Some Blogger Blogs Being Locked As Malware Hosts, Because Of Malicious JavaScript

For a long time, we've been dealing with various malware / spam mitigation issues, in Blogger Help Forum: Something Is Broken.

Recently, malware detections, long simply identified as "Malicious JavaScript" in the well known Spam Appeal Guidelines, was given its own identity, and a separate classification / appeal process. We're now seeing several common types of JavaScript, included in blogs which are typically mentioned in forum reports.

It may be helpful to describe some examples of JavaScript code being seen, so blog owners can avoid making the same mistakes, by not including these scripts in their blogs.

There are 3 common types of JavaScript applications, found in many blogs with the owners requesting review / unlock action.

1. CPA / Cost Per Action.
2. Traffic Redirection, targeting other blogs / websites.
3. Traffic redirection, targeting the canonical URL for the host blog.

CPA / CPALeads / Cost Per Action, and similar online marketing terminology, involves providing a reward for viewing a blog, or for subscribing to the blog feed. Some CPA scripts may be used to collect email addresses, also known as "email address mining", later used for hacking activity or spam distribution.

CPA scripts present another problem. Since Blogger blogs are intended to reward the readers by providing interesting and unique content, blogs which use CPA may be improperly designed or maintained. Blogger wants the blog owners to publish blogs which entertain or inform their readers - not blogs which require artificial or ingenious techniques to generate traffic, and visitor activity.

Traffic Redirection, targeting other blogs / websites is a technique enjoyed by many hackers and spammers. The use of some blogs as gateways, leading to redistributors, which in turn lead to payload blogs or non Google websites, is part of many hacking / spam attacks. Google is trying to restrict the use of Blogger blogs as malware / spam hosts - and actively prevents scripts, which only shuffle readers from one blog to another, without choice.

Even though Blogger will not encourage you to move your blog, to Tumblr, Weebly, WordPress, or wherever, you are allowed to do this - if you feel the need.

Hello, faithful readers:

This blog is now hosted at my new blogging host. Please update your blog lists and bookmarks!

If you must do this, it's OK to post a notice, in your Blogger blog. You can even put a link, to the new blog, in the notice. You just can't use JavaScript, to automatically send the reader to the new blog.

Traffic redirection, targeting the canonical URL for the host blog, is a technique used by some blog owners who perceive Country Code Alias Redirection to present a problem. Some accessories installed on their blogs, and various non Google services which may be used to provide activity on their blogs, may not properly reference the canonical URL tag included in all Blogger blogs.

Since Blogger / Google wants all Blogger blog owners to benefit from improved world wide access to Blogger blogs, blogs which employ automatic canonical URL redirection may damage the effect of CC alias redirection. Blogs which host scripts which immediately redirect readers to the canonical URL, and are considered undesirable by any host government, may force an offended host government to block the entire Blogger service, in their country.

To prevent malicious misuse of Blogger by hackers and spammers, and to encourage effective long term use of Blogger by legitimate blog owners, Blogger / Google may detect any blogs which use these types of scripts as part of their general malware / spam classification strategy. Given the ability and willingness of the blog owner, to remove the JavaScript code in question, most blogs can be returned to service - but each blog will remain offline, until the removal is verified.

It's to everybody's benefit to identify, and to avoid use of, these scripts in our blogs, before it's too late. If your blog contains one of these scripts, why not remove the problem now, instead of waiting until you too have to post your problem report, in the forum

Help me! My blog was just locked for

MALICIOUS JAVASCRIPT

What do I do, now?

>> Top

Malware Classification, And Country Code Alias Redirection Bypass Code

We're seeing a few complaints, in Blogger Help Forum: Something Is Broken, about overly aggressive malware classification, from blog owners who only want to publish their blogs without fear of side effects from the controversial feature, Country Code Alias Redirection.

Spurious malware / spam detection is a painful topic to discuss - and it's even more so when the question of country code alias redirection is discussed. Like auto pagination long ago, country code alias redirection appears to be another case of Google manipulating its customers, maliciously. If you consider this issue from the viewpoint of Blogger blogs in general, though, you may see the full picture.

Blogger blogs, like the Internet, need to be available to all countries in the world, without fear of censorship. Country Code Alias Redirection allows Blogger to selectively disable any single blog, in any single country. This selective disabling will, eventually, eliminate the need of any country government to block the entire Blogger service, in their country, because of a few unsuitable blogs.

Country Code Alias Redirection is a righteous feature in Blogger blogs. Like many new Google features, it was added before every Internet service was made able to support it. CCAR uses an Internet standard - not a Google proprietary feature - the canonical URL tag. If you look at the header in this blog, you can see an example of a canonical URL tag.

