Something to allow more aggressive content filtering without risking losing legitimate comments?  Ideally, it could be configurable per-project or even per-item-that-takes-user-submissions.  So a quiet project that isn't getting spammed might be able to just bypass moderation entirely and let any posts not blocked by site filters (like the TextCHA) through, while a heavily attacked, highly-visible project might even be able to make their own filter rules, possibly even on a per-communication-tool basis, while blocking posts that look too much like spam entirely.

It could actually be as simple as having means for the system to assign a non-zero spam score to a new post if certain conditions are met and allowing to vote posts as "not-spam".  To prevent spammers from gaming the system, keep a log of votes (to allow tracing spammer accounts that are used to abuse the voting system) and give each user two votes per time interval (choose day, week, hour, whatever, ideally based from statistics on how often real users vote posts as "spam" now)--the first vote in an interval counts in full, but each subsequent vote counts half of the previous vote.  After an interval, both votes are restored.  Project admins would need the ability to zero out a post's spam score (assuming that a project admin can be trusted not to want their own project spammed) and perhaps tracker admins should be given some similar power.

Are the spams varying much, or are there correlations between them?  If the spammers are just posting the same thing over and over, perhaps a circular buffer (in some sense) of the most recent posts (site-wide) could be kept and incoming posts checked for similarity against other recent posts, with the probability that the new post is spam (and thus its initial spam score?) being proportional to how closely it resembles other recent posts?  This would also have the advantage that such pseudo-blacklisting would expire as posts are replaced in the buffer.  Essentially, it would be a time-span-limited originality filter.  Since legitimate posts to trackers in two different projects (or even two different bugs in the same project) are likely to be fairly different, and rather unlikely to contain the same URLs, this could alternately take the form of a rolling URL blacklist, perhaps with the most likely to be joe-jobbed (but trustworthy) domains (such as debian.org, gnu.org, kernel.org, fsf.org, etc.) whitelisted to prevent spammers from getting (too many) legitimate URLs into the blacklist.  This should rate-limit spam to a manageable fraction of posts overall.

I like the idea of content-based filters more than CAPTCHAs simply because spammers have found ways to get other people to solve CAPTCHAs for them (I believe this is how Gmail's CAPTCHA was "broken"), but if spammers can't post their garbage over and over, no matter what it is or how many CAPTCHAs they solve, we can hopefully make spamming Savannah painful enough that the spammers go elsewhere.

Jacob Bachmeyer <jcb>
Thu 04 Feb 2010 08:20:12 PM UTC, comment #38: 

We just got a great deal of spam. One of the spammers 1) found he needed to type "451" and 2) was greedy enough to spam a lot of items at once.

I just changed the question, let's see if this works.

At my day job, I recently implemented TextCHA-based solutions for MediaWiki and MoinMoin. On most websites spam stopped (can't tell for those that restricted anonymous edits though). However, one of them continued to receive spam, but much less. AFAICS one spammer is sending a mass-posting from multiple IP sources at once, and succeed depending on which TextCHA is asked. Since the questions were asked in French, I assume that there's one French-speaking human in the spammer's team that answered at least one of the questions I had setup. It still spammed the website after I changed the 2 questions (though most of the posts were blocked). I just switched to an unguessable question (i.e. a password), and the spam stopped, which means it's not a flaw in the MoinMoin antispam.

One counter-measure that spammers might use would be to present the questions to normal web users in exchange of porn material (this is not new, that also worked for Captchas).

Multiplying the questions, and ask them at random, might help fighting spammers, because they'll have a hard time listing all the possible TextCHA questions (especially if not all of them are asked on any given day).

Sylvain Beucler <Beuc>
Sun 04 Oct 2009 10:08:17 AM UTC, comment #37: 

Almost no spam is reported these days, so I guess the current simple measures are effective.

Sylvain Beucler <Beuc>
Sun 04 Oct 2009 02:02:46 AM UTC, comment #36: 

At least from a cursory glance at the spam others have mentioned here, it looks like most of the spam follows the same format.

Perhaps some means of blocking (or holding for moderation?) comments that contain many lines that begin with a URL and have following text?  In other words, most of the spam seems to be many lines of:

    http://spammerland.example.com/spamspamspam  Yet More Junk

Perhaps a filter that rejects or holds for moderation or (anyone else have a good idea?) comments with more than a certain fraction of lines that match m{^http://} (Perl regexp notation) might help the spam problem?

