Team Blog Ownership, And Abuse Classification

We see some people, posting in Blogger Help Forum: Something Is Broken, who have problems with blogs under team ownership, and abuse classification.

My blog was deleted as spam but I don't spam! BTW, one of the other administrators of my blog recently had his Google account blocked.

We've observed, a few times, that team blog relationships create interesting complications, with various Blogger issues - and this appears to represent yet one more complication.

In most cases, when a Blogger account or blog is deleted or locked, the owner of the account or blogs affected should see an online notification, and / or receive email informing of the action taken.

There are several reasons why notification - email or online - may not always be provided.

• Blogger accounts, based on bogus or inactive email addresses, will not provide email notification.
• A person who uses multiple Blogger accounts, accidentally or intentionally, will only see the dashboard for the account currently logged in.
• An owner of a Blogger account, recently unlocked after detected suspicious / unusual activity, will see only an empty dashboard, when logging in.

The team blog ownership relationship appears to provide one more reason for lack of notification.

• Administrators of blogs under team ownership may not see notification, when one of the team members has a Blogger account deleted or locked.

Both Blogger accounts deleted for non repentant abusive activity, and Blogger accounts locked when suspicious / unusual activity is detected, appear to present this complication, with blogs under team ownership.

When a Blogger account is deleted after the owner repeatedly produces TOS violations, all blogs owned by the account are apparently deleted. It's possible that, when a blog is deleted, team ownership issues are overlooked in the blog deletion process - and the blog simply disappears from the dashboards of the other team members. It's also possible that this is a predictable group action - comparable to affiliate network detection.

When a Blogger account is locked after suspicious / unusual activity is detected, all owned blogs simply disappear from the dashboard of the owner. Blogs owned by a locked account are under automatic security review, with no appeal by the owner being possible. Team administrators are unlikely to have any alternative appeal opportunity, for a blog under review when an owning account is locked.

The latter two scenarios represent two reasons why, if we see the complaint in Blogger Help Forum: Something Is Broken

My blog has disappeared from my dashboard, and is not online!

One initial question should be

Was the blog under team ownership?

>> Top

Repeated TOS Violations Are Punished Gradually

Some blog owners don't understand the serious nature of repeated violation of TOS Policy, in Blogger blogs - and how offenses are handled, by Google.

We've seen several reports, in Blogger Help Forum: Something Is Broken, from blog owners who appear to be unclear about the consequences of repeated TOS Violations.

I got email from Blogger, about my Blogger account.

We'd like to inform you that we've received another complaint regarding a blog that you administer. Upon review of your account, we've noted that you've repeatedly violated the Terms of Service: http://www.blogger.com/go/terms. Given that we've provided you with several warnings of these violations and advised you of our policy towards repeat infringers, we've been forced to disable your Blogger service.

How do I get my blog restored?

This example appears to represent the final step, in a multi step policy.

It appears that Google takes a multi step approach, towards repeated TOS violations - such as hosting of malware, porn, and / or spam - in Blogger blogs. This is similar to the DMCA Violations punishment process.

1. Unlike DMCA violations, individual posts are not deleted.
2. Deletion of offending blogs.
3. Deletion of offending Blogger account(s) (and blogs).

With a TOS initiated blog deletion, the blog owner is expected to have the blog reviewed. If the review determines the blog to be unrighteously deleted, the blog is restored - though there may be side effects.

If the blog owner does not wish to have the blog reviewed, he / she is allowed to start over, with a new blog - but will have to publish to a new URL. Content lost must be recovered by the owner - and the owner should be more careful with future blogs.

If the blog owner continue to publish blogs which violate TOS, any Blogger accounts involved, along with any other blogs owned by the deleted accounts, will be deleted.

We see that an appeal is possible.

Next steps for suspended accounts: If you believe your access to this product was suspended in error, contact us.

With any blogs published to a non BlogSpot domain, the domain URL(s) will remain in use, in the Google database - though the domain owner is free to use the domain outside Google address space. If the offender wishes to start over, both new BlogSpot and non BlogSpot URLs will be required.

As with other issues with email delivered warnings, there will be cases when the owner may not receive warnings in a timely fashion. Even so, the owner is responsible, when he / she offends, repeatedly.

Blogs under team ownership are apparently vulnerable to action taken against any team member. In some cases, blogs will simply disappear from the dashboards of the other team members, with no appeal or review request being possible.

It's possible that legal notice, provided by Google through email, will supercede ongoing forum advice - even if email sent is not received by the owner.

>> Top

Hacking Detection Is (Generally) Not The Fault Of The Blogger Account Owner

We've been helping Blogger blog owners deal with spurious fuzzy content classification, for many years.

We started out, long ago, with blogs deleted because of spam classification. Later, Blogger added malware classification - and most recently, porn classification ("adult content", with objectionable advertisements). These three classification categories involve fuzzy blog content analysis.

