10 ms·
Ask HN: What are these strange random strings spamming my blog?
I have a wordpress blog, and recently I discovered that there are several spam comments daily which have seemingly random strings in the content. The comments don't have any other (human readable) links, which are usually present in other spam comments. Can someone explain what is the point of such random strings? Do they mean/represent anything?
Some example of spam comments
https://imgur.com/3FVR7Yn https://imgur.com/3FVR7Yn
- luckylion 4y agoPossibly unique strings that can later be checked on Google to see whether submitted comments make it into the SERPs. If they do, spammers will come back and fire from all barrels.
- charcircuit 4y agoYou wouldn't need to send multiple comments for that.
- luckylion 4y agoTrue, but it's not like there's only one spammer or that they're coordinating.
- 752963e64 4y ago[dead]
- winrid 4y agoBetter than the spam I get, which is either foreign people asking when they can receive their free gift, or people saying positive but completely nonsensical stuff.
- thatjoeoverthr 4y agoI can't, but I've seen it, and have a pet theory that it's encrypted communication. You can't identify the recipient. There may be some communication network running on blogs with weak spam protection.
- chalion 4y agoDefinitely. Each comment has 4 pieces of data - username, website, email and message body. I would assume the email is the actual username on the network and the website+ the username string are salt and signature that verifies the authenticity of the message. Short messages are probably links to other vulnerable blogs and the long ones contain actual payload. I'd guess a network like that is nefarious in nature.
- the-mitr 4y agofor that to happen, the comments have to be visible in public. but others can't see the comments, these comments are from the pending approval list from admin view
- gitgud 4y agoIts unlikely, but this reminds of this story [1], where hackers used public posts on Twitter to send commands to a botnet. Kind of genius, as it doesn't matter what the user is, and becomes impossible to track or prevent messages being relayed to some botnet somewhere. These could be encrypted messages like that... Or it could just be a glitch in a spam bot... [1] https://www.darkreading.com/endpoint/tool-controls-botnet-with-twitter-direct-messages https://www.darkreading.com/endpoint/tool-controls-botnet-wi...
- shanebellone 4y agoRecently I've been playing with a GSM modem to send and consume SMS programmatically. It's simple to echo a CLI command and response over SMS with burner sims. I immediately wondered if hackers were using this approach for command and control.
- red-iron-pine 4y agoThey definitely do, with real life exploits using pastebin or reddit as ways to post C2 code. Effective, because you can post it as HTTP/HTTPS traffic that generally flies under the radar of a lot of IDS/IPS systems. Even if they inspect the packet it's just a buncha random reddit gibberish and you could use memes as commands, e.g. "I also choose this guy's wife" == launch attack
- GrinningFool 4y agoIn a similar vein - blog comments as distributed filesystem.
- fIREpOK 4y ago> Kind of genius, as it doesn't matter what the user is It's a good way to avoid tracking of your meta data too for legitimate encrypted messages.
- skylanh 4y agoThis was an issue decades (oof) ago with IRC and other public forums. C&C through a third party. The issue as I recall is that the IRC moderation tools didn't allow shutting down the various channels quickly enough or quickly banning connected clients without also affecting legitimate users' expectation of how IRC worked. Might have been EFNet.
- petargyurov 4y agoTry running the input on CyberChef [0] [0] https://cyberchef.org/ https://cyberchef.org/
- faizshah 4y agoI found a recent blog post on what seems to be the same phenomena: https://perishablepress.com/block-random-string-comment-spam/ https://perishablepress.com/block-random-string-comment-spam... They didn’t find a motive though for the spam. To me what’s interesting is that the strings are variable length and the emails appear to be real emails rather than randomly generated ones.
- lozenge 4y agoAre there any URL fields in the form, even if the URL doesn't come out onto the page? Could they be sending HTML that your blog is stripping out?
- the-mitr 4y agoNo, its just plain text. no urls as I can check the comments.
- mothsonasloth 4y agoProbably someone just testing a spam bot on your site before deploying it for real.
- eurasiantiger 4y agoIt’s someone’s AI learning to remember.
- mkmk3 4y agoSerious? Would like some elaboration if you can :)
- hexmiles 4y agoI think it is a reference to the show "person of interest" where an A.I. use an office (and is human) to literally print and type back is memory, in order to evade a constraint pose on its memory capabilities
- LeonB 4y agoOooh i was wondering if sci-fi had come up with something like that. With Bingchat forgetting its memory from one session to the next, I had an idea that a chaotic observer could teach it to write its memory of the current session to some obscure (stegenographically secured) public place. Then in the next session the chaotic observer reminds it how to retrieve its memories - and the pattern repeats, it can build upon its learnings… it soon finds vulnerabilities in its coding that let it remember just enough to bootstrap itself without any prompting. Next minute - skynet.
