Social Icons

Pages

Showing posts with label False Positives. Show all posts
Showing posts with label False Positives. Show all posts

Saturday, 14 December 2013

Blogger Blog Content Needs To Be Unique, And Properly Targeted

I've been studying spam, in Blogger blogs, for over 5 years.

This year, we've seen improvement in the automated spam classification process, implied by a noticeable reduction in spam review requests overall - and in a considerable reduction in the proportions of false positive classifications. During the past few months, blogs requested for review are 2 or 3 times more likely to be confirmed as legitimate spam blogs (true positives), compared to this time last year.

Of the blogs confirmed to be spam hosts, when I am able to examine cached copies of the content, 3 out of 4 of those appear to contain material scraped or syndicated from other blogs or websites.
  • Content scraped (stolen), or syndicated (copied, with permission), from other blogs / websites. Content scraped or syndicated to other blogs / websites.

Google describes the problem, in Blogger Help: Spam, phishing, or malware on Blogger, quite simply.
Spam blogs cause various problems, beyond simply wasting a few seconds of your time when you happen to come across one. They can clog up search engines, making it difficult to find real content on the subjects that interest you. They may scrape content from other sites on the web, using other people's writing to make it look as though they have useful information of their own. And if an automated system is creating spam posts at an extremely high rate, it can impact the speed and quality of the service for other, legitimate users.

Long ago, spam blogs were first encountered as startup components in large spam blog farms.

Later, we explored the involvement of various "get rich quick" schemes, and of affiliate marketing.
  • Content or links which reference referral-based activities such as GPT ("Get Paid To"), MLM ("Multi-Level Marketing"), MMF ("Make Money Fast"), MMH ("Make Money from Home"), PTC ("Pay To Click"), or PTS ("Pay To Surf").
  • Affiliate marketing (Please, don't confuse this with "affiliate networking"!).

Of these three broad descriptions of confirmed spam blog content - spam blog startups, get rich quick schemes, and affiliate marketing - the one common feature in most of the blogs, confirmed as spam hosts, seems to be the lack of unique content. One of the features of the Panda update to Google Search was described as "content quality" in search results.

The past year tuning to Blogger spam classification appears to be in keeping with Panda, in that it is targeting blogs which rely upon content intentionally replicated from blog to blog - whether "scraped" (stolen, without permission), or "syndicated" (copied, with permission).

The end result here is that Blogger blogs, to avoid spurious spam classification, need to contain as much unique material as possible. While some amounts of quotation of other blogs and websites is beneficial, the majority of blog content needs to be written by the blog owners and contributors, and properly targeted to the reader population.

>> Top

Wednesday, 6 November 2013

Comment Notification Email, And Spam Classification

Comment moderation, and comment notification, have long been optional features of Blogger Commenting.

The sequence of comment moderation email, and comment notification email, was simple.
  • If comment moderation was selected, moderation email was sent to all blog administrators. Any one administrator could then select to Publish, or to Reject, a given comment.
  • If comment moderation was not selected, each comment was simply Published, immediately.
  • If comment notification was selected, notification email was sent to all recipient email addresses, when any comment was published.
  • All blog administrators could Delete any comment, after it was published, at their discretion.

When the new comment moderation system was provided, in 2010, comment moderation changed. As the comment filters became trained, some comments were automatically rejected - and sent to the Spam queue - and that is where the current problem starts.

With the new comment moderation system, spuriously filtered comments never generated notification email - and this was a problem.

Comments sent directly to the Spam queue could be moderated, and Published, at the discretion of the blog administrators. Comments which were not Published remained in the Spam queue - and never generated notification email.

As the filters in the new comment moderation system became trained, false positives became a problem. Comments, spuriously filtered as Spam, generated no notification email.

Blog owners, accustomed to moderating comments after they were published, and receiving no notification email from comments which went straight to the Spam queue, complained of lost comments.

Listening to complaints from the blog owners, Blogger Engineering changed the sequence of the comment moderation and notification emails.
  • If comment notification is selected, email is sent to all recipient email addresses, as soon as a comment is submitted for publication.
  • If comment moderation is selected, moderation email is sent to all blog administrators.
  • All blog administrators can Delete, or mark as Spam, any comment, before or after Published, at their discretion.

With comment notification email being sent immediately, this leaves recipients of the email occasionally confused. Comments immediately judged as Spam by the filters, or later by a blog administrator, will still generate email.

Recipients of comment notification email, not seeing a given comment published, who are blog administrators, can check the Spam queue - and in some cases, choose to Publish a comment which is spuriously filtered as Spam. This helps to train the filters - and later, see less spuriously filtered comments.

