[kunarion]

[Technical] Geeky stuff here. Look away if you get bored easily.

The following is just an Internet/PC thing, it's been going on for years, and IT IS NOT GEOCACHING'S FAULT. It's the nature of the beast and I'm not sure GC could do anything about any of it (plus, like most Internet companies, they have this mildly annoying hands-off policy that kinda perpetuates these issues, but what ya gonna do). It's just something I watch sometimes.

Has anyone else been getting Spam email from "other Geocachers"? I've gotten two this week, from the same open mail IP address (98.130.1.240), and one had the return address of a friend listed in my own profile. Of course it was NOT from her (and it was an old email address she doesn't even have anymore, so it was super easy to tell), you need to understand email can have ANY "from" email address typed into it.

I've seen some persistent Spam scripts around here. GC seems to be keeping them cleaned up rather well.

One typical Bot had many user names, but one was "yucc" something. It joined Geocaching.com, joined the Forums, placed benign posts in several topics, along with an invisible GIF, to track topic activity.

There was a Bot this week that had no Gif, but used responses from Yahoo to form a paragraph to reply to a topic. It looked just like a slightly confused human post. So it's like a parasite, allowed to live around here and collect data, pretty tough to detect.

So the Spam Bots are joining for the purpose of collecting user data, enough to convince you to open an email and even run a program "from your friend", so "you know it must be safe". My email isn't listed in my profile, so these Bots are digging deeper. Some of you (AND YOU KNOW WHO YOU ARE) are running those programs you get in email "from people you know well" (NOT JUST FROM GEOCACHING -- YOUR OTHER FRIENDS AND RELATIVES OPEN AND INSTALL SPAM TROJAN HORSE PROGRAMS TOO AND YOU KNOW IT). Once you install a "program from your friend", it can grab email lists directly off your computer, and even send real messages from your real email. That's the end game, the goal of the strange Bots around here, to collect lists of viable email addresses, which are sold to Spammers.

You can run a virus scan til you're blue in the face, but if you go to all the work to install a Trojan Horse program you get in email "from a dear friend", the PC may allow it to run with no errors. Actually, the trojan horses rely on people who aren't familiar with PCs, who are in the habit of closing all those annoying windows that pop up.

This post has been edited by kunarion: 04 November 2011 - 06:41 AM

[knowschad]

What I don't get is how a forum post can gather information. I realize that if it has a link (or a linked hidden image) that it can boost the click rating of a webiste, but how is that getting any personal (or not) information?

[sbell111]

I've never received any emails like that. I thought that maybe they were just getting caught by my spam filter, but a quick check didn't turn any up.

[kunarion]

knowschad, on 04 November 2011 - 06:57 AM, said:

What I don't get is how a forum post can gather information. I realize that if it has a link (or a linked hidden image) that it can boost the click rating of a webiste, but how is that getting any personal (or not) information?

It's customized to GC in particular, and it joins the site, not just the Forum. Once you're a member, you can see email addresses, friends lists, usage patterns. I don't know what they get out of signing up to the Forum, except that it covers all the bases. But they get a list of active members for sure, which can be cross-referenced with the GC site. People which are verified to be "social-networking" are probably better bait than people who don't use the Forum. Just a guess.

Some friends in my list have their email address shown right in the Profile (I'm not convinced you couldn't find mine, too, with a little detective work). They don't need my email immediately, just enough people in my own profile that have email addresses shown. So the Spammers send email directly, compose it to look like it's from friends (or from Groundspeak or any number of ways). It's not even sent from my Friend's account or PC, it's all a spoof, but with a return address that looks right. Once my Friend gets an email "from me", which has a Trojan Horse in it, all she has to do is run it, and now the Trojan Horse has access to my real email address for certain. And now I get an email "from my Friend".

It's like a chain letter.

The thing that raised a huge red flag is, it's "TO:" a dozen people I don't know. Hey Spam Bots, "you need to fix that [BUG]"!

This post has been edited by kunarion: 04 November 2011 - 07:24 AM

[The Blorenges]

The first one noticed was yucww.

I noticed another one a couple of days ago - juerklog - but I notice the two post have now been deleted.

