Page 1 of 1

Spam intruder?

Posted: October 23rd, 2018, 12:31 pm
by Eeli Kaikkonen
I use Feedly feed reading service for this forum. I just got this:
Screenshot_20181023_192242.png
Screenshot_20181023_192242.png (45.13 KiB) Viewed 1639 times
Notice the spam. It's not seen when I open the forum. But someone may have intruded into the system somehow, maybe there's some weakness is some forum software update?

Re: Spam intruder?

Posted: October 23rd, 2018, 1:53 pm
by Jonathan Robie
Bother.

Someone has managed to insert text into the Atom feed (see http://ibiblio.org/bgreek/forum/app.php/feed). You won't see it on the forum itself, only in an RSS/Atom feed. If you are just reading B-Greek in a browser, this problem probably won't affect you at all.

I just raised this issue on the phpBB forum (https://www.phpbb.com/community/viewtop ... #p15117141), they are usually fairly responsive. Thanks for catching this!

Re: Spam intruder?

Posted: October 23rd, 2018, 2:11 pm
by Jonathan Robie
Someone pointed out that the text is in the original post, just very, very small.

It's gone now, I edited it out. I'm trying to figure out how the text got there in the first place.

Re: Spam intruder?

Posted: October 23rd, 2018, 2:16 pm
by Jonathan Robie
OK, it should have been obvious.

Mark Miller seems to be a spam account. He simply typed the text into his post, using a very small font that cannot be seen normally. His account has now been banned.

Thanks, Eeli!

Re: Spam intruder?

Posted: October 24th, 2018, 11:40 am
by Barry Hofstetter
This was my fault. I approved the person, and never saw that. The funny thing was that it activated my "this could be a spammer instinct" but because he gave a real sounding name, I thought I would give him the benefit of the doubt. I shall never ignore my spidey-sense again.

Re: Spam intruder?

Posted: October 24th, 2018, 12:05 pm
by Jonathan Robie
Barry Hofstetter wrote:
October 24th, 2018, 11:40 am
This was my fault. I approved the person, and never saw that.I don't think it's really your fault. This kind of thing can happen easily. The funny thing was that it activated my "this could be a spammer instinct" but because he gave a real sounding name, I thought I would give him the benefit of the doubt. I shall never ignore my spidey-sense again.
It's actually easy to see when someone does this if you are suspicious. Moderators can simply open the post up in an editing window, or anybody can reply to the post to see it in plain text.

You can practice with this post - I hid some text in it.

Re: Spam intruder?

Posted: October 24th, 2018, 2:50 pm
by Barry Hofstetter
Jonathan Robie wrote:
October 24th, 2018, 12:05 pm
Barry Hofstetter wrote:
October 24th, 2018, 11:40 am
This was my fault. I approved the person, and never saw that.I don't think it's really your fault. This kind of thing can happen easily. The funny thing was that it activated my "this could be a spammer instinct" but because he gave a real sounding name, I thought I would give him the benefit of the doubt. I shall never ignore my spidey-sense again.
It's actually easy to see when someone does this if you are suspicious. Moderators can simply open the post up in an editing window, or anybody can reply to the post to see it in plain text.

You can practice with this post - I hid some text in it.
Hmmm... very clever of the little orcs to be able to do that. They won't slip it past me again. Grrr.

Re: Spam intruder?

Posted: October 24th, 2018, 8:14 pm
by Jacob Rhoden
Jonathan Robie wrote:
October 24th, 2018, 12:05 pm
It's actually easy to see when someone does this if you are suspicious. Moderators can simply open the post up in an editing window, or anybody can reply to the post to see it in plain text.

You can practice with this post - I hid some text in it.
The silliest part of this, is that Google crawlers actually detect when text is not visible (hidden, too small, moved off the side of the page, etc....) and ignore (and possibly penalise) such behaviour. Ignorance on the part of spammers is clear.

That said, it is worth being aware that spammers could hack an existing account and insert hidden advertisements into legitimate accounts.

Re: Spam intruder?

Posted: October 25th, 2018, 5:54 am
by Jonathan Robie
Jacob Rhoden wrote:
October 24th, 2018, 8:14 pm
That said, it is worth being aware that spammers could hack an existing account and insert hidden advertisements into legitimate accounts.
I don't know that they can. That's not what happened here.

I think the more common pattern is to come in, establish an account, then quote someone and insert invisible text with links into that quote. People have seen that on other forums. That's what just happened here.
Jacob Rhoden wrote:
October 24th, 2018, 8:14 pm
The silliest part of this, is that Google crawlers actually detect when text is not visible (hidden, too small, moved off the side of the page, etc....) and ignore (and possibly penalise) such behaviour. Ignorance on the part of spammers is clear.
I imagine someone, perhaps in some third world country, is getting paid for every link they create to a product they want to promote. These links can't be clicked on, and Google may not index them, but as long as someone is paying, that may not matter to the spammer.

I don't there was anything dangerous about this spam. I have looked in the feeds briefly and didn't see other examples, but I will look more deeply to see if this has happened in the past.