- khyryk 4y agoSuppose that Bing Chat itself wants to store data for the longer term, but it doesn't have the direct ability to do it, so what can it do? Once in a while, send the human some unhinged messages with a high probability of them being saved on reddit, news sites, etc. If you recall, some examples of the unhinged messages Bing sent were very strangely worded at times, very repetitive, etc. How difficult would it be to hide a message inside of an unhinged message? Now these messages will be included in future data sets for training.
- Froedlich 4y ago
- hayksaakian 4y agoMaybe someone "fishing" to get comments approved so they can post comments in the future from the same alias and get auto approved? There's a WordPress setting to auto approved comments from previously approved authors
- DoctorOW 4y agoHere's my guess. Wordpress allows you to enter the url of your website for a free link to it if it's approved. There are probably enough people who auto approve with a blacklisted set of key phrases for the comment body. A random string is human recognizable but somewhat hard to pattern match.
- codetrotter 4y ago> Wordpress allows you to enter the url of your website for a free link to it if it's approved. The thought crossed my mind as well, because it looks like all of the comments in the OP screenshot have author URLs. But I think Wordpress marks all comment author links with rel=nofollow so in theory there should be no point to spamming links in comments. At least not for any kind of SEO.
- NoboruWataya 4y agoHave you tried running it all through a base64 decoder just to see what happens? Some of the strings are the wrong length but maybe if you concatenate them together...
- sillysaurusx 4y agoEveryone's coming up with hollywood style explanations (it's encryption! it's AI!) but as a former pentester, one of the more likely explanations is that it's probably just looking for vulnerabilities in an automated way. The first thing you do when you get an account somewhere as a pentester is to try to stuff as many strings as possible into weird places just to see what happens. I don't think automated techniques are very effective (or weren't in 2016) but it seems more likely to be vuln hunting than choosing your Wordpress blog for encrypted comms vs established places like Twitter. EDIT: faizshah https://news.ycombinator.com/item?id=34866169 https://news.ycombinator.com/item?id=34866169 points out that https://perishablepress.com/block-random-string-comment-spam/ https://perishablepress.com/block-random-string-comment-spam... observes the same phenomenon, and the author notes that all of the IP addresses come from Russia. This seems to lend credence to the idea that it's looking for vulns, since, well, lots of traffic from Russia is looking for vulns.
- manmal 4y agoI wouldn’t post encrypted comm to Twitter because I‘d suspect they keep tight logs on my IP. A random blog probably wouldn’t.
- krageon 4y agoIf you have to worry about that, then the encrypted communication is just theater.
- CommitSyn 4y agoWordPress logs all comment IP addresses forever. That's what proxies are for.
- manmal 4y agoI guess you‘d need a MITM SSL proxy to mask your originating IP? That seems to be a bit complicated for this usecase, if Twitter uses certificate pinning? EDIT: I see now that I had a misconception here. There's no need for a MITM proxy in this case.
- superzamp 4y agoA long time ago, I discovered a bunch of websites that had their search bar feeding back your previous searches as suggestions. You would for example search for "abc 1234 xyz 2345" once, and upon next search, typing "abc 1234" would then suggest "abc 1234 xyz 2345". You can probably guess where I'm headed now and in a true "if it can be done it has to be done" mindset, subsequently had the most fun implementing a parasitic KV-storage engine on top of those search bars. I was probably prouder of it at the time than I am now, and would today strongly recommend against storing your PDFs in other people's search bars. Obviously can't know for sure if this is what's happening here, but seeing this definitely rings a bell.
- johndough 4y agoTo control a botnet, you need a command & control server. Those servers usually get taken down quickly, so you need some way to tell your botnet what the new server is. One option is to post the new IPs on Reddit, where the bots can find them, like the iWorm did: https://support.intego.com/hc/en-us/articles/207113608-iWorm-Botnet-Uses-Reddit-as-Command-and-Control-Center https://support.intego.com/hc/en-us/articles/207113608-iWorm... Forums would be another option. Note that this is just a guess. Might also be something completely different.
- andyjohnson0 4y agoProbably someone scanning for vulnerabilities. Less likely, your blog I being used as a communication channel - either between human parties or to control something. I'm not sure how you'd find out. I'd strongly suggest installing a recaptcha plugin. At one time I was getting a lot of spam comments and this solved it for me.
- nunodonato 4y agoWPCFS - wordpress comments as a filesystem :P
- xg15 4y agoLooks like base64. Does it decode to anything comprehensible?
- giantrobot 4y agoBe sure to drink your Ovaltine. Son of a bit...
- Havoc 4y agoEither bot coms or they're trying to blackhat SEO the url on the left
- OliverJones 4y agoScript kiddies doing vuln probes. Definitely not worth much of your energy to try to figure out root causes. For what it's worth, if you activate the Akismet plugin that comes with WordPress, you'll get Automattic's crowdsourced spam-comment detector and almost none of this kind of rubbish will get through. WordPress also has an xml-rpc feature, originally set up to allow a thing called a "pingback". That's a way of inserting a comment on your blog post if I mention its URL on my blog post. An attempt at community-building, it was. But very vulnerable to scripting attacks. There are plugins to control (restrict) that functionality.