<link href='http://blogging.nitecruzr.net/2013/02/malware-classification-and-cc-alias.html' rel='canonical'/>

That's the tag for this article, for instance.

Some Blogger blog owners find that CCAR causes problems, with some accessories on their blog. Some owners have added anti redirection code to their blogs, so the accessories on their blogs continue to work. CCAR may not work with every third party provided blog accessory or Internet service - because all Internet services, and third party accessory providers, are not yet aware of canonical URL tags.

Just because some people are not up to date with all Internet features (like CCAR), this does not mean that CCAR should not be used. The people involved need to be encouraged to update their accessories, and their services, as necessary.

Right now, some blogs which include anti redirection code are being spuriously detected as malware hosts - and this is more controversy. The anti redirection code looks like malware, because similar code is used by people to abuse our blogs. To not classify blogs attempting to disable CCAR, would require the malware classifier to identify the intent of the blog owner - and would make malware detection more complicated.

Identification of intent is not present in computer software, right now. That ability will be available only when computers truly are programmed to "think" - and when that happens, it may be the end of the human race as we know it.

Since CCAR is a righteous feature, it's possible that anti redirection code actually should be treated as malware - even though the blog owners, adding the code to their blogs, may not consider this to be the case. Those of us who are concerned with detection and removal of malware and spam from the Internet, in general, know that malware and spam is like a cancer - if you don't remove what you see, it's only going to get worse.

To allow anti redirection code to be installed in some Blogger blogs, will encourage other blog owners to do the same. Also, it will allow some hackers and spammers to do likewise, without fear of detection. Neither of these possibilities is good for Blogger blogs, in general.

If you installed anti redirection code in your blog some time ago, your blog was just locked as a suspected malware host. and you are now anxiously waiting for malware review while your blog remains offline, we're sorry for you. But you are not being abused by Blogger - nor is your malware classification unfair.

Remove the anti redirection code, on your blog - now, while you are able. Encourage the providers of third party accessories and Internet services to update their code. And don't allow or encourage hackers and spammers to abuse Blogger blogs, or the Internet in general. Please.

>> Top

Country Code Aliases Are Not In Use, In All Non USA Countries

One source of confusion, about the occasionally misunderstood country code aliasing of BlogSpot published blogs, comes from the way the aliasing is being installed, world wide.

Country Code Aliasing is a new feature - and it's still being tested. Since it's being tested, it's not being immediately installed in all countries, world wide - and this will cause confusion, until it is fully installed.

Google is installing Country Code Aliasing, one country at a time, as convenient to them.

Google is providing no notice, before - or after - any given country is being added, as an alias to "blogspot.com". This is a standard technique used in Information Technology environments - it's not new or unique to the Blogger / Google Country Code Aliasing feature. It's called by various names, in different companies. Some call it phased installation, others pilot testing, and others may have other names.

What it means - simply - is that not all blog owners will see the same effects, as the new feature is installed, in every country, as each new country is added. Every different blog will have a differing reader population, distributed over different countries. Readers in some countries - where aliasing is active - will see different results than readers in other countries, where aliasing is not active.

Combining the different content in every different blog, which makes some blogs more or less susceptible than other blogs to the effects of aliasing, with the different reader population, not any two blog owners will see the same problems, or have the same opinions, about aliasing.

Until every blog owner realises several details about aliasing, we're going to keep hearing complaints.

• Country code aliasing is not optional.
• Country code aliasing has a real purpose.
• Country code aliasing is beneficial to all of us.

We'll all just have to deal with the problems, one country at a time. We'll need to ask our readers, one crucial question.

What exact URL is displayed, by your browser, when you observe the problem?

And, we'll have to observe the difference between "blogspot.com", "blogspot.co.uk", and "blogspot.fr".

>> Top

Country Code Aliases Cannot Be Bypassed, Productively

Occasionally we see the innocent query in Blogger Help Forum: Something Is Broken, about the recently introduced Blogger feature - country code aliasing.

Is there any way I can opt out from this constantly changing of the .com termination, into .be, .bg, or .ro, depending on where I travel?

Not many Blogger blog owners realise the benefits of country code aliasing, which is, like auto pagination, a feature which is not optional. There are publicly available workarounds, which may bypass the effects of country code aliasing - and which may cause more trouble than simple URL confusion.

Many spammers would love to setup gateway blogs, and automatically redirect their unwitting victims to other blogs (or non Blogger websites) which contain their actual hacking, porn, or spam payload. Blogger / Google, like some browsers and security programs, actively prevents automatic redirection of Blogger blog traffic.