A fourth category, which similarly results in blog(s) being deleted, I describe as "hacking detection". This category complements the other three, because the primary symptom of all four are remarkably similar.

Help me! Blogger has deleted my blog!!

This is a frequent complaint, seen in Blogger Help Forum: Something Is Broken.

One problem with using the term "hacking" is that some account owners take this diagnosis personally.

Why do you mention hacking? I am not a hacker!

And in almost all cases, the owners are correct.

Blogs are deleted by Blogger, currently, because of several different reasons.

1. DMCA Violation.
2. Hacking detection.
3. Malware detection.
4. Porn detection.
5. Spam detection.

I list the different categories, collectively, because they are frequently reported, using the common symptom.

My blog was deleted, and I did not do it!

DMCA, malware, porn, and spam are generally based on what the blog owner did (though in many cases, what the owner "did" was simply to publish a blog). Hacking, on the other hand, is generally based on action by someone other than the blog owner.

DMCA, malware, porn, and spam classifications are based on content analysis (automated), or complaint (manual) - and these classifications can be somewhat avoided by the blog owner. Don't steal content or publish a blog containing malware, porn, or spam, to reduce your chance of having the blog classified.

Hacking detection, on the other hand, is based on analysis of Blogger account traffic - and this classification can not be avoided, as easily, by the blog owner. Hacking generally involves use of a cloud of computers, to systematically break into a Blogger account owned by the victim.

Though frequently, a hacking attack starts with unintentional disclosure of personal information by the victim, actual hacking activity is typically not initiated by the victim.

Detection of hacking attacks is best conducted by Google, because they can look for repetitive activity against multiple Blogger / Google accounts, from multiple computers located worldwide.

• Most account owners can login to their accounts in one or two tries.
• Very few account owners will, intentionally, attempt to login to their accounts, concurrently, from computers in Argentina, USA, and Zaire.
• Very few computers will be used to access Blogger accounts owned by people in Brazil today, in China tomorrow, and in Denmark next week.

Recovery from hacking detection requires willful action by the victim - though Blogger makes the required action so simple, its purpose becomes transparent. The victim, or account owner, is simply required to change the account password, solve a CAPTCHA, and / or verify account ownership by providing various personal details.

Having initiated hacking recovery, the account owner is able to login to Blogger - but is greeted by an empty dashboard.

You are not yet the owner of any blogs. Create a blog, and get started!

This is where the confusion starts.

Not all Blogger account owners personally publish a blog. Some people setup Blogger accounts simply to comment on, and / or Follow blogs published by other people - and won't, necessarily, publish a blog using the account in question.

Blogger accounts with no owned blogs may still be under attack by hackers - and are subject to hacking detection. This makes the primary symptom so confusing.

You are not yet the owner of any blogs. Create a blog, and get started!

People who don't own any blogs (under this Blogger account) may, or may not, see this as a problem.

In cases where the initial symptom is a deleted blog, the blog owner must recover the hacked (locked) account, before the blog can be recovered. This is one more scenario where unplanned, anonymous blog ownership, just causes more confusion.

Having initiated hacking recovery, a blog owner is simply expected to wait patiently, until the blogs owned by the account are verified as free of content added by the hacker. Unfortunately, we sometimes see the blog owner, impatiently reporting in Blogger Help Forum: Something Is Broken.

I had to change my password, and having done that, Blogger deleted my blog!

Sometimes, hacking detection starts with the Blogger account owner, repetitively trying to recover access to the account, by sequentially trying every possible password (sometimes trying the same password, repeatedly).

I know it's one of these! But which one? Did I maybe type the one, incorrectly??

This repetitive action looks the same as any malicious hacking attack - and that is why hacking detection is so hard to canonically diagnose.

Please, consider these details, the next time you post your problem report.

Help me! Blogger has deleted my blog!!

In some cases, I may respond with a mention of hacking detection. If I do that, please don't take my response as a personal attack upon you.

Why do you mention hacking? I am not a hacker!

Even though being the victim of a hacking attack is not the fault of the account / blog owner, that person may still have to bear some of the responsibility. In general, blog owners have to support themselves - learn how to protect themselves, and use 2-step verification.

>> Top

Blog Owners, Unable To Request Restore Of A Deleted Blog

One of the more intriguing issues, seen in Blogger Help Forum: Something Is Broken, involves people unable to recover control of their blogs.

I recently changed ISPs, and now I can't login to update my blog.

Occasionally, this issue becomes more complicated, because the blog is deleted - and the owner can't request that it be restored, using the automated review request wizard. Sometimes, the would be blog owner may to try to bypass the current blog recovery policy, by claiming special circumstances.

The blog has been deleted. I received no suspicious activity or password change notification emails, or emails of any kind related to my blog.

