Being A Hacking Victim Is Not Always The Fault Of The Account / Blog Owner

Even though being the victim of a hacking attack is not (always) the fault of the account / blog owner, the blog owner may have to bear some of the responsibility.

Since hacking detection is a fuzzy process, it's not always going to be detected immediately. The previous article discusses what happens when Google does detect a hacking attack - and in some cases reacts too diligently.

If Google is not able to detect an attack, in some cases, an attack may be successful.

With some blogs, that are not updated frequently, a hacker may take control, and successfully hijack a blog.

Occasionally we see another report

I just discovered that my blog contains spam - and I can't access the dashboard, to clean the blog!

This may well be a successfully hijacked blog, discovered too late.

Unfortunately, the latter report may also be another devious attempt to steal control of somebody's blog. Blogger Support cannot, reliably, support hacking recovery, on an individual basis.

From what I can tell, Blogger / Google is working on the larger picture - making the automated detection process more reliable. Given this concern, Blogger / Google won't be frequently available to diagnose and return control of individual hijacked blogs - even when the issue is righteous.

In general, blog owners have to support themselves, and learn how to protect themselves. This may be yet one more reason why 2-Step Verification is becoming less optional.

>> Top

Empty Or New Blogs Can Be Classified As Possible Spam Hosts

We're seeing a few recent reports, in Blogger Help Forum: Something Is Broken, from owners of empty and / or new blogs, about spurious spam classification.

Very few owners of empty or new Blogger blogs understand why their blogs should be classified as possible spam hosts, by the Blogger anti-spam processes. Most blog owners seem to think that only blog content is considered, in spam classification.

Spam classification considers many characteristics of a Blogger blog, in classifying any blog as a possible spam host.

Blog content is an obvious - but not the only - factor in spam classification. Given previously observed behaviour of spammers, many characteristics of blogs, besides simply the extracted and analysed content, are used in classifying possible spam blogs. Using fuzzy spam classification techniques, one might also consider

• Overall behaviour in Google, by the owner.
• Past posting habits of the owner.
• Previous classification of similar blogs.

Some spammers are active in multiple Google activities and features. It's possible that some spammers even try to make their spam in Blogger harder to detect, by spreading their activity across other Google functions. Some spammers may not realise that spammy activity in other Google areas can be tracked, and included by Blogger spam classifications processes.

Blog owners who use one or more techniques involved in setting up and maintaining spam blog farms may be classified as spammers - and their blogs then classified as possible spam hosts. The term "blog owner" must itself be considered fuzzily, as some spam blog farms contain blogs owned by multiple Blogger accounts and profiles. Some Blogger accounts, similar to known spammer accounts - even with no blogs owned, or with empty blogs published - may then appear as possible spam hosts.

Empty blogs, that appear similar to blogs in known spam farms, may themselves appear as possible spam hosts. Various details such as blog name, blog design, and use of various blog accessories and features, can make a blog appear similar to known spam blogs - with no other content.

Given the need for Google to reduce the volume of spam blogs, fuzzy spam classification might use any of the above details, in classifying any empty or new blog as a possible spam blog. This will, unfortunately, lead to spurious spam blog detection. Given the ability of spammers to publish multiple blogs in the Blogger name space, classifying empty and new blogs is necessary, in making it possible for Google to keep up with spammy activity.

>> Top

Recovering And Protecting Your GMail Account

Blogger blog owners may have productive action, when their Blogger accounts are successfully hacked through an attack on their GMail accounts.

GMail account owners can get detailed instructions on recovering a successfully hacked account, and on preventing future hacking attacks from being successful. Some of the instructions are specific to GMail use - but overall, Blogger account owners will benefit from their use.

To benefit from the GMail instructions, one should consider the differences between Blogger, email, and Google accounts.

Gmail Account Recovery: Gmail Account Recovery and Security provides complete and detailed instructions for recovering a hacked and stolen GMail email account.

The Recovery instructions include specific mentions of Disabled / Suspended accounts, successfully Stolen accounts, and accounts locked or deleted because of Underage owners.

Accompanying the recovery advice is Gmail help and information: How NOT To Get Hacked. These are instructions for preventing a recurrence of a reported problem. This includes discussion of using a strong and secure password, identifying hacking techniques that involve the account owner, and preventing attacks which are conducted using the computer or network in use by the account owner.