Jacob Bachmeyer <jcb>
Wed 21 Jan 2009 11:17:36 PM UTC, comment #35: 

I wonder if http://blogspam.net/code/ could be usefully adapted for savannah. It's for blogs instead of hosting services, but ...

(It would be astonishing to me if no other hosting site -- sourceforge, berlios, etc. -- had done anything about comment spam, but I can't go looking right now.)

Karl Berry <karl>
Site Administrator
Wed 21 Jan 2009 11:03:17 PM UTC, comment #34: 


> Another thing that I wonder about is running some kind of
> simple-minded spamassassin-like test on comments before they
> are posted. The spam that gets posted is completely obvious
> and I'd expect any program would detect it. Do any other
> hosting sites do this?


Generally speaking mail anti-spam tools aren't much efficient against comments spam.

In this case we're willing to block people whose URLs usually aren't in the URL block-lists yet. In addition several spammers do include part of the page content along with their URLs (including legitimate URLs) which means they aren't so easy to block.

So if there's a way to detect such spam on the fly, I'm willing to implement it, but I doubt it.

Sylvain Beucler <Beuc>
Sun 18 Jan 2009 07:11:05 PM UTC, comment #33: 

How sad.

We can't defeat the manual setup, but I agree a couple more questions couldn't hurt.  A couple more ideas from the overview page:
At what institution did Richard Stallman start his career? (MIT)
What is GNU's graphical desktop called? (GNOME)

Another thing that I wonder about is running some kind of simple-minded spamassassin-like test on comments before they are posted.  The spam that gets posted is completely obvious and I'd expect any program would detect it.  Do any other hosting sites do this?

Karl Berry <karl>
Site Administrator
Sat 17 Jan 2009 10:41:52 AM UTC, comment #32: 

From what I remember it was registered 12th january, so it did pass the TextCHA.

My understanding of the stats is that spammers combine initial manual setup with later automated spamming. In this case I presume the spammer's cronjob reported a failure to login, triggered manual check (reading the GNU manifesto page), fixing the cronjob and running it again.

Not all spammers have error reporting though, as shown by the ridiculously high number of blocked anonymous spam.

So I guess we need to implement 10-20 questions instead of one, and also make it less automatable by storing the currently selected question on the server-side rather than in a form field.

I'm not sure why spammers insist on posting urls here though, trackers item doesn't get a particularly high google rank in general..

Sylvain Beucler <Beuc>
Thu 15 Jan 2009 10:48:42 PM UTC, comment #31: 

Could it be the case that the spammer already existed in the system before the textcha?

Karl Berry <karl>
Site Administrator
Thu 15 Jan 2009 07:00:09 PM UTC, comment #30: 

So at least one spammer took at look at the GNU manifesto publication date (which is the current TextCHA question).

I need to add more questions, at once - any suggestions? :)

Sylvain Beucler <Beuc>
Wed 14 Jan 2009 06:20:25 PM UTC, comment #29: 

Re: "Well I put the TextCHA 9 days ago and the spamlist.php stayed empty since then - so you should have an idea on whether it works now :)"

These got through it since then:

  http://savannah.nongnu.org/task/?4755

But I am sure it is an improvement in spite of that counter example.

Bob Proulx <rwp>
Site Administrator
Wed 14 Jan 2009 06:06:03 PM UTC, comment #28: 

Well I put the TextCHA 9 days ago and the spamlist.php stayed empty since then - so you should have an idea on whether it works now :)

Sylvain Beucler <Beuc>
Wed 14 Jan 2009 02:16:07 AM UTC, comment #27: 

Because of the spam problems I've had to add the savannah sender as a "always moderated" address to my project mailing lists; for every bug, etc. email that is generated I have to go approve it in case it's spam.

Frustrating.  I hope the captcha solves this problem.

Paul D. Smith <psmith>
Tue 13 Jan 2009 11:07:01 PM UTC, comment #26: 

I figured the spamlist.php url wasn't available to normal mortals.  But since I submitted this bug in the first place and that was offered as an option I felt justified in saying that it didn't work for me.