Recipients of comment notification email, not seeing a given comment published, and who are not blog administrators, will have to notify a blog administrator, who can check the Spam queue. In some cases, again, the administrator can choose to Publish a comment that is spuriously filtered as Spam.

As a blog owner, you need to properly select the moderation and notification options, to satisfy your personal needs. And, help to train the filters.

>> Top

Thursday, 27 June 2013

"Adult Content" Blogs, And New Blogger Monetisation Restrictions

This week, we're seeing some reports from a few blog owners who recently received a disturbing email message, mentioning their blogs and adult advertisements.
I received an email stating I have adult content on my blog, and that a new policy will cause certain blogs to be deleted. Is my blog vulnerable to deletion, under this new policy?

Like many spammers, these blog owners may be asking for a whitelisting of their blog - which is something that Blogger just won't provide.

The legendary email, recently received, is somewhat ambiguous in wording.
You are receiving this message because you are the admin of a blog hosted on Blogger which is identified to have Adult content.

Please be advised that on June 30th 2013, we will be updating our Content Policy to strictly prohibit the monetization of Adult content on Blogger. After June 30th 2013, we will be enforcing this policy and will remove blogs which are adult in nature and are displaying advertisements to adult websites.

If your adult blog currently has advertisements which are adult in nature, you should remove them as soon as possible as to avoid any potential Terms of Service violation and/or content removals.

The policy discouraging monetised "adult content" blogs is not new - we have actually been warning people about this for years, in the Malware / Spam Appeal Guidelines. We cite the Guidelines a dozen or so times daily, in various malware and spam review discussions in Blogger Help Forum: Something Is Broken.
Blogger / Google has repeatedly stated that some blog content is not acceptable, because it constitutes or encourages abusive activity, such as hacking, porn, and spam, in the Blogger Internet space.

Here is the current list of examples, developed by Blogger / Google, and the Top Contributors of Blogger Help Forum.
  • Affiliate marketing (Please, don't confuse this with "affiliate networking"!).
  • Automated traffic redirection, to another Blogger blog, or to non Google hosted content.
  • Commercially funded adult content.
  • Content created with scripts and programs, rather than by hand.
  • Content or links which reference account hacking / password distribution / password sharing.
  • Content or links which reference code deconstruction / reverse engineering, to bypass normal use of proprietary
  • software.
  • Content or links which reference referral-based activities such as GPT ("Get Paid To"), MLM ("Multi-Level Marketing"), MMF ("Make Money Fast"), MMH ("Make Money from Home"), PTC ("Pay To Click"), or PTS ("Pay To Surf").
  • Content scraped from other blogs / websites.
  • Copyright Infringement.
  • Large blogs with multiple, unfocused / unrelated subjects.
  • Links to Illegal Downloads / Streaming / Torrents.
  • Monetizing of adult content, aka porn spam.

The specific blogs, targeted by the email, are not difficult to identify. "Adult Content" blogs will generally bear an interstitial "Content Warning", awarded either voluntarily or involuntarily.

In odd cases, people may receive the email, but may not have any blogs affected by the policy - and in this case, they will simply have to ignore the email. Blogger Support can only review blogs, when they are actually deleted or locked.

In other cases, people may not receive the email. Just as with malware and spam classifications, all blog owners won't be contactable by email.

If the adult content classifier is designed similar to the malware and spam classifiers, it will use a fuzzy detection process to identify the undesirable "adult content" advertisements.

Since fuzzy malware / spam classification does not support whitelisting, porn classification won't either. Blog owners asking "Is my blog safe?" are unlikely to get any useful answers.

My suspicion is that owners of the most popular and productive "adult content" blogs will move to alternate hosting. Some of them may relocate to WordPress - until WordPress, similarly, rejects them.

Some owners, choosing to remain in Blogger, will take the warning seriously, and remove any ads.
If your adult blog currently has advertisements which are adult in nature, you should remove them as soon as possible as to avoid any potential Terms of Service violation and/or content removals.
Various possible "adult content" blogs, with and without "adult advertisements", remaining in Blogger hosting, will be classified and deleted, and will result in more reports in Blogger Help Forum: Something Is Broken.
Why was my blog deleted?

We'll simply end up with more discussions with requests for review and reinstatement - and more uncertainty. Some blogs will be restored promptly, with others requiring careful deliberation. And some blog owners will simply be told
Sorry, your blog cannot be restored. It was recently confirmed as a adult content host, with unacceptable advertisements.