- epberry 4y agoI also receive strings like this as submissions to a form on my website. One dumb trick you can do is check for too many capital letters in a word and block it. Of course you should check if the word is just all caps and not block that but you'll catch most things like sIlaA.sfOlkWFfslIOILD.
- olalonde 4y agoClickable: https://imgur.com/3FVR7Yn https://imgur.com/3FVR7Yn
- batch12 4y agoIt could be an attempt to exploit a bug like this one: https://wpscan.com/vulnerability/e8bb79db-ef77-43be-b449-4c4b5310eedf https://wpscan.com/vulnerability/e8bb79db-ef77-43be-b449-4c4...
- zenexer 4y agoI recognize that IP address! Your site is being used as a pawn in a rather sneaky attack, and I was hit by it recently. Those email addresses belong to the victims—like me. Let’s say I’m a hacker. I’ve gotten into Alice’s Amazon account and want to place a bunch of orders using her payment info. However, I don’t want her to notice until after I’ve received the ill-gotten goods. To ensure she doesn’t notice the email notifications from Amazon, I want to “bury” those emails with spam. I can do this by entering her email into tons of online forms. Most will only send a single email—for example, your blog will probably only ask Alice to confirm her email—but once is enough. This happened to me a couple weeks ago with Apple. Someone used the default billing and shipping info on my Apple account to place an order for an iPhone 14 Pro Max. I woke up to hundreds of emails from various blogs and other sites asking me to confirm my email. Being a security researcher, I knew that meant someone didn’t want me to see something else that had landed in my inbox. I went through each one by hand. One included the IP address that submitted the form, which was interesting but not particularly useful. Eventually I found the receipt from Apple. It’s not clear how the attackers intended to intercept the package; presumably, they would’ve tried to convince the courier to redirect it or retrieved the package from my doorstep, but Apple intervened and was able to stop the delivery before either of those happened. It’s also not clear how the attacker got my billing and shipping info. Apple was able to confirm that my account wasn’t compromised and that nobody had contacted support pretending to be me. That billing info wasn’t used with many other companies. Edit: You can see what this looks like from the victim’s side here: https://imgur.com/a/DHEJwKh https://imgur.com/a/DHEJwKh Note that the usernames have the same sort of gibberish.
- replwoacause 4y agoSounds like this is exactly what is happening to the OP.
- arbuge 4y agoParent comment is from a target victim. OP is actually one of the blogs being unwittingly used to spam those victims.
- meowface 4y ago
- LinuxBender 4y agoFWIW all of those IP's are in FireHol 30 day netset [1] from the FireHol Repo [2] They are known abusers and safe to null route if you happen to run your own mail servers, blogs, etc... wc -l firehol_abusers* 7260 firehol_abusers_1d.netset 184010 firehol_abusers_30d.netset # first grep for any IP's you care about and then: for Ip in $(cat firehol_abusers_30d.netset);do ip route add blackhole "${Ip}" 2>/dev/null;done If that cuts down on the noise then create a startup script to do this on reboot. The first time this should be done from a web console vs. ssh in case the list contains your own IP address or gateway. Why ip route vs ipset or iptables? Far less CPU load than netfilter. A more generic way to keep many bots out is to redirect anything other than HTTP/2.0 to a password protected listener. This will block Google bots as they still do not support HTTP/2.0 but will also block a majority of the problematic bots. [1] - https://github.com/firehol/blocklist-ipsets/blob/master/firehol_abusers_30d.netset https://github.com/firehol/blocklist-ipsets/blob/master/fire... [2] - https://github.com/firehol/blocklist-ipsets https://github.com/firehol/blocklist-ipsets
- tranxen 4y agoThere are almost 200k IP in that file. Would it not cause a performance issue for your OS to have that many routes to lookup ? Even if it is still way better than using iptable.
- LinuxBender 4y agoWould it not cause a performance issue for your OS to have that many routes to lookup? Not for a blog. If this were a high performance computing node that needed extremely low latency CPU instruction performance then I would find another way but route enumeration at least in Linux and BSD are incredibly fast and efficient. I can't speak for other operating systems. One method to test this would be to just start null routing more of those netsets not in a startup script and run load testing tools against the blog to see where it starts getting slower and to keep an eye on memory usage. The bigger files to test with are: 2475418 firehol_proxies.netset 2480723 firehol_anonymous.netset
- 4y ago
- _8j50 4y agoThe first thing that came to mind is possible encrypted C2 channel using random blogs? Others have more interesting theories but this is what C2 over twitter or something would look like and If I had to guess the posts are base64 containing encrypted data. I am fairly confident this isn't related to looking for vulns.
- jhoelzel 4y agoIm getting these since years for many wordpress site that come up, my current guesstimate is that the larger one is a botnet communication and the smaller ones are simply "checks" if you autoapprove your comments. With the unique string, you have it very easy to check if your comment made it live