Are BlogCFC users getting spammed?
Posted At : September 17, 2007 2:40 AM
| Posted By : Mark Drew
Related Categories:
spam
I have noticed recently that a number of blogs seem to be getting spammed.
Now, why is this different from normal? Well, it seems to me that this spam is *human* spam, rather than bots or anything. They seem to be getting past the captcha on blog comments. The volume is fairly low for a bot, but its constant.
I just wondered if it was just because most of the blogs that I read are running blogCFC, there are human spammers, or there is some way round the captcha?
Just so you know, I have started moderating comments for this reason, don't worry, I shall be checking my email to make sure that the right comments are displayed.
Oh, and most of the IP's seem to be from China. Whatever gets you through the day guys, your spam posts wont appear here.
So I really doubt its a vulnerability in BlogCFC.
As for a way around captcha, I don't use it but looking at the captcha I see below, it should not be that hard for someone to code a OCR program to crack it. I'm looking at a captcha of 4 letters, 3 fonts and very little skewing of the letters. Not very effective.
@Ben: It isnt a surprise to get them, its just that it seems to be targetting CF blogs (hence I am spotting it now) and hence I am not sure what to do... I shall see if I can increase the captcha settings, and apologies for that!
@Michael: I think they are human, some of the quotes seem to make sense (rather than copy and paste) and then the links which have no pattern) I shall see if I can increase the settings for my comments.
As long as we all moderate, that should deal with it one would hope?
http://tinyurl.com/35xv4j
unfortunately the only real way i think to battle spam once you get to a certain size is to implement slashdot/digg style ratings for content and allow users to police it themselves.
if you've never seen slashdot's method for handling large-volume spammers, trolls etc it makes for interesting reading...
http://yro.slashdot.org/faq/com-mod.shtml
obviously smaller sites wouldnt never need that much functionality and it'd be a bit like trying to smash a walnut with a sledge hammer but it highlights just how big of an issue this can be to people who are responsible for building social based websites.
@Ray: go implement please;) (in your own time)
Actually, I am doing some design changes to my blog, it might be part of that...
And apologies to *normal* commenters...
with the slashdot stuff i was referring more to the problem in general, showing that stuff like captcha works to a point but when you become a big enough target due to your site traffic/ exposure you really need to take the moderation out of the hands of the site admin (unless you can afford a team to moderate it in which case fill your boots ;) ) and rely on your users having a strong sense of community and the will to see threats such as this minimised.
as i said for blogs typically this is overkill but you could always do something that sat mid-way between the two.
i saw this site a while back which has some nice simple (hah!) maths questions in lieu of a captcha...
http://random.irb.hr/signup.php
i think there is a lot to be said to this kind of approach (i.e. targeting the security to the target audience rather than *any* human with net access).
If any posts are sent with that, I am thinking that they would need to be moderated.
What do you guys think of this idea, or maybe having a set of rules, so that if it has a url it gets moderated, if I delete that post, the url gets put in a blacklist, so then next time the idjits post spam, if it has a url and that url (or domain) is in the blacklist, then it automatically rejects the post completely. and shows them a nice picture of tubgirl ... or something
MD
1) I wrap Galleon 2 (few days away)
2) I wrap BlogCFC 5.9
3) I do minor updates for LHP, Soundings, Harlan, and the others
4) MAX is done.
5) Peace arrives in the Middle East
6) Pigs Fly
7) Paris Hilton graduates.... anything
8) I get slim.