Bob Proulx <rwp>
Site Administrator
Tue 13 Jan 2009 11:03:10 PM UTC, comment #25: 


> I added a basic TextCHA in the registration page.

Thank you very much.  It'll be interesting to see how much it helps.

> Meanwhile, do you by any chance know about
> https://savannah.gnu.org/siteadmin/spamlist.php


I did, but deleting spam after the fact is very much suboptimal, because it has already generated mail to the mailing lists (e.g., bug-grep).

(Bob, the page probably didn't come up for you because you have to be savannah super-user in the web interface.)

> Do you get only registered spam or also anonymous spam.


In the projects I looked at (grep, texinfo), anonymous comments were (thankfully) disallowed, so it was only registered spam.

Karl Berry <karl>
Site Administrator
Mon 05 Jan 2009 08:18:45 AM UTC, comment #24: 

Well that's an administrator page.

Sylvain Beucler <Beuc>
Mon 05 Jan 2009 05:13:59 AM UTC, comment #23: 


> Meanwhile, do you by any chance know about https://savannah.gnu.org/siteadmin/spamlist.php ?
> Reported spammers can be banned in a single click.


I did not know about that page but that page gives me a permission denied error.

Bob Proulx <rwp>
Site Administrator
Sun 04 Jan 2009 10:27:39 AM UTC, comment #22: 

I added a basic TextCHA in the registration page.

Sylvain Beucler <Beuc>
Sun 04 Jan 2009 07:53:21 AM UTC, comment #21: 

Meanwhile, do you by any chance know about https://savannah.gnu.org/siteadmin/spamlist.php ?
Reported spammers can be banned in a single click.
It could be improved with a "hide all posts from this spammer".

Do you get only registered spam or also anonymous spam. It would be amazing to see that spammers prefer registering an account rather than typing 421 in a single field.

Sylvain Beucler <Beuc>
Sat 03 Jan 2009 11:49:41 PM UTC, comment #20: 

plenty of spam is still coming through; i see it especially on bug-grep, but others have been hit.  can we do anything to make it harder for spammers to get registered?  after-the-fact is discouragingly insufficient.

Karl Berry <karl>
Site Administrator
Sat 03 Jan 2009 09:52:59 AM UTC, comment #19: 

After 8 months...
Apparently this is slightly decreasing.

-- User was not logged and check_value is wrong
255478

-- Idem, and in addition the posted text contains an HTTP link
245328

-- Validated post (validated captcha or authentified)
17412

-- Posts per suspicious IP
Top-10:
| 200.63.42.109   |  4689 |
| 200.63.42.111   |  4699 |
| 78.129.202.7    |  4891 |
| 194.8.74.43     |  5175 |
| 194.8.74.47     |  5674 |
| 194.8.75.251    |  5775 |
| 81.177.22.216   |  8405 |
| 216.240.153.114 |  8851 |
| 77.91.229.56    |  9867 |
| 208.70.78.16    | 21635 |
But there's a total of ~30000 IPs.

-- Average posts by suspicious IP
6.9553

-- Posts per IP suspicious and per day
Lots of 1-2 daily posts per IP + between 2 and 4 big spammers ranging from 10 to 200 daily posts per IP.

-- Number of different IP adresses
37444

-- Average number of different apparently-spamming IP adresses per day
203.1569

Sylvain Beucler <Beuc>
  Spam posted by anonymous
  Spam posted by anonymous
Fri 15 Aug 2008 07:45:34 PM UTC, comment #16: 

Some stats after 3 months 1/2:

-- Approximation for anonymous spam + anonymous users who mistyped the captcha
-- User was not logged and check_value is wrong
153800
-- Idem, and in addition the posted text contains an HTTP link
147648
-- Validated post (captcha or authentified user)
8112 (=~ 5% of all captcha-filtered posts)
-- Posts per suspicious IP
min:   1
max-1: 8111  (77.91.229.56)
max:   12747 (208.70.78.16)
#IPs: 24946
-- Average posts by suspicious IP
5.3733
-- Posts per IP suspicious and per day
~ [1, 120]
-- Number of different IP adresses
28291
-- Average number of different apparently-spamming IP adresses per day
350

Beware: the messages we really need to analyse further are the 8000 ones, not the 150000 others which are already blocked. So the analysis only confirms that the spam we get comes from the clever spammers.

