Scott on Writing

# re: And the Point of this Comment Spam Would Be? 9/3/2005 5:44 PM Jeff Atwood

You're crazy not to use a CAPTCHA. That would prevent this manual labor entirely..

# re: And the Point of this Comment Spam Would Be? 9/3/2005 6:53 PM Scott Mitchell

Jeff, the TRIGGER approach I use to filter comment spam works wonders. It removes 99.9% of comment spam. To date, it's stopped over 11,000 comment spams. See this blog entry for more info: http://scottonwriting.net/sowblog/posts/3083.aspx

CAPTCHAs have a couple of problems, IMHO. First, they are vulnerable to AI and social engineering schemes, as discussed here: http://scottonwriting.net/sowblog/posts/3154.aspx

Second, correct me if I'm wrong, but CAPTCHAs aren't supported via CommentAPI, meaning those that post comments to my blog via their aggregator are S-C-R-E-W-E-D if CAPTCHAs are used.

# re: And the Point of this Comment Spam Would Be? 9/3/2005 10:01 PM Arif Khan

Can you check server logs and track the IP addresses associated with those comment spams? ...any pattern or consistency ...?

# re: And the Point of this Comment Spam Would Be? 9/3/2005 10:27 PM Scott Mitchell

Arif, I believe more modern versions of .Text/CommunityServer track the commenters IP address, but not the version I'm using. I guess I could troll through the logs and *try* to determine the IP, but the user, for example, may be coming through a popular proxy (AOL, perhaps), in which case IP blocking would be less than ideal since it would block out many commenters who are not propagating the comment spam.

# re: And the Point of this Comment Spam Would Be? 9/4/2005 7:10 PM Joel Ross

About 6 months ago, blogs.sagestone.net underwent the same type of comment spam. It started with Amanda, and kept going - it eventually stopped, but it was annoying. So, no, they probably aren't targetting you directly, but it is still odd!

Oh - and we are running .Text there too...maybe it's a .Text thing. We aren't a very popular blog, so who knows why we were targetted either.

# re: And the Point of this Comment Spam Would Be? 9/6/2005 5:33 AM ron

you should check out reversedos. it works wonders.

http://www.angrypets.com/tools/rdos/

# re: And the Point of this Comment Spam Would Be? 9/7/2005 2:19 PM Andy

Could it be that someone is testing a comment spam algorithm or something similar? Just a thought...

# re: And the Point of this Comment Spam Would Be? 9/8/2005 8:20 AM Michael K. Campbell

I second Ron's suggestion ;)

You should use ReverseDOS. Your trigger sounds like a great approach - but why burn up cycles letting spam get clear into your data tier before it is nuked - ReverseDOS implements pattern matching in an HttpModule.

Plus, if this IS a human - you can take the fun out of it for them. If they post Ginger, Gabi, etc. and you've set up filters for that your site will look, to the spammer, like it is suffering a DOS attack, and will take a minute or two to send back the HTTP 403 header.

# re: And the Point of this Comment Spam Would Be? 12/13/2005 8:48 AM James

Things like this could be an attempt to find an SMTP injection vulnerability on your website to see if they can use it as an open relay for sending out spam. It seems to be the latest thing that spammers are up to these days. It might be worth your while setting up some kind of logging system to see if you can determine exactly what is being posted to your blog.

It seems that PHP websites are particularly at risk -- PHP's mail() function has a vulnerability that allows a malicious user to inject arbitrary headers. As far as I can tell, the System.Web.Mail classes in ASP.NET are somewhat more secure, but it probably won't stop them having a go anyway, so it's a good idea to check all your user-supplied data for newline characters where there shouldn't be any.

I've gone into more detail about this on my blog:

http://www.jamesmckay.net/archive/2005/12/51

Ads Via DevMavens