Being A Hacking Victim Is Not Always The Fault Of The Account / Blog Owner

Even though being the victim of a hacking attack is not (always) the fault of the account / blog owner, the blog owner may have to bear some of the responsibility.

Since hacking detection is a fuzzy process, it's not always going to be detected immediately. The previous article discusses what happens when Google does detect a hacking attack - and in some cases reacts too diligently.

If Google is not able to detect an attack, in some cases, an attack may be successful.

With some blogs, that are not updated frequently, a hacker may take control, and successfully hijack a blog.

Occasionally we see another report

I just discovered that my blog contains spam - and I can't access the dashboard, to clean the blog!

This may well be a successfully hijacked blog, discovered too late.

Unfortunately, the latter report may also be another devious attempt to steal control of somebody's blog. Blogger Support cannot, reliably, support hacking recovery, on an individual basis.

From what I can tell, Blogger / Google is working on the larger picture - making the automated detection process more reliable. Given this concern, Blogger / Google won't be frequently available to diagnose and return control of individual hijacked blogs - even when the issue is righteous.

In general, blog owners have to support themselves, and learn how to protect themselves. This may be yet one more reason why 2-Step Verification is becoming less optional.

>> Top

Anonymous Blog Ownership, And Hacked Account Detection

This week, we're seeing a number of reports from blog owners with Blogger accounts recently hacked.

I was asked to change my password, because of suspicious activity. Having done that, my blogs are now deleted!

With hacked Blogger / Google accounts, causing deleted blogs, there's not a lot of advice that we can provide.

As you just discovered, the account is recovered almost immediately. Blog recovery, unfortunately, takes longer - sometimes, 1 to 2 days. You'll have to wait, patiently, until your blogs are verified by Google Security staff.

We're also seeing the normal amount of reports of blogs deleted by Blogger, when detected for malware, porn, or spam. In some cases, blog review ends with the conclusion that the blog was not, in fact, deleted for a TOS violation. In these cases, the blog won't be restored by Blogger Support.

In some cases, blog review - which starts with a claim of spurious classification for malware, porn, or spam hosting - ends with advice to have the owning Blogger / Google account recovered.

The blog owner has to wait until the review process is complete, to learn where he should have started, days ago. As I've observed a few times in the past, anonymity - whether intention or accidental - can cause problems with blog ownership. If your Blogger / Google account is locked, but you don't get the required notification, you can waste valuable time with the blog offline.

Whether you intentionally anonymise yourself - or accidentally create a second (or third) Blogger account, you may not get essential email from Google, advising you to recover your account. When that happens, your blog will stay offline until it can be reviewed - and review starts only after you recover the account that was locked.

Now, you're going to have to open every possible email account, and carefully look for the overlooked email. If you never find the missing email message, you're going to have to login to Blogger, using every possible email address that you may have ever used, until you hit the locked Blogger account.

When you do identify the locked account, you'll get the advice to change your password, solve a CAPTCHA, and / or answer a number of secret questions, to prove that you are the account owner. Or, if you're lucky, you can await a phone call (digital or voice) with a special code, to unlock your account. Either way, you'll be unlocking the account while under stress, with the blog offline.

And after you get the account unlocked, you'll still have to wait until the blog(s) can be verified.

If you try to blame Google, for this disaster

Why was my blog deleted? I did not spam!

you will simply be wasting your time. This is yet one more story that starts with gratuitous and uncontrolled creation of multiple Blogger accounts and email addresses.

>> Top

Hacking Detection Is (Generally) Not The Fault Of The Blogger Account Owner

We've been helping Blogger blog owners deal with spurious fuzzy content classification, for many years.

We started out, long ago, with blogs deleted because of spam classification. Later, Blogger added malware classification - and most recently, porn classification ("adult content", with objectionable advertisements). These three classification categories involve fuzzy blog content analysis.

A fourth category, which similarly results in blog(s) being deleted, I describe as "hacking detection". This category complements the other three, because the primary symptom of all four are remarkably similar.