Sylvain Beucler <Beuc>
Sat 12 Jul 2008 12:44:59 PM UTC, comment #15: 

Here's an extremely clever spam that showed up in my bug #17873 a day or two ago: it takes some sentences from OTHER COMMENTS and adds the spam bit in the middle, so the result is somewhat relevant to the bug in question, plus spam.  It doesn't really make sense but it's enough to cause you to look twice:

Friday 07/11/2008 at 07:59, comment #13:

since the dependencies are fake, problems arise easily. http://without-prescription-no.com , and some makefiles may be using it, so we'd have to use some other special target.

Paul D. Smith <psmith>
  Spam posted by anonymous
Sat 24 May 2008 07:49:03 AM UTC, comment #13: 

TextChas sounds like something to try out:
http://moinmo.in/HelpOnTextChas

Examples:
<<Since you are not logged in, please enter the last name (family name) of the founder of the GNU project (http://www.gnu.org/gnu/thegnuproject.html):>>

<<Since you are not logged in, please enter the date of release of version 3 of the GNU GPL (gplv3.fsf.org):>>

Answers are matches against a set of regexps and languages.

The cons is the need for i18n'ing the questions. And change the questions from time to time.

This could also be added in the account creation page.

Sylvain Beucler <Beuc>
Thu 22 May 2008 06:47:36 PM UTC, comment #12: 

It seems poetic to me that this bug reporting a problem with bug spam is also getting bug spam.  :-)

Bob Proulx <rwp>
Site Administrator
  Spam posted by anonymous
Wed 30 Apr 2008 08:31:08 PM UTC, comment #10: 

We got a series of '//Not Viagra' spam. The logs show that this was done over ~15mn with ~2msg/min. This means filters like MoinMoin's "surge protection" won't work in such case. "surge protection" may still be good to implement, in combination with reducing the number of allowed links per posts - to compensate, spammers would need to post more independent posts, in which case "surge protection" would kick in.

After 6 days, let's have some new stats:
- posts: 12400
- failed "421" tests: 11903
- valid posts containing 3x "http://": 420
- IPs: 2241
- Max posts per IP: 647
- Max posts per IP and day: 150
- Average posts by suspicious IP: 5

I don't have much time for this, so code contributions are needed.

Sylvain Beucler <Beuc>
Fri 25 Apr 2008 06:49:52 PM UTC, comment #9: 

I added a few tracers in the code and build some stats for the past day. I trace all new items and items comments.

Total comments received: 1869
Posts that failed the 421 captcha and contain "http://": 1808
Validated posts (login or captcha): 36
Captcha-validated (anonymous) posts: 6 => 17%
Validated posts that contain "http://": 6
Validated posts that contain spam: 2 (1 login + 1 captcha)

Number of differents IPs: 468
Number of differents IPs for posts that failed the captcha and contain "http://": 436
Max # of posts by IP: 89
Average posts by suspicious IP: 4.18
Median of the above: 1

So we're in front of a distributed comment spamming, coming from numerous origins, each generally posting only a few comments. The wide majority of the posts are sent by very primitive bots and are several orders of magnitude more numerous than legitimate posts. The rest of the spam comes from more intelligent bot, but also from bots who just registered an account (and avoid any captcha). IDS won't be much effective because of the diversity of the attack sources.

I portscanned a few spamming IPs. AFAICT they were not open proxies (either completely closed, or classic GNU/Linux setup with no apparent proxy). I only checked a few IPs, so this is not a definite conclusion.

The use of a graphical captcha will not stop the clever spammer, not spammers who create accounts. So this solution may not work so well.

About reCaptcha in particular: while this is an interesting initiative, we don't have the source code for the server-side of this solution (only for the client plugins). One of Savannah's goal is to showcase a forge running exclusively on free software. Relying on external 3rd-party services which lack source code defeats the point. (same goes for akisnet or something)

Possible solutions: I'd suggest testing URL blocklists, escalating based on the presence of external URLs, and also improving post-moderation (fix rather than reject - we'll probably never get rid of 100% spam).

The trace is still running so we may get more data later on.

