3 ms·

I'm glad to see this blogged about as it was on my todo list. I have numerous previous examples of this scam as well if people want to compare and contrast (fre

by Smerity 14y ago

I'm glad to see this blogged about as it was on my todo list. I have numerous previous examples of this scam as well if people want to compare and contrast (free sunglasses [Oakleys], free headphones [Beats by Dr Dre], etc). What annoys me most about this is the scam is only spread through exploiting human nature and not advanced technology. The code is literally almost exactly the same each time yet nothing has been done by Facebook to prevent it. Fingerprinting this is certainly not impossible (every example I've seen is formulaic and even starts the counter at 973) and I'm surprised Facebook doesn't have an advanced spam fighting arsenal that's effective against it. Does anyone know what tools they use to combat this sort of thing? Machine learning would work really well here considering numerous past examples and the fact you're only interested in links that are spreading virally. Even if you needed a human being for final confirmation before blocking the site, you'd knock out a link once and it'd positively impact tens of thousands of people. I'd be shocked if using bit.ly and a few other obvious spammy redirects was all you needed to trick Facebook...

abeland 14y ago
Hi, my name is Abe, and I'm an engineer at Facebook working on the team that prevents these kinds of scams from spreading on the site. As you suspect, we actually do have a bunch of tools that detect attacks like this (and others), but they're not perfect, and you never really see when they work, only when they don't. In cases like this, you're right that there are often obvious content patterns. However, enforcing on or detecting those doesn't really scale, as they're trivial for the attacker to change. Instead, we try to focus on aspects of an attack that are much more expensive for the attacker to change. One component of our systems that detect this does involve looking at metadata about URLs, and running it through some machine learned classifiers (you're correct that simply using bit.ly is insufficient to stop us). Regardless, we've taken care of this particular instance of the attack and are always working to systematically improve our detection and mitigation systems. Let me know if you're interested in helping us out in this effort!

by Smerity 14y ago

abeland 14y ago

Hi, my name is Abe, and I'm an engineer at Facebook working on the team that prevents these kinds of scams from spreading on the site. As you suspect, we actually do have a bunch of tools that detect attacks like this (and others), but they're not perfect, and you never really see when they work, only when they don't. In cases like this, you're right that there are often obvious content patterns. However, enforcing on or detecting those doesn't really scale, as they're trivial for the attacker to change. Instead, we try to focus on aspects of an attack that are much more expensive for the attacker to change. One component of our systems that detect this does involve looking at metadata about URLs, and running it through some machine learned classifiers (you're correct that simply using bit.ly is insufficient to stop us). Regardless, we've taken care of this particular instance of the attack and are always working to systematically improve our detection and mitigation systems. Let me know if you're interested in helping us out in this effort!