Major Flaw in Spam Removel System

[flyoffacliff]

Senerio:

1. A bot spams a forum, creating 100 global accounts and 250 spam posts per account.
2. The forum admin uses the spam removal tool. But does not have time to select all 100 accounts, so he has to select "everyone", removing some legit posts.
   
3. All the spam posts are gone, but the accounts are still there and active.
4. Since they are on different global accounts, the admin has to ban/disable/delete all 100 individually.
   

While the yellow issue is minor. The red one is major.

[RedBassett]

Account registration is a hard process for bots. More often, a human will register the account and then hand the posting ability to a bot.

If this should happen, turn on limited registration. Then go to the member list. Then click the "date registered" column header twice to sort by date registered, newest first. Check the first member, then shift-check the last one, selecting all the spam account. Then click Actions > Moderate > Delete Members.

[Thomasss]

Kinda hard for bots due to the CAPTCHA they have to use.

[rchelitalk]

Even though you didn't post a request here I believe this has already been answered for you in this thread that you started and Ryan Roos replied to.

support.proboards.com/thread/435432/post-control-system

[flyoffacliff]

Dec 9, 2012 12:44:03 GMT -8 rchelitalk said:

Even though you didn't post a request here I believe this has already been answered for you in this thread that you started and Ryan Roos replied to.

support.proboards.com/thread/435432/post-control-system

That is for spam posts, I am talking about removing spam members too.

[flyoffacliff]

Dec 9, 2012 12:22:24 GMT -8 Thomasss said:

Kinda hard for bots due to the CAPTCHA they have to use.

Captcha's are easy to bypass with modern OCR technology, and relay services such as REMOVED BY ADMIN.

[Thomasss]

Dec 9, 2012 18:31:09 GMT -8 flyoffacliff said:

Dec 9, 2012 12:22:24 GMT -8 Thomasss said:

Kinda hard for bots due to the CAPTCHA they have to use.

Captcha's are easy to bypass with modern OCR technology, and relay services such as REMOVED BY ADMIN.

i found my new favorite website!

[RedBassett]

*cough cough* My post above outlines quick removal of spam accounts

[Ryan Roos]

RedBassett already explained everything that I would say in his first post.

Additionally I haven't seen a feature suggested in this thread. We have implemented prevention for these sorts of things. We have created tools for dealing with anything that might happen. We offer better security and more tools and options than other forum services.

You can throw out hypothetical situations all day. But we already lead in solutions. You seem very worried that someone is going to target your forum for no apparent reason. You aren't going to have better security and cleanup anywhere else. What you are posing is an extremely unlikely and very improbable situation. Additionally you have not provided a solution to how you would stop such a thing from happening. We do have such systems in place, and they will not be made public.

If you are afraid you can limit registration and disable guest posting. Problem solved. If you don't want to do those two things then you can easily clean up and deal with any spam attack of any size (no matter how unlikely) in a matter of minutes. You have the tools based on how you chose to run a forum. If spammers are a major concern we gave you the tools to stop them cold from even accessing your forum,. if you are a public forum we gave you the tools to deal with them.

Threads like this unnecessarily scare other members. Spam attacks are rare. And on the scale you're suggesting, it's never happened. Even if it did we're prepared and admins are prepared.

[Patrick [ASE]]

Just to back up what Ryan said, we had a severe spam attack from advertisers here at support, that lasted a few weeks, the staff were on alert and dealt with every incident quickly, i would guess that many of the spam posts were dealt with withouf members seeing the posts. after a while the spamming stopped.


If we can cope with that in V4.5, then with the extra features, you should easily be able to handle the little amount of spam you might get with V5 if any.

[Ryan Roos]

In v5 that would have been a lot easier to handle as well. We learn from prior experiences. You also need to trust that ProBoards itself is doing a lot behind the scenes to protect you. We obviously can't give details or that would defeat the purpose.

[flyoffacliff]

Dec 9, 2012 20:00:33 GMT -8 RedBassett said:

*cough cough* My post above outlines quick removal of spam accounts

Sorry, I did not see that post. Thanks.

Dec 10, 2012 9:45:08 GMT -8 Ryan Roos said:

RedBassett already explained everything that I would say in his first post.