Not all blog owners understand the effect of Blogger malware classification. Similar to spam classification, malware classification actively scans through Blogger blogs, looking for signs of malware. Here's an example - a very simple code snippet, recently discovered in the header of the template, in a blog which has been repeatedly locked for "Malicious JavaScript" / "Spam".

var·blog·=·document.location.hostname;
var·slug·=·document.location.pathname;
var·ctld·=·blog.substr(blog.lastIndexOf("."));
if·(ctld·!=·".com")·{
var·ncr·=·"http://"·+·blog.substr(0,·blog.indexOf("."));
ncr·+=·".blogspot.com/ncr"·+·slug;
window.location.replace(ncr);
}

To prevent malware detection here, I'm omitting the essential opening and closing tags, which would normally encase the code snippet.

<script·type='text/javascript'> ... </script>

If your blog contains similar redirection code, to bypass country code aliasing, you may get a notice, one day, that your blog has been deleted for "Malicious Javascript". In order to get the blog restored, so your readers may view it, you may have to remove the Malicious JavaScript - then wait until the blog can be reviewed, to ensure that it is safe for public visibility.

You will accomplish more, and cause yourself (and your readers) less pain, by learning to live with country code aliasing - and concentrating on convincing the various search engines and other Internet services to accept Canonical URLs, so country code aliasing will work, seamlessly, with the Internet service which interests you. Alternately, use better designed gadgets and Internet services.

>> Top

Blogs, Written In Non Roman Character Languages, Have Trouble With Publishing Static Pages

We're seeing a few reports in Blogger Help Forum: Something Is Broken, from owners of blogs which publish in languages that don't use Roman characters, about problems publishing static pages in their blogs. Supposedly, with the affected blogs containing multiple static pages, the pages are all being published with the same URL.

The problem is thought to involve blogs published using the New Blogger GUI. Hopefully, by switching back to the Classic Blogger GUI, the problem can be worked around, until Blogger Engineering can diagnose and fix the problem.

We have a Rollup Discussion in Blogger Help Forum: Something Is Broken, where we are asking for details, from owners of blogs affected.

1. What is the URL of your blog?
2. In what language is the blog published?
3. Are you using the New Blogger GUI?
4. If you switch back to the Classic GUI, does that resolve your problem?
5. In what city / province / country do you live?

Please answer as best you are able, to improve chances of Blogger Engineering finding and fixing the problem, as promptly as possible.

>> Top

Confusion Over Reason For, And Effect Of, Country Code Aliases

Some blog owners are a bit confused about why Google developed the Country Code based "blogspot.com" aliases - and what effects the aliases have.

Similar to the earlier confusion about our email addresses displayed in the navbar, a few blog owners, publishing "mybloggerblog.blogspot.com" (for instance) see their blog displayed as "mybloggerblog.blogspot.co.uk" (when they live in the UK), and think that the whole world now knows that this blog, "mybloggerblog.blogspot.com", is published by someone in the UK.

Not everybody, living in the UK, and seeing the blog as "mybloggerblog.blogspot.co.uk", may realise that people in France see it as "mybloggerblog.blogspot.fr", people in Italy see it as "mybloggerblog.blogspot.it", and so on. This is a problem, because some blog owners prefer to keep their country of residence a secret, from their readers.

Of the people who know about the worldwide distribution of the Country Code aliases, not everybody understands their actual purpose. And, not everybody sees aliasing, even when they live in countries outside the USA.

Not too long ago, many Blogger blog owners - not just those publishing to "blogspot.com" - knew of the legendary Great Firewall Of China.

The Chinese government, fearful of their citizenry being able to read the various blogs and web sites all over the Internet, had decided that Blogger blogs were particularly "dangerous" to the Chinese way of life - and had forced all Chinese ISPs to block all Blogger blogs from being accessed, by any Chinese Internet customer.

In 2010, the Turkish TV Network DigiTurk, angry at one Blogger blog owner and his illegal distribution of DigiTurk owned content in his blogs, convinced the Turkish government to issue a court order blocking all Blogger blogs from being accessed in Turkey. From time to time, the Thai government, displeased by some Blogger blogs, has had Blogger blocked in Thailand. Other countries have had similar experiences.

Before the existence of Country Code aliases, Google has, effectively, had only 2 alternatives, when faced by a displeased government.

• Remove one or more offensive blogs, by deleting them. Any blog owner faced worldwide loss of his blog, if he offended any one government.
• Face having their service blocked, for all Blogger blogs, in a country with an offended government. All Blogger blog owners faced having their blogs unavailable, to their readers in any country with an offended government.

Given the possibility that virtually any Blogger blog has the potential to offend somebody, somewhere in the world, this occasionally left Google between a rock and another rock.

The various governments faced another dilemma - again, just 2 alternatives.

• Observe the demands of a small but economically vocal minority, such as DigiTurk, and ignore the wishes of their citizenry in general.
• Ignore major content providers, such as DigiTurk - and face possible retaliatory service interruptions by them.