Then there's the one I mentioned to kunarion the other day, the one he refers to as "bot with no gif" - Fletcher15

It's interesting to try and spot these oddities. I may have a slight advantage for picking up on them because you're all asleep when I sit down here with my breakfast cuppa, and click "View New Content". Sometimes I notice a string of 3 or 4 last posts from an odd name that have appeared overnight.

I think it's good to have this Bot Spot Top-ic.


MrsB

[knowschad]

kunarion, on 04 November 2011 - 07:17 AM, said:

knowschad, on 04 November 2011 - 06:57 AM, said:

What I don't get is how a forum post can gather information. I realize that if it has a link (or a linked hidden image) that it can boost the click rating of a webiste, but how is that getting any personal (or not) information?

It's customized to GC in particular, and it joins the site, not just the Forum. Once you're a member, you can see email addresses, friends lists, usage patterns. I don't know what they get out of signing up to the Forum, except that it covers all the bases. But they get a list of active members for sure, which can be cross-referenced with the GC site. People which are verified to be "social-networking" are probably better bait than people who don't use the Forum. Just a guess.

Some friends in my list have their email address shown right in the Profile (I'm not convinced you couldn't find mine, too, with a little detective work). They don't need my email immediately, just enough people in my own profile that have email addresses shown. So the Spammers send email directly, compose it to look like it's from friends (or from Groundspeak or any number of ways). It's not even sent from my Friend's account or PC, it's all a spoof, but with a return address that looks right. Once my Friend gets an email "from me", which has a Trojan Horse in it, all she has to do is run it, and now the Trojan Horse has access to my real email address for certain. And now I get an email "from my Friend".

It's like a chain letter.

The thing that raised a huge red flag is, it's "TO:" a dozen people I don't know. Hey Spam Bots, "you need to fix that [BUG]"!

I am quite familiar with spoof emails coming from what appears to be somebody you know. What I don't get, and I don't think you really addressed, is why they would post a bogus forum message.

Also, actual emails on profile pages seems to be exceedingly rare, from my experience as a GC stalker. I'm sure they could get one now and then, but it surely wouldn't be a very productive use of their bots.

[kunarion]

knowschad, on 04 November 2011 - 07:39 AM, said:

I am quite familiar with spoof emails coming from what appears to be somebody you know. What I don't get, and I don't think you really addressed, is why they would post a bogus forum message.

They mass-post in forums all over the Interweb, and place a GIF image on their server so they can track hits (invisible is sneaky, and added later when the forum software's not looking). They may also look for vulnerabilities in the database, and need to join to see how it's served.

There are a bunch of different techniques around here. I think it's an active Spam Bot campaign, possibly human-assisted. But I also think the Bots that never got their GIF installed are defective. It's tough to write software that works correctly on any given system.

If you run Forum software, you're constantly applying updates and patches to fight off the latest attacks. It's a job in itself. Don't get me started on Forum scripts.

This post has been edited by kunarion: 04 November 2011 - 07:55 AM

[Pup Patrol]

Be aware of old threads being resurrected...

don't click any links that get posted...

jeklin110:

http://forums.Ground...howtopic=264785

[Pup Patrol]

Looks innocent and suspicious at the same time:

http://forums.Ground...0

[kunarion]

Pup Patrol, on 07 November 2011 - 04:06 AM, said:

Looks innocent and suspicious at the same time:

http://forums.Ground...0

How do you even find these?

Here's my review of today's bot: I like the brief all-purpose quote, lack of invisible GIF, lack of punctuation and capitalization (which have been a huge problem for them in the past), and decent user name. I also like the single post, since a bunch of rapid-fire replies identify a bot instantly. They're refining the bots nicely, and GS seems to be a satisfactory testing grounds for them.

But there are plenty of issues: They're still posting in old topics, at random. Why not pick the most current, rather than digging up bones? They're posting at 2am PST, which I'm sure is a respectable hour in China, but it looks suspicious if you're trying to look like not a bot -- it's becoming kind of a fingerprint. And immediately posting upon joining GC, that's a huge red flag. And let's "humanize" and personalize -- the replies still look generated. The challenge is to make your reply look like a contribution to the topic, not just "I agree" style posts. And why no Profile activity now? It was a nice touch to have some of the member Profile filled out.