What is the story here? Can blogs just disappear from the Blogosphere, without the involvement of the blog owners - and be unrecoverable?

Recovery of a deleted blog starts with the requirement that only a blog owner can un delete a deleted blog - and this is where many mysterious disappearances start.

Since a Blogger blog is the property of the owner, and the owner is allowed to delete a blog any time required, it would not be right to let people who are not the owner un delete a blog - or demand that the blog be un deleted. To enforce this requirement, Blogger added the dashboard based Restore wizard.

Since only the owner will have the deleted blog listed in their dashboard "Deleted Blogs" list, only the owner can request restore of the blog in question.

The dashboard Restore wizard serves blog owners, with blogs deleted under various circumstances.

• Deleted by the owner.
• Deleted by Blogger, as a suspected spam host.
• Deleted by Google, for TOS Violation.

Any deleted blog will appear in a special dashboard list, "Deleted Blogs" or "Locked Blogs" - when it can be recovered. If the blog is not recoverable by the owner, there may not be a link.

There are specific cases where a deleted blog may not be recoverable using the recovery wizard.

• The blog is locked, pending integrity check (following account lock for suspicious activity).
• The blog is owned under a different Blogger account, and is listed on another dashboard, under "Deleted blogs".
• A blog owner deleted the blog, long ago - and the blog is no longer recoverable.

A blog locked, pending integrity check, cannot be requested for restore. The owner has to first have the owning account unlocked. Similar to the account recovery process, Blogger / Google will require that the owner provide proof of ownership, before the account will be unlocked. With the account unlocked, security specialists will inspect each blog owned by the account, and verify that each does not contain evidence of tampering by a temporarily successful hacker.

While a blog is under integrity check, it won't be listed on the dashboard of the owner - either under "Deleted blogs", "Locked blogs", or "My blogs". Neither the owner, nor any third parties, will be able to do anything except wait, patiently.

Blogs found to contain malware can be locked as TOS Violations, with the owner later required to remove the malware found. This requirement will apply for malware installed by the owner (intentionally, or unintentionally), or for malware installed by a hacker.

With a blog locked pending malware removal, the owner is given the benefit of the doubt, and allowed to simply remove the malware, no questions asked. In some cases, Blogger may be able to assist by providing specific identification of the malware found - but this won't happen, consistently.

A blog owned under another account must be un deleted by the owner of the other account. Again, only a blog owner can have a blog restored - whether deleted by an owner, or by Blogger / Google.

A blog deleted over 90 days previously cannot be recovered. It won't appear on the dashboard of any (former) owner, since it can't be recovered.

It's dead, Jim.

The basic rule is simple. If your blog was deleted, and if you're able to un delete it (or request un deletion), you'll have a link on your dashboard. If a blog is not listed on your dashboard, you can't request, with any predictable success, that it be un deleted - any more than you can demand that a non deleted blog be restored to your control.

>> Top

Some Blogger Blogs Being Locked As Malware Hosts, Because Of Malicious JavaScript

For a long time, we've been dealing with various malware / spam mitigation issues, in Blogger Help Forum: Something Is Broken.

Recently, malware detections, long simply identified as "Malicious JavaScript" in the well known Spam Appeal Guidelines, was given its own identity, and a separate classification / appeal process. We're now seeing several common types of JavaScript, included in blogs which are typically mentioned in forum reports.

It may be helpful to describe some examples of JavaScript code being seen, so blog owners can avoid making the same mistakes, by not including these scripts in their blogs.

There are 3 common types of JavaScript applications, found in many blogs with the owners requesting review / unlock action.

1. CPA / Cost Per Action.
2. Traffic Redirection, targeting other blogs / websites.
3. Traffic redirection, targeting the canonical URL for the host blog.

CPA / CPALeads / Cost Per Action, and similar online marketing terminology, involves providing a reward for viewing a blog, or for subscribing to the blog feed. Some CPA scripts may be used to collect email addresses, also known as "email address mining", later used for hacking activity or spam distribution.

CPA scripts present another problem. Since Blogger blogs are intended to reward the readers by providing interesting and unique content, blogs which use CPA may be improperly designed or maintained. Blogger wants the blog owners to publish blogs which entertain or inform their readers - not blogs which require artificial or ingenious techniques to generate traffic, and visitor activity.

Traffic Redirection, targeting other blogs / websites is a technique enjoyed by many hackers and spammers. The use of some blogs as gateways, leading to redistributors, which in turn lead to payload blogs or non Google websites, is part of many hacking / spam attacks. Google is trying to restrict the use of Blogger blogs as malware / spam hosts - and actively prevents scripts, which only shuffle readers from one blog to another, without choice.

Even though Blogger will not encourage you to move your blog, to Tumblr, Weebly, WordPress, or wherever, you are allowed to do this - if you feel the need.