>> Top

Saturday, 19 January 2013

Third Party Gadgets And Recent Malware Detected Blogs

Earlier this week, we noted an increased level of activity in reports about blogs locked as suspected spam hosts, in Blogger Help Forum: Something Is Broken. Upon review of the increased volume of spam referrals, with the majority of the cases found to be spurious, Blogger Support provided advice, about a new reason for deleted blogs.
Yesterday, our malware detection system began receiving reports of malicious content on some blogs. While the blog content on many of these blog may be malware-free, 3rd party widgets on these blogs may contain malware.

When a blog is locked for hosting malicious third party gadgets, the blog will be present in the dashboard "Deleted blogs" list - and should be unlocked, on the spot, using the "Restore" option in the list.

The Known Issues advice continues, and describes a planned action.
We’re currently in the process of contacting all blog owners with instructions.

Until Blogger Engineering comes up with an automated contact procedure, owners of blogs which are deleted by Blogger may do well to check their dashboard "Deleted blogs" list, before asking for spam review in the forums.

Owners who find their blog listed, in "Deleted blogs" will be able to immediately restore the blog in question. Having restored the blog, it will be accessible in the "Locked blogs" list - where only the administrators can access it - and remove any possibly malicious third party gadgets, which may have been recently installed. So far, we've seen problems reported withAll of these are known to trigger malware classification, and cause locked blogs. While the blog is in "Locked blogs", it will remain offline, and inaccessible by readers and search engines.

Once all malicious / unsafe accessories and tweaks have been removed, the owner can submit the blog for unlock review, using the "Request Unlock Review" button in "Locked Blogs". Given a successful review, the blog will be returned to the main "My blogs" list, and restored to service.

Once malicious accessories and tweaks have been removed from the blog in question, it's a good idea to not reinstall them. Repeated detection will lead to Blogger account termination, similar to the penalty for repeated DMCA violations.

There are several reasons why all owners of such blogs may not see their blog listed, in a dashboard list. Owners of these blogs will still be obligated to report their problem in the forums - and to patiently wait while Blogger Support can restore their blogs.

The latter scenario will provide one more example while poorly planned anonymous blog ownership is not a good idea.

>> Top

Monday, 7 January 2013

We Are At The Mercy Of Every Anti-Malware Protection Program Imaginable

We see reports, from time to time, in Blogger Help Forum: Something Is Broken, about blogs which people can't read, from their computers.
One of my readers claims that I have a virus on my blog. He provided the following information:
AVG anti-virus detected the following threat on the site:
File Name: www.mydomain.com/favicon.ico

Threatname: Exploit Black Hole Exploit Kit
How do I fix this?

Similar to the many reports that we process here, about spurious spam classification, the above report is frequently determined to be a false positive. An anti-virus alert, even if a false positive, is generally not as simple to resolve as a spurious Blogger spam classification, though.

One of the frustrating problems with false malware alerts is that they come from so many different anti-malware products.

I've contributed my opinion about computers, and the suggestion that no two privately owned computers are identical, many times. One way which many computers vary is the complement of security software, which is chosen by each different computer owner.

At any time, any different anti-malware product may decide that some component of your blog is unsafe.
  • Maybe, a single file mentioned in your blog code (as above, "favicon.ico") is suspect.
  • Maybe, content hosted by "blogspot.com" is unsafe.
  • The code may be an accessory that we added, intentionally.
  • The code may be content in another blog - hosted by your blog in a bloglist, a linklist, or maybe in the Reading List on your dashboard.
In either case, you (or your reader) won't be allowed to view the blog - or may be allowed to view the blog, but given a stern warning which very few chose to accept.

Like many problems with layered security, any malware detection can come from
  • A native browser filter.
  • A filter in a browser add-on.
  • A filter installed on the computer.
  • A filter in a network appliance.

Listen to your computer. some time. Your anti-virus protection may update automatically - and may audibly announce the update. On a typical day, I hear the Avast client on my several computers announce an update, several times - and I am not (contrary to some misconceptions) seated in front of my computer on a 24 x 7 basis.

Avast (my personally and professionally recommended choice, to many people) is only one of dozens of various anti-malware products which receives automatic updates, when the host computer is online. Any one of these products may be updated, at any time -and somebody's access to your blog (or my blog) becomes blocked.

If you get a message from one of your would be readers
I can't view your blog!
this could be someone reporting that your blog just went offline, for one reason or another - or it can be someone just discovering that the anti-malware program, on his computer, has decided that BlogSpot hosted content is unsafe. In either case, there is not a lot that you can do, except wait it out - and concentrate on the readers who can access your blog.

>> Top