The Prevention instructions, many which are common sense issues to any IT professional or security expert, are specifically written to apply to GMail account owners. There may be additional issues which apply in general, to Blogger accounts - and specifically, to Blogger accounts which are based on non GMail email accounts.

There are a few differences between Blogger blog ownership and GMail account ownership, which will cause issues that cannot be easily resolved by Blogger Support, or by GMail Support, to the satisfaction of the (former) blog owner.

GMail accounts are, by nature, single owner - and ownership of a GMail account is never transferred. In contrast, Blogger blogs can be under team ownership - and ownership can be transferred.

• Intentional team blog ownership. Team blog ownership can cause problems with loss of blog control, when all known blog administrators (accidentally or intentionally) remove themselves as administrators, leaving an unknown administrator.
• Intentional transfer of control. A blog owner may assign administrator status to another person, voluntarily - then later regret his decision.
• Un intentional transfer of control. A blog owner may assign administrator status to another person, voluntarily - and the other person may then remove the former owner administrator status.
• Ownership theft after account hacking. A hacker, having temporarily gained control of a Blogger account, may transfer ownership of a blog to another Blogger account.

All of these scenarios are regarded as simple transfer of blog ownership, by Blogger Support.

Though maybe not preferred by the (former) blog owner, the blog in question will now be under control of another person. It's possible that some of these scenarios are considered by Google Security, when reviewing Blogger / Google accounts after hacking activity is detected.

Blogger accounts, based on non GMail email addresses, will be subject to the typical uncertainty which accompanies any third party service in Blogger. Some details may be involve the email provider, while others will involve Blogger - and arbitrating between the two will be the responsibility of the Blogger account owner.

Owners of Blogger accounts which are based on non GMail email addresses will need to contact the providers of the actual email service, for resolution of some of these issues.

In general though, the GMail Account Loss Prevention and Recovery instructions provide good advice, for any Blogger account owner.

>> Top

Anonymity, Your BirthDate, And Your New Blogger / Google Account

Not all new Blogger blog owners understand why they are asked for their birthdate, when they setup a Blogger or Google account. Some folks see this as a violation of their right to privacy, and enter a fake birthdate. Some real serious privacy enthusiasts might enter "01/01/01", just to get through the setup process - maybe intending to correct it, later.

Nobody entering "01/01/01", for one's birthdate, suspects that claiming such a birthdate makes them - in 2013 - appear to be 12 years of age. Unfortunately, 12 years is below the minimum age for owning a Blogger blog. Since Blogger / Google tries to protect the young people on the Internet from inadvertently exposing themselves - or their families or friends - to unknown dangers, people who may appear to be of insufficient age are subject to having their Blogger / Google accounts, and Blogger blogs, deleted or locked.

If you entered a fake birthdate some time ago, and now find your account or blog locked or deleted, you need to prove your age to Google - and you should do this promptly. The Google Accounts document Frequently Asked Questions about Google Account and Age Requirements explains how you do this. The process of verifying your age / birthdate is not convenient - and some privacy enthusiasts may claim that it too violates their privacy rights - but it is necessary, to let you correct your birthdate - when you are legitimately of legal age.

Now, you have to hope that you did not, intentionally or mistakenly, also provide a bogus email account as your Blogger / Google account name / recovery email address. The process of identifying yourself as the owner (former, nominally underage) of a given Blogger / Google account is easier to do, when you have access to the email account stated as the account recovery email address.

>> Top

A Team Blog With No Administrators Is Given To The Authors, For Their Control

We have known, for a while, that every Blogger blog has to have at least one administrator.

That rule is enforced by the Permissions wizard, which gives any administrator the choice to demote or remove any administrator, from the Permissions list - but only when there is at least one other administrator in the list.

When the Permissions list is displayed, if there are at least two members with administrative authority, each administrator entry, in the list, has a link to demote or remove that member. If there is only one member with administrative authority, there is no such link - and that member can be neither demoted or removed from the list.

As long as only the Permissions wizard is used, to demote or remove administrators, this article would be meaningless (see the above link). But, there is another way for administrators to be removed - and this occasionally leaves blogs with no administrator.

If the only way to lose an administrator (or member) from a blog was by using the Permissions list to demote or remove, then the Permissions list setup, as described above, would be sufficient.

Unfortunately, the Blogger - and Google - account deletion processes don't consider the member lists for the blogs owned by the account. When a Blogger account is deleted, the fate of the blogs owned, by that account, has to be decided later.