Hello, faithful readers:

This blog is now hosted at my new blogging host. Please update your blog lists and bookmarks!

If you must do this, it's OK to post a notice, in your Blogger blog. You can even put a link, to the new blog, in the notice. You just can't use JavaScript, to automatically send the reader to the new blog.

Traffic redirection, targeting the canonical URL for the host blog, is a technique used by some blog owners who perceive Country Code Alias Redirection to present a problem. Some accessories installed on their blogs, and various non Google services which may be used to provide activity on their blogs, may not properly reference the canonical URL tag included in all Blogger blogs.

Since Blogger / Google wants all Blogger blog owners to benefit from improved world wide access to Blogger blogs, blogs which employ automatic canonical URL redirection may damage the effect of CC alias redirection. Blogs which host scripts which immediately redirect readers to the canonical URL, and are considered undesirable by any host government, may force an offended host government to block the entire Blogger service, in their country.

To prevent malicious misuse of Blogger by hackers and spammers, and to encourage effective long term use of Blogger by legitimate blog owners, Blogger / Google may detect any blogs which use these types of scripts as part of their general malware / spam classification strategy. Given the ability and willingness of the blog owner, to remove the JavaScript code in question, most blogs can be returned to service - but each blog will remain offline, until the removal is verified.

It's to everybody's benefit to identify, and to avoid use of, these scripts in our blogs, before it's too late. If your blog contains one of these scripts, why not remove the problem now, instead of waiting until you too have to post your problem report, in the forum

Help me! My blog was just locked for

MALICIOUS JAVASCRIPT

What do I do, now?

>> Top

Malware Classification, And Country Code Alias Redirection Bypass Code

We're seeing a few complaints, in Blogger Help Forum: Something Is Broken, about overly aggressive malware classification, from blog owners who only want to publish their blogs without fear of side effects from the controversial feature, Country Code Alias Redirection.

Spurious malware / spam detection is a painful topic to discuss - and it's even more so when the question of country code alias redirection is discussed. Like auto pagination long ago, country code alias redirection appears to be another case of Google manipulating its customers, maliciously. If you consider this issue from the viewpoint of Blogger blogs in general, though, you may see the full picture.

Blogger blogs, like the Internet, need to be available to all countries in the world, without fear of censorship. Country Code Alias Redirection allows Blogger to selectively disable any single blog, in any single country. This selective disabling will, eventually, eliminate the need of any country government to block the entire Blogger service, in their country, because of a few unsuitable blogs.

Country Code Alias Redirection is a righteous feature in Blogger blogs. Like many new Google features, it was added before every Internet service was made able to support it. CCAR uses an Internet standard - not a Google proprietary feature - the canonical URL tag. If you look at the header in this blog, you can see an example of a canonical URL tag.

<link href='http://blogging.nitecruzr.net/2013/02/malware-classification-and-cc-alias.html' rel='canonical'/>

That's the tag for this article, for instance.

Some Blogger blog owners find that CCAR causes problems, with some accessories on their blog. Some owners have added anti redirection code to their blogs, so the accessories on their blogs continue to work. CCAR may not work with every third party provided blog accessory or Internet service - because all Internet services, and third party accessory providers, are not yet aware of canonical URL tags.

Just because some people are not up to date with all Internet features (like CCAR), this does not mean that CCAR should not be used. The people involved need to be encouraged to update their accessories, and their services, as necessary.

Right now, some blogs which include anti redirection code are being spuriously detected as malware hosts - and this is more controversy. The anti redirection code looks like malware, because similar code is used by people to abuse our blogs. To not classify blogs attempting to disable CCAR, would require the malware classifier to identify the intent of the blog owner - and would make malware detection more complicated.

Identification of intent is not present in computer software, right now. That ability will be available only when computers truly are programmed to "think" - and when that happens, it may be the end of the human race as we know it.

Since CCAR is a righteous feature, it's possible that anti redirection code actually should be treated as malware - even though the blog owners, adding the code to their blogs, may not consider this to be the case. Those of us who are concerned with detection and removal of malware and spam from the Internet, in general, know that malware and spam is like a cancer - if you don't remove what you see, it's only going to get worse.

To allow anti redirection code to be installed in some Blogger blogs, will encourage other blog owners to do the same. Also, it will allow some hackers and spammers to do likewise, without fear of detection. Neither of these possibilities is good for Blogger blogs, in general.

If you installed anti redirection code in your blog some time ago, your blog was just locked as a suspected malware host. and you are now anxiously waiting for malware review while your blog remains offline, we're sorry for you. But you are not being abused by Blogger - nor is your malware classification unfair.

Remove the anti redirection code, on your blog - now, while you are able. Encourage the providers of third party accessories and Internet services to update their code. And don't allow or encourage hackers and spammers to abuse Blogger blogs, or the Internet in general. Please.

>> Top