Help me! Blogger has deleted my blog!!

This is a frequent complaint, seen in Blogger Help Forum: Something Is Broken.

One problem with using the term "hacking" is that some account owners take this diagnosis personally.

Why do you mention hacking? I am not a hacker!

And in almost all cases, the owners are correct.

Blogs are deleted by Blogger, currently, because of several different reasons.

1. DMCA Violation.
2. Hacking detection.
3. Malware detection.
4. Porn detection.
5. Spam detection.

I list the different categories, collectively, because they are frequently reported, using the common symptom.

My blog was deleted, and I did not do it!

DMCA, malware, porn, and spam are generally based on what the blog owner did (though in many cases, what the owner "did" was simply to publish a blog). Hacking, on the other hand, is generally based on action by someone other than the blog owner.

DMCA, malware, porn, and spam classifications are based on content analysis (automated), or complaint (manual) - and these classifications can be somewhat avoided by the blog owner. Don't steal content or publish a blog containing malware, porn, or spam, to reduce your chance of having the blog classified.

Hacking detection, on the other hand, is based on analysis of Blogger account traffic - and this classification can not be avoided, as easily, by the blog owner. Hacking generally involves use of a cloud of computers, to systematically break into a Blogger account owned by the victim.

Though frequently, a hacking attack starts with unintentional disclosure of personal information by the victim, actual hacking activity is typically not initiated by the victim.

Detection of hacking attacks is best conducted by Google, because they can look for repetitive activity against multiple Blogger / Google accounts, from multiple computers located worldwide.

• Most account owners can login to their accounts in one or two tries.
• Very few account owners will, intentionally, attempt to login to their accounts, concurrently, from computers in Argentina, USA, and Zaire.
• Very few computers will be used to access Blogger accounts owned by people in Brazil today, in China tomorrow, and in Denmark next week.

Recovery from hacking detection requires willful action by the victim - though Blogger makes the required action so simple, its purpose becomes transparent. The victim, or account owner, is simply required to change the account password, solve a CAPTCHA, and / or verify account ownership by providing various personal details.

Having initiated hacking recovery, the account owner is able to login to Blogger - but is greeted by an empty dashboard.

You are not yet the owner of any blogs. Create a blog, and get started!

This is where the confusion starts.

Not all Blogger account owners personally publish a blog. Some people setup Blogger accounts simply to comment on, and / or Follow blogs published by other people - and won't, necessarily, publish a blog using the account in question.

Blogger accounts with no owned blogs may still be under attack by hackers - and are subject to hacking detection. This makes the primary symptom so confusing.

You are not yet the owner of any blogs. Create a blog, and get started!

People who don't own any blogs (under this Blogger account) may, or may not, see this as a problem.

In cases where the initial symptom is a deleted blog, the blog owner must recover the hacked (locked) account, before the blog can be recovered. This is one more scenario where unplanned, anonymous blog ownership, just causes more confusion.

Having initiated hacking recovery, a blog owner is simply expected to wait patiently, until the blogs owned by the account are verified as free of content added by the hacker. Unfortunately, we sometimes see the blog owner, impatiently reporting in Blogger Help Forum: Something Is Broken.

I had to change my password, and having done that, Blogger deleted my blog!

Sometimes, hacking detection starts with the Blogger account owner, repetitively trying to recover access to the account, by sequentially trying every possible password (sometimes trying the same password, repeatedly).

I know it's one of these! But which one? Did I maybe type the one, incorrectly??

This repetitive action looks the same as any malicious hacking attack - and that is why hacking detection is so hard to canonically diagnose.

Please, consider these details, the next time you post your problem report.

Help me! Blogger has deleted my blog!!

In some cases, I may respond with a mention of hacking detection. If I do that, please don't take my response as a personal attack upon you.

Why do you mention hacking? I am not a hacker!

Even though being the victim of a hacking attack is not the fault of the account / blog owner, that person may still have to bear some of the responsibility. In general, blog owners have to support themselves - learn how to protect themselves, and use 2-step verification.

>> Top