Any blogs which have only one member (the owner) are either frozen or deleted - as with only one owner, there is no need to keep those blogs. Any blogs with more than one member simply lose that one member. But what if a blog has more than one member, but only one administrator - and that one administrator takes a hike?

With a team blog with one administrator, and one or more authors, losing the one administrator would leave a blog that was being published (by the authors), but could not be managed (because there was no administrator). This would, in the past, lead to panic in the forum.

The administrator for my blog deleted his Blogger account - and now my blog has no administrator! What do we do now?

With no administrator existing, Blogger Support would be summoned, and would have to determine whether a blog:

• Had no administrators.
• Had at least one author.
• Was being requested by a person who had a legitimate need to request control (a former administrator, or a current author).

Failure to ensure that each condition was being properly met could, with the right problem report, allow a hijacker to improperly assume control of someone's blog - with only Blogger Support to blame for enabling the hijacking.

To allow control recovery without needless delay, and avoid the need for endless detail in verifying any such panicky report, Blogger Engineering made a simple procedural change. The "Forgot your username or password?" wizard, when control recovery is requested for a blog with no administrator, simply sends the appropriate access tokens (aka "login instructions") to all blog authors - as long as the membership list is well maintained.

Any blog authors, able to receive the login instructions, then become de facto administrators - and can jointly determine the fate of the blog. The control recovery process can be automated, and the risk of possible hijacking of actively owned (administered) blogs is reduced. This simply requires that at least one blog author uses a Blogger account based on an active and genuine email address - and if necessary, can search persistently for the email sent.

When this reset process is done, each author of the blog initially has the same power as each of the other authors. Blogger leaves it to all authors to act honourably - and to politely choose one or more authors to be administrators. As long as the author submitting the reset process is able to locate the email message in his Inbox immediately, he can make himself the sole administrator - if he decides.

If one of the authors has problem locating the email, it's possible that the other newly appointed administrators could unwisely hijack control of the blog. If this happens, it will be up to the authors to jointly establish order. Blogger Support will not be involved in any conflict.

The more authors a given blog may have, the greater the chance that one author, receiving the email message, may act dishonourably, and hijack the blog. In cases where there are a large number of authors (precise number not known, right now), Blogger will defer to the author requesting the reset.

In this case, the author requesting the account reset can enter his email address, that is used by his Blogger account, to have the password reset email sent directly to him.

>> Top

If Your Blog Was Deleted, It's Good To Know Why

Of the many problem reports that we see in Blogger Help Forum: Something Is Broken, possibly the most ambiguous might be

My blog was deleted. How do I get my blog back?

The confusion, evidenced here, is normal - but overlooking the reason for the deletion can waste time - and delay or prevent getting the blog restored.

Any time someone reports a deleted blog, it's good to understand - and possibly verify - the cause of the deletion.

1. Was the blog deleted by the owner?
2. Was the blog deleted by Blogger - as a suspected abusive content host?
3. Was the blog deleted - because the owning Blogger account was locked by Blogger / Google?

Each of these possibilities can have different consequences - different recovery protocols - and different prognoses. To avoid wasting time - and affect the options for recovery - it's good to triage the diagnosis.

A blog deleted by the owner must be recovered by the owner. If the blog was deleted because the owning Blogger account was deleted, the owning account has to be restored, to start. And the time limit, for restoring a blog, deleted by the owner, is limited.

A blog deleted by Blogger, as a suspected abusive content (malware, porn, spam) host, must be reviewed and restored by Blogger. The good news here is that the review and restore process has, theoretically, no time limit for either initiation or completion.

A blog deleted by Blogger because of a deleted or locked Blogger account, likewise, has no time limit. However, there are two possibilities here.

1. If the Blogger account was locked for "suspicious activity", the account must be unlocked, following owner request - then the owner must wait, patiently, for the blog(s) to be verified and restored to service.
2. If the account was deleted, because of ownership of other blogs suspected as spam hosts, all blogs suspected must be reviewed.

Here, having the Blogger account associated with an active email account is a necessity, for finding the warning notices from Blogger, and deducing which cause contributed to the deletion. And, we see yet another reason for limiting your use of multiple email / GMail accounts.

Bearing in mind the limited time window for getting an owner deleted blog restored, it's a good idea to first identify all owner initiated deletions. If we wait for Blogger to review the blog, as a suspected spam host, and they respond with

The blog was trashed by the owner.

this won't help the owner when he realises

Oh yeah, I may have deleted it - last year (and over 90 days ago!).

>> Top