So the bots are looking much better, but they have a long way to go. I give it a 6.

cool.alfred, on 07 November 2011 - 02:48 AM, said:

this is a good idea

This post has been edited by kunarion: 07 November 2011 - 07:19 AM

[knowschad]

this is a good idea

[GeoGeeBee]

knowschad, on 07 November 2011 - 07:14 AM, said:

this is a good idea

Aha! I knew it!

[hzoi]

kunarion, on 04 November 2011 - 06:36 AM, said:

Has anyone else been getting Spam email from "other Geocachers"? I've gotten two this week, from the same open mail IP address (98.130.1.240), and one had the return address of a friend listed in my own profile. Of course it was NOT from her (and it was an old email address she doesn't even have anymore, so it was super easy to tell), you need to understand email can have ANY "from" email address typed into it.

I guess the spam boths have identified you as a threat and are taking more aggressive steps against you.

You keep this up, and these guys are going to show up on your doorstep eventually...

[kunarion]

hzoi, on 07 November 2011 - 07:41 AM, said:

these guys are going to show up on your doorstep eventually...

They did, and they gave me a "Mind Wipe". Worse, I have to PRETEND I got a "Mind Wipe", because that's only science fiction. Those losers.

I've already done their survey and rated the Mind Wipe a 3, "Somewhat dissatisfied". That'll teach 'em!

This post has been edited by kunarion: 07 November 2011 - 09:41 AM

[CatfishPilot]

Is there a four or six year degree course available at my local Ivy League school that could explain what your talking about?

[Pup Patrol]

kunarion, on 07 November 2011 - 06:57 AM, said:

Pup Patrol, on 07 November 2011 - 04:06 AM, said:

Looks innocent and suspicious at the same time:

http://forums.Ground...0

How do you even find these?

I've developed an eye for the innocuous, generic-reply spammeroni. Can't count the number of times I've read a newly registered account replying "I like this idea" or "This is helpful", etc.

Quote

Here's my review of today's bot: I like the brief all-purpose quote, lack of invisible GIF, lack of punctuation and capitalization (which have been a huge problem for them in the past), and decent user name. I also like the single post, since a bunch of rapid-fire replies identify a bot instantly. They're refining the bots nicely, and GS seems to be a satisfactory testing grounds for them.

But there are plenty of issues: They're still posting in old topics, at random. Why not pick the most current, rather than digging up bones? They're posting at 2am PST, which I'm sure is a respectable hour in China, but it looks suspicious if you're trying to look like not a bot -- it's becoming kind of a fingerprint. And immediately posting upon joining GC, that's a huge red flag. And let's "humanize" and personalize -- the replies still look generated. The challenge is to make your reply look like a contribution to the topic, not just "I agree" style posts. And why no Profile activity now? It was a nice touch to have some of the member Profile filled out.

So the bots are looking much better, but they have a long way to go. I give it a 6.

cool.alfred, on 07 November 2011 - 02:48 AM, said:

this is a good idea

Ayup.

[Keystone]

So if a mod sees one of these suspicious accounts, and puts their post into edit mode to confirm there's no evil code, does anything else need to be done?

[GeoBain]

kunarion, on 07 November 2011 - 06:57 AM, said:

So the bots are looking much better, but they have a long way to go. I give it a 6.

cool.alfred, on 07 November 2011 - 02:48 AM, said:

this is a good idea

I give it a 2. A smart bot would post +1. You'd never notice that.

[kunarion]

Keystone, on 07 November 2011 - 12:36 PM, said:

So if a mod sees one of these suspicious accounts, and puts their post into edit mode to confirm there's no evil code, does anything else need to be done?

Make a note of the IP address.

I know it looks like I'm just making fun of the Spam bots, but it's no laughing matter. Remember the attack that grabbed thousands of peoples' account info on the Sony Game Network, and shut it down for over a month? This is the same thing.

So, anyway, let's just keep an eye on it.

[Pup Patrol]

It would be helpful if the spammette would post more than once.

IP address grab and check:

http://www.stopforumspam.com/

Even just googling the IP address can be productive. Seeing the same email address / username listed as being registered on forum after forum after forum, none of them of related interests, is a give-away.