By developing Country Code aliases, Google now has a third possibility. Any offended government can simply produce a properly issued court order, and require the removal of any specific blog - in their country only. Blogger can block one specific blog, in one specific offended country, by flagging the specific alias of that blog, in the BlogSpot database.

• The owner of an offending blog sees the blog blocked in one specific country only, and accessible everywhere else in the world. No more complete blog deletions, for cultural or political offenses.
• Blogger can block specific blogs, in specific countries. The Blogger service can remain accessible, in all countries.
• The various governments can have specific blogs blocked, in their countries. The Blogger service can remain accessible, in their country.

This is truly a Win - Win - Win (Blog owners - Blogger / Google - Governments of the world) scenario.

If the governments of the world are given this alternative, they will become used to getting court orders identifying specific offensive blogs, and to dealing with Blogger / Google on a single blog basis. This will be easier on the various politicians, who (right now) have to justify to their "customers" (the citizens) why they are blocking such a popular service. Yes, almost surely every politician, even the ones in "dictatorships", have to respond to angry citizens (maybe, their kids or wives?), occasionally.

Maybe even some politicians, growing weary of repeatedly getting yet one more court order ("Why am I doing this? The game starts this evening - I'm going home now!"), will start to feel like Sisyphus, and will realise how silly all of it is. Yes, we can dream.

Yet, there are challenges, with this strategy.

• Blogger blog owners need to know when to ignore the aliases - and how silly it is to add useless code to their blogs, in attempting to bypass the aliases.
• Search engines need to know how to observe the aliases.
• Services such as FaceBook need to know how to observe the aliases.

Google is not yet finished, in developing and publicising this feature. The Blogger Help FAQ Why Has The URL Of My Blog Changed? isn't going to become redundant, any time soon.

>> Top

A Template For Virginia USA, #4

As the frustrations about the CC TLD aliases continue to be reported in Blogger Help Forum: Something Is Broken, and some of the details are discovered and resolved, we are seeing suggestions of other, more subtle problems.

Some blog owners claim that their page rank / search engine reputation has taken a nose dive, because their readership is spread out over many different countries. Apparently, canonical resolution by the search engines does not work, for all "blogspot.com" published blogs. Older blogs, including those with Classic (HTML based) templates - and possibly some older Layout templates - seem to lack canonical resolution.

The canonical resolution process, by the search engines, requires a canonical tag which defines the base URL of the blog. Blogs with older templates don't have the canonical tag in the template header - and the search engines can't aggregate the CC alias URLs generated by the many different country code references.

Any blog, indexed by the search engines, separately, under the different CC TLD aliases, is going to have a lower overall search reputation. The different references, under the many aliases, will be indexed - but as each will be more diverse, each reference will appear lower in SERP lists. This will result in less search engine related traffic - and subsequently still lower SERP positioning.

If your blog depends upon search engine generated traffic for publicity, and you have an older blog, you are going to want to check the template header.

<link href='http://blogging.nitecruzr.net/' rel='canonical'/>

If you do not find a similar tag in the template header for your blog, you need to upgrade your template. Your readers will thank you, too.

>> Top

Attention Canadian Blog Owners: The URL Of Your Blog Is "BlogSpot.com" - NOT "BlogSpot.ca"

We have a number of blog owners, apparently located in Canada, who have been sharing their "blogspot.com" published Blogger blogs, using the "blogspot.ca" alias. This week, two major services - FaceBook and McAfee Anti-Malware, have decided that links mentioning "blogspot.ca" are not trustworthy.

Use of the Country Code aliases - of which "blogspot.ca" is simply one of many - has provided potential for confusion, for some time. What some blog owners may not realise is that only the online viewers of the blog (and the owners, viewing their own blogs) see the "blogspot.ca" alias - and only when they are located in Canada. At the same time, people in Malaysia see their blog (and other blogs, published to "blogspot.com") as "blogspot.my", people in Mexico see their blog as "blogspot.mx", etc.

Thanks to the use of the canonical URL, specified in the blog header, the search engines index "blogspot.com" published Blogger blogs, consistently, as "blogspot.com".

It's possible that FaceBook and McAfee have tightened down on their link validation criteria. Noting that the "blogspot.ca" alias is not indexed by the search engines, they may simply be objecting to people posting links that have no reputation. Multiple people posting links without reputation could be seen as an organised link spamming campaign - and FaceBook has reacted.

Why FaceBook (social networking), and McAfee (anti-malware), seem to have changed their criteria simultaneously, remains to be seen.

For immediate concern, we see many Canadian blog owners with massive amounts of previously posted FaceBook links, pointing to "blogspot.ca". Unfortunately, this may be an issue which the blog owners need to discuss with FaceBook.

>> Top