Additionally I haven't seen a feature suggested in this thread. We have implemented prevention for these sorts of things. We have created tools for dealing with anything that might happen. We offer better security and more tools and options than other forum services.

You can throw out hypothetical situations all day. But we already lead in solutions. You seem very worried that someone is going to target your forum for no apparent reason. You aren't going to have better security and cleanup anywhere else. What you are posing is an extremely unlikely and very improbable situation. Additionally you have not provided a solution to how you would stop such a thing from happening. We do have such systems in place, and they will not be made public.

If you are afraid you can limit registration and disable guest posting. Problem solved. If you don't want to do those two things then you can easily clean up and deal with any spam attack of any size (no matter how unlikely) in a matter of minutes. You have the tools based on how you chose to run a forum. If spammers are a major concern we gave you the tools to stop them cold from even accessing your forum,. if you are a public forum we gave you the tools to deal with them.

Threads like this unnecessarily scare other members. Spam attacks are rare. And on the scale you're suggesting, it's never happened. Even if it did we're prepared and admins are prepared.

1. Oh, sorry, the feature would be a quick way to remove spam members, not just spam posts. redbassett already pointed out an alternative way. But it would be good if we could mass remove members, instead of just posts.
2. Their is not a tool for mass deleting/disabling/banning members.
3. Only by IP address, which can be easily changed or hidden.
4. Sorry, I was not trying to scare anyone. I am just overly cautious about everything.
5. Actually, It happened on a forum that I used to be a global moderator on a few years ago. We were able to clean up the spam posts pretty easily, but they sent thousands of spam PMs. Since we could not view others PM's and delete them, we just sent an apology. I see in V5, you can remove others PM's with the forum cleanup tool. But you have to select each member individually. The option to remove all PM's sent in a given time period is greys out, and is only available for topics and posts.

Dec 10, 2012 10:21:11 GMT -8 Patrick [ASE] said:

Just to back up what Ryan said, we had a severe spam attack from advertisers here at support, that lasted a few weeks, the staff were on alert and dealt with every incident quickly, i would guess that many of the spam posts were dealt with withouf members seeing the posts. after a while the spamming stopped.


If we can cope with that in V4.5, then with the extra features, you should easily be able to handle the little amount of spam you might get with V5 if any.

Okay, thanks. But spam posts are not the problem. The main problem I am talking about is spam accounts.

Dec 10, 2012 11:32:07 GMT -8 Ryan Roos said:

In v5 that would have been a lot easier to handle as well. We learn from prior experiences. You also need to trust that ProBoards itself is doing a lot behind the scenes to protect you. We obviously can't give details or that would defeat the purpose.

Okay, thanks. I guess I am too worried. But if each spammer was using a different username, global ID, and IP address, and they registered 2 accounts per day over the course of many years. Then there is little you can do to prevent it. But at least it will be easy to clean up if it does happen, which is very unlikely.

[RedBassett]

Dec 10, 2012 13:10:15 GMT -8 flyoffacliff said:

1. Oh, sorry, the feature would be a quick way to remove spam members, not just spam posts. redbassett already pointed out an alternative way. But it would be good if we could mass remove members, instead of just posts.

What I suggested isn't an alternative.  It is the way to mass delete accounts.  If checking two checkboxes and four clicks is too many steps for something that happens once every few years, then something else is the issue.

Dec 10, 2012 13:10:15 GMT -8 flyoffacliff said:

3. Only by IP address, which can be easily changed or hidden.

IP address is the only way to identify guests.  If a spammer rotates IP addresses to continue, I don't think they will bat an eyelash at re-registering an account.

[VS Admin]

You can mass remove members from the Members page. Just sort by registration date, check the box next to the members you want to delete, go to Actions > Moderate > Delete Member

[flyoffacliff]

Dec 10, 2012 16:34:38 GMT -8 VS Admin said:

You can mass remove members from the Members page. Just sort by registration date, check the box next to the members you want to delete, go to Actions > Moderate > Delete Member

 
I know. This was mentioned earlier in this thread. I am just saying there could be a tool for it to make it easier. It is not a big deal though. Thanks.