Also, if you have access to the account's email address, you can check it on StopForumSpam also.

Not all the baddies are reported to StopForumSpam, but it's pretty helpful.

[knowschad]

Pup Patrol, on 07 November 2011 - 02:48 PM, said:

It would be helpful if the spammette would post more than once.

IP address grab and check:

http://www.stopforumspam.com/

Even just googling the IP address can be productive. Seeing the same email address / username listed as being registered on forum after forum after forum, none of them of related interests, is a give-away.

Also, if you have access to the account's email address, you can check it on StopForumSpam also.

Not all the baddies are reported to StopForumSpam, but it's pretty helpful.

Boy, those guys sure do get some nice email, don't they?

[hzoi]

kunarion, on 07 November 2011 - 02:02 PM, said:

Remember the attack that grabbed thousands of peoples' account info on the Sony Game Network, and shut it down for over a month? This is the same thing.

Ngaaaaah! All too well. Better not happen here.

[Pup Patrol]

Quick, get your dvd deals while they last:

http://forums.Ground...howtopic=285150

http://forums.Ground...howtopic=285149

[knowschad]

Pup Patrol, on 10 November 2011 - 05:38 AM, said:

Quick, get your dvd deals while they last:

http://forums.Ground...howtopic=285150

http://forums.Ground...howtopic=285149

Those aren't exactly subtle, are they?

[gspotter]

saw this in the news

http://www.bbc.co.uk...nology-15690187

http://www.wired.com...1/steam-hacked/

don't know if it is relevant or not.


edit: found another article

This post has been edited by gspotter: 11 November 2011 - 05:29 AM

[GOF and Bacall]

In to video games? http://forums.Ground...dpost&p=4893794

Looking for an iphone 4s? http://forums.Ground...dpost&p=4893795 or http://forums.Ground...dpost&p=4893797

[kunarion]

gspotter, on 11 November 2011 - 05:17 AM, said:

saw this in the news

That "Steam" thing is horrible. I had to sign up, install Steam software, fill out paperwork, then stay online all the time so it pops up "announcements" and software updates, all to play a one-player game. Electronic Arts has a similar thing. One purpose is to make sure I bought the software, and even if I did, they can reach into my computer and remove the game whenever they feel like it. It's like a bunch of hacker low-lifes designed an online game service. What could possibly go wrong. I feel all icky just having it on my PC.

I used to tell people not to download "free" hacked software, because you may unknowingly install Trojan Horse info-stealing software along with it. Well, now you're required to buy the Trojan Horse, since it comes with the $50 game.

If they require a bunch of my info before allowing me to play a game, their server security had better be rock-solid. Guess what. It ain't.

This post has been edited by kunarion: 15 November 2011 - 05:17 AM

[Pup Patrol]

Very odd spam, that I haven't reported:

http://forums.Ground...howtopic=285536

Well, that's different!

[knowschad]

Pup Patrol, on 16 November 2011 - 06:16 AM, said:

Very odd spam, that I haven't reported:

http://forums.Ground...howtopic=285536

Well, that's different!

Kidney Stones. I thought for a second there that it had something to do with Keystone.

[kunarion]

knowschad, on 16 November 2011 - 06:29 AM, said:

I thought for a second there that it had something to do with Keystone.

There is a 20 percent chance that you will get Keystones. Please to check on my following site of web for piece of readness.

[knowschad]

kunarion, on 16 November 2011 - 07:13 AM, said:

knowschad, on 16 November 2011 - 06:29 AM, said:

I thought for a second there that it had something to do with Keystone.

There is a 20 percent chance that you will get Keystones. Please to check on my following site of web for piece of readness.

You forgot to provide a link.

[GeoBain]

Need to teach that bot about bb code.

[kunarion]

GeoBain, on 16 November 2011 - 08:34 AM, said:

Need to teach that bot about bb code.

That's a durable bot there. It's been sitting around for over three hours. Maybe due to having no valid "link" to click?

I'd previously thought there was an automatic bot vac around here. Are they all removed manually after being reported and verified?