Note that this applies to Savannah in general. Savane (and more generally forges) is not widespread. Mediawiki or DotClear installations probably get a different kind of spam, both in quality and quantity ;)

Suggestions?

Sylvain Beucler <Beuc>
Tue 15 Apr 2008 12:22:50 AM UTC, comment #8: 

I agree with Paul, the captcha is only an "enter 137"  How about implementing some of the modern day Recaptcha systems?

Dennis Berko <devioux>
Mon 14 Apr 2008 10:33:08 PM UTC, comment #7: 

Ditto here; one of my bugs is getting lots of spam, but it's almost all posted by Anonymous.  So, I think the captcha we're using must not be strong enough??

See https://savannah.gnu.org/bugs/?17873

There are some real users posting spam there too.

It seems like it should be trivial for folks with access to the database to query it and get a list of all the comments marked spam, faster and easier than us posting links to them all.  You could even query those that were posted by Anonymous vs. "real" users.

Paul D. Smith <psmith>
Sat 12 Apr 2008 12:13:16 AM UTC, comment #6: 

Sylvain,

There are several (12) spam comments at:

https://savannah.gnu.org/bugs/index.php?16179

And a spam bug report at:

https://savannah.gnu.org/bugs/?22897

Maybe others, I didn't keep a log.

Tony Abou-Assaleh <taa>
Fri 11 Apr 2008 11:59:52 PM UTC, comment #5: 


> Bob, for your initial question, maybe see https://savannah.gnu.org/maintenance/SavaneTasks


The SavaneTasks page describes a process to clean spam through direct SQL access.  I am happy to do this.  Where can I log in to be able to run the SQL commands documented on that page?

Bob Proulx <rwp>
Site Administrator
Fri 11 Apr 2008 10:17:23 PM UTC, comment #4: 

Sure I'd love to get started on this assignment, As Sylvain said it would be great to get some more details first.

Dennis Berko <devioux>
Fri 11 Apr 2008 09:50:32 PM UTC, comment #3: 

Dennis,

Maybe this is an opportunity for you to analyse the spam we receive at Savannah, in preparation of the anti-spam coding tasks?

Tony, can you give more details about the spam you received (URLs, patterns...) ?

Bob, for your initial question, maybe see https://savannah.gnu.org/maintenance/SavaneTasks

Sylvain Beucler <Beuc>
Fri 11 Apr 2008 03:01:37 AM UTC, comment #2: 

I continue to receive comment spam in GNU grep's bug tracking from registered users. This is becoming increasing annoying not only for the maintainer, but for all members of bug-grep list that gets notifications of changes to the bug tracking.

Any suggestions on how to deal with the situation?

Tony Abou-Assaleh <taa>
Sat 15 Mar 2008 05:30:14 PM UTC, comment #1: 

I second this request. I've been getting a lot of spam recently on GNU grep project. We have the bug comments connected to the mailing list, resulting in mailing list spam as well.

Tony Abou-Assaleh <taa>
Fri 14 Mar 2008 05:27:08 PM UTC, original submission:  

Is there a way to lock accounts from known spammers and to find and clean up the spam they have left behind?  See these bugs for examples of pharmacy spam from two different accounts.

  http://savannah.gnu.org/bugs/?16179
  http://savannah.gnu.org/bugs/?15280
  http://savannah.gnu.org/task/?3491
  http://savannah.gnu.org/bugs/?1212

Bob Proulx

Bob Proulx <rwp>
Site Administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by jcb (Posted a comment)
  • -email is unavailable- added by karl (Posted a comment)
  • -email is unavailable- added by psmith (Posted a comment)
  • -email is unavailable- added by devioux (Posted a comment)
  • -email is unavailable- added by Beuc (Posted a comment)
  • -email is unavailable- added by Beuc
  • -email is unavailable- added by taa (Voted in favor of this item)
  • -email is unavailable- added by taa (Posted a comment)
  • -email is unavailable- added by rwp (Submitted the item)
  •  

    There are 100 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-01-04 Beuc Carbon-CopyRemoved 71380 -
    2009-01-04 Beuc Carbon-CopyRemoved 71623 -
    2008-04-11 Beuc Carbon-Copy- Added -email is unavailable-
    2008-04-11 taa Carbon-Copy- Added taa

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code