[knowschad]

kunarion, on 16 November 2011 - 07:13 AM, said:

knowschad, on 16 November 2011 - 06:29 AM, said:

I thought for a second there that it had something to do with Keystone.

There is a 20 percent chance that you will get Keystones. Please to check on my following site of web for piece of readness.

And then, pratz007, another sock, comes back with a correction to the link, assuring us that the site is a "real one".

[Pup Patrol]

kunarion, on 16 November 2011 - 09:20 AM, said:

GeoBain, on 16 November 2011 - 08:34 AM, said:

Need to teach that bot about bb code.

I'd previously thought there was an automatic bot vac around here. Are they all removed manually after being reported and verified?

I assume so. They do sit around until they are either reported or a Mod signs and sees them. then poof.

In the meantime, one spammy supports and helps the original spammette:

http://forums.Ground...6

too funny.

And these aren't bots....

[kunarion]

Pup Patrol, on 16 November 2011 - 09:24 AM, said:

one spammy supports and helps the original spammette:

http://forums.Ground...6

too funny.

And these aren't bots....

So people are doing the Bot work, personalizing it. Someone probably got in a heap of trouble for that malformed link (I wonder what the penalty is -- bet it's kinda severe). An actual person then had to create another GC account to correct the post. Congratulations on the promotion, Bot helper dude!

I don't know why Google isn't warning about the new Kidney Spam site. Maybe it takes a while to get added to Google's malicious site list, or maybe the malicious code gets added later (after things settle down, and the post has now helped to move the site up in popularity on Google).

This post has been edited by kunarion: 16 November 2011 - 09:46 AM

[kunarion]

Pup Patrol, on 16 November 2011 - 06:16 AM, said:

Very odd spam, that I haven't reported:

http://forums.Ground...howtopic=285536

Well, that's different!

That topic's still alive and kicking, kidney stones and all. OK, so a link to a not-yet-malicious site isn't anything. But why would a non-Geocaching topic still be active here, 24 hours later? Yes, I reported both Bots yesterday.

[knowschad]

kunarion, on 17 November 2011 - 06:17 AM, said:

Pup Patrol, on 16 November 2011 - 06:16 AM, said:

Very odd spam, that I haven't reported:

http://forums.Ground...howtopic=285536

Well, that's different!

That topic's still alive and kicking, kidney stones and all. OK, so a link to a not-yet-malicious site isn't anything. But why would a non-Geocaching topic still be active here, 24 hours later? Yes, I reported both Bots yesterday.

That IS odd!! Both of those user accounts are still open, as well.

This post has been edited by knowschad: 17 November 2011 - 08:50 AM

[Pup Patrol]

knowschad, on 17 November 2011 - 08:49 AM, said:

kunarion, on 17 November 2011 - 06:17 AM, said:

Pup Patrol, on 16 November 2011 - 06:16 AM, said:

Very odd spam, that I haven't reported:

http://forums.Ground...howtopic=285536

Well, that's different!

That topic's still alive and kicking, kidney stones and all. OK, so a link to a not-yet-malicious site isn't anything. But why would a non-Geocaching topic still be active here, 24 hours later? Yes, I reported both Bots yesterday.

That IS odd!! Both of those user accounts are still open, as well.

I've reported both of the oddballs again. Why is the topic still in existence?

Is someone brave enough to check out the link in er.jacob89's sig line:
http://forums.Ground...howtopic=285456

Again, a newly-created account posting an appropriate response, but something doesn't seem right.

[Pup Patrol]

Okay, that is a spammer, too.

Do a google search for "er.jacob89" and see what you get.

Classic spammer evidence.

[knowschad]

Pup Patrol, on 17 November 2011 - 09:03 AM, said:

knowschad, on 17 November 2011 - 08:49 AM, said:

kunarion, on 17 November 2011 - 06:17 AM, said:

Pup Patrol, on 16 November 2011 - 06:16 AM, said:

Very odd spam, that I haven't reported:

http://forums.Ground...howtopic=285536

Well, that's different!

That topic's still alive and kicking, kidney stones and all. OK, so a link to a not-yet-malicious site isn't anything. But why would a non-Geocaching topic still be active here, 24 hours later? Yes, I reported both Bots yesterday.

That IS odd!! Both of those user accounts are still open, as well.

I've reported both of the oddballs again. Why is the topic still in existence?

Is someone brave enough to check out the link in er.jacob89's sig line:
http://forums.Ground...howtopic=285456

Again, a newly-created account posting an appropriate response, but something doesn't seem right.

An exact copy of Clayshooter's response!

A: You can run a pocket query (PQ). You can also get instant notifications of new caches if you set up email notification.
B: You can run a pocket query (PQ). You can also get instant notifications of new caches if you set up email notification.

[kunarion]

knowschad, on 17 November 2011 - 09:26 AM, said:

An exact copy of Clayshooter's response!

A: You can run a pocket query (PQ). You can also get instant notifications of new caches if you set up email notification.
B: You can run a pocket query (PQ). You can also get instant notifications of new caches if you set up email notification.

Sheesh, I don't have time to do BOTH of those steps.

If you kill the bot (lock the post and the account), a fresh bot will arrive. Maybe we're on hold to test that no more appear while these bots are alive. I'd still like to see that Kidney link munged.

[knowschad]

kunarion, on 17 November 2011 - 10:02 AM, said:

knowschad, on 17 November 2011 - 09:26 AM, said:

An exact copy of Clayshooter's response!

A: You can run a pocket query (PQ). You can also get instant notifications of new caches if you set up email notification.
B: You can run a pocket query (PQ). You can also get instant notifications of new caches if you set up email notification.

Sheesh, I don't have time to do BOTH of those steps.

If you kill the bot (lock the post and the account), a fresh bot will arrive. Maybe we're on hold to test that no more appear while these bots are alive. I'd still like to see that Kidney link munged.

Well, I'm sure you saw my attempt at munging the link.

[ArcherDragoon]

I am still trying to figure out how a robot made of spam is a good idea...

[GeoBain]

ArcherDragoon, on 18 November 2011 - 08:16 AM, said:

I am still trying to figure out how a robot made of spam is a good idea...

Says the dragon made of cheese.

[knowschad]

GeoBain, on 18 November 2011 - 08:31 AM, said:

ArcherDragoon, on 18 November 2011 - 08:16 AM, said:

I am still trying to figure out how a robot made of spam is a good idea...

Says the dragon made of cheese.

zzzzzzzzzzzzzzzzzzzzzzzzzzzzING!!!!!!!!!!!!!!!!!!!!

[kunarion]

knowschad, on 18 November 2011 - 08:54 AM, said:

GeoBain, on 18 November 2011 - 08:31 AM, said:

ArcherDragoon, on 18 November 2011 - 08:16 AM, said:

I am still trying to figure out how a robot made of spam is a good idea...

Says the dragon made of cheese.

zzzzzzzzzzzzzzzzzzzzzzzzzzzzING!!!!!!!!!!!!!!!!!!!!

But the cheese dragon's head is missing. That's where the best cheese is.

[knowschad]

kunarion, on 18 November 2011 - 02:47 PM, said:

knowschad, on 18 November 2011 - 08:54 AM, said:

GeoBain, on 18 November 2011 - 08:31 AM, said:

ArcherDragoon, on 18 November 2011 - 08:16 AM, said:

I am still trying to figure out how a robot made of spam is a good idea...

Says the dragon made of cheese.

zzzzzzzzzzzzzzzzzzzzzzzzzzzzING!!!!!!!!!!!!!!!!!!!!

But the cheese dragon's head is missing. That's where the best cheese is.

He is trying to point out that he's not a cheesehead. (apologies to a certain caching team that might be lurking about)

[Pup Patrol]

Ooops....this one has been able to exist undetected for a while:

http://forums.Ground...ity&mid=5151440

What's the point of its existence? Why is it picking and choosing where to post its spammer-nonsense?

How many others are out there?

Who wants to report this one?

[The Blorenges]

Pup Patrol, on 21 November 2011 - 02:51 AM, said:

Ooops....this one has been able to exist undetected for a while:

http://forums.Ground...ity&mid=5151440

What's the point of its existence? Why is it picking and choosing where to post its spammer-nonsense?

How many others are out there?

Who wants to report this one?

That's a good one.

You ran it to ground - you report it.

MrsB