Need help with forum troll

[theprez98]

Re: Need help with forum troll

My question is this:

If someone is abusing your forum, where would you go? I'd go to the support forum for my particular type of forum (i.e., VBulletin support forum). Why would you even think of coming to DEFCON forums?

[TheCotMan]

Re: Need help with forum troll

Running it through a content filter could work but with so many posting daily we're concerned that someone innocent will mistakenly have their post deleted.

Such content filters don't *delete* messages (in configurations I've seen.) They only move the message to a moderator queue for moderators to consider as spam/valid or not.

I first saw this on MythBusters forum site (discovery channel.)

I posted something with several citations through URL (kind of like a pseudo bibliography) and their system thought my post was spam. It took them 6-12 hours to mod+ the post so the public could see it. At the time, I was a little frustrated that my post did not appear right away, but I understood the need for it-- I just wish their filter was smarter than it was. ;-)

Public humiliation won't work, he apparently thrives off of that and non of his content is illegal just highly abusive.

Then you don't have the kind of skilled, creative, and imaginative moderators that we have here on the Defcon forums. Check out "Fucktard Hall" as a place where we keep loser posters' posts around as a kind of cautionary tale to the rest of the public, on what not to do. It has been quite effective, when paired with everything else. You'll note we have not had many inductees lately. :-)

Of course, we don't have to be politically correct when we show users the errors of their actions. ]:>

Our ultimate goal is to cause as little disruption to our other posters as possible.

That is the goal of many forums. The problem is that ease of use, and low thresholds for cost of entry make it easy for abusers to generate excess noise which can drive away your valued members.

Raise the bar too high, and new members stop posting.

We also employ a tiered user promotion system. This allows a great deal of variety in implementation (different metric/vectors can be selected for action) and control to limit damage. Tiered promotion systems should be very short. You can't really gauge anything about a user based on how old their account is. However, a user with no derogatory marks on their account, with a large number of posts, and a long history of not causing problems is probably a fairly safe bet, when considering future posts.

For example, you could arrange it so that users with accounts less than 24 hours old can only post 1 post every hour, or 5 posts in one day. You can arrange to have it so that, users with more than X posts, who have been around more than Y days, and have no derogatory notes about them, can publish things and bypass moderation queues, or spam filters.

Leverage your user information in such a way that "regulars" are not burdened with higher costs of entry, but new users (like those that might return over and over again to troll) have a heavier burden.

Once you gain access to IP information about users, in a per-post scenario in addition to registration IP per user, you can automate a process to locate users that are sharing an IP address. I've done that here. I even put it in a nifty web page that grabs the results of a clever SQL "SELECT" on the DB to let me know what usernames are sharing the same IP address, to better identify would-be abusers of the "one account per user" rule. (I generally don't act on this unless a user gives me reason to consider them-- like if they started a flame-fest with themself.)

Thank you for taking the time to answer my question. It is much appreciated. Any other suggestions will be welcome.
IBTrippin

No problem. Good luck.

[IBTrippin]

Re: Need help with forum troll

Ok Thank you for the overview. If he's using something such as this then I guess there's not much we can do. Guys, I really appreciate your time in this matter. You've been more than helpful and have provided some excellent insights.
Happy Hoildays

[Thorn]

Re: Need help with forum troll

Ok Thanks, thats a start.
We're relatively new at this and we're having to learn as we go. One of the prolems we have is we have no way to check IP address used at sign-up or we don't know how. We were able to get this posters address but thats been about it. Our posters are able to see their posts as soon as they submit them and we want to keep it this way so a waiting period isn't feasable, but thanks for the suggestion. Running it through a content filter could work but with so many posting daily we're concerned that someone innocent will mistakenly have their post deleted. Setting them as a "Tachy Goes to Coventry" user sounds feasible we may try that. Also what is Ban IP found as torr-exit points? we may try that too. Public humiliation won't work, he apparently thrives off of that and non of his content is illegal just highly abusive. Our ultimate goal is to cause as little disruption to our other posters as possible.
Thank you for taking the time to answer my question. It is much appreciated. Any other suggestions will be welcome.
IBTrippin

"Tachy Goes to Coventry" is specific to VBulletin, although other forum software packages may have similar options.

TOR ("The Onion Router") is a means of connecting anonymously by using encrypted tunnels. Here is the TOR overview. TOR exit points are specific IPs that are known to be where the tunnels are exited to the "normal" IP traffic. You may also be block other users however, if they too, are using TOR.

[IBTrippin]

Re: Need help with forum troll

Ok Thanks, thats a start.
We're relatively new at this and we're having to learn as we go. One of the prolems we have is we have no way to check IP address used at sign-up or we don't know how. We were able to get this posters address but thats been about it. Our posters are able to see their posts as soon as they submit them and we want to keep it this way so a waiting period isn't feasable, but thanks for the suggestion. Running it through a content filter could work but with so many posting daily we're concerned that someone innocent will mistakenly have their post deleted. Setting them as a "Tachy Goes to Coventry" user sounds feasible we may try that. Also what is Ban IP found as torr-exit points? we may try that too. Public humiliation won't work, he apparently thrives off of that and non of his content is illegal just highly abusive. Our ultimate goal is to cause as little disruption to our other posters as possible.
Thank you for taking the time to answer my question. It is much appreciated. Any other suggestions will be welcome.
IBTrippin

[TheCotMan]

Re: Need help with forum troll

Looking at what Chris wisely points out, I won't comment on techniques that might be used by trolls, spammers, etc. to bypass bans but as for methods to defend against some:

profile the activities of the user, and use the information you find to deny access.
Ban the email addresses and domain,
Check for IP addresses used to signup,
Ban IP found as torr-exit points,
Ban IP by networks (including full subnets) with custom messages by HT-error, letting possible innocent users know who is to blame for their disabled access,
Deny signup with email addresses from "public" or "free" webmail systems,
Add a waiting period,
Run all posts through a content filter, and setup a baysian filter with their content, treated as spam. Anything found to be spam-like is held in a moderator queue, and that account is then flagged to block all future posts from being public until moderated.
require moderators to OK all messages before they are made public,
Let the user remain unbanned, but set them as a "Tachy Goes to Coventry" user (They can see their own posts, but nobody else can.)
Public humiliation of the user, and exposure of their own private information, including email addresses, IP addresses used, and more.
If their content is illegal, report it as such to the hosted ISP, and followup. (Especially effective in cases where "kiddie porn" is published in some way. In my experience, ISP tend to react quickly at resolving such problems.)

There are more techniques, but I don't like publishing everything we use on the defcon forums, for fear that spammers will learn to create countermeasures faster than we can can implement new counter-counter-measures, or would that just be new measures?

I can tell you, that ultimately, the defender of a forum is at a disadvantage in this game. There is nothing that I can do as a mod, that I, as an evil-user can't bypass. Attacker has the advantage, and there are many more attackers than there are defenders.

And consider this: spammers are *paid* to spam, while all of the mods here are volunteers.

[IBTrippin]

Re: Need help with forum troll

How do we know you aren't said banned forum troll and are trying to use your tricky troll ways to get us to tell you how to get around your ban?

You'll just have to trust me on this. I'm not the one banned, I'm the one who does the banning. This has really become a problem and we're looking for a way to stop it. We're getting around 50 to 100 abuse reports a day. I'm losing more hair than I can afford! What do you need to convince you I'm sincere?

[Chris]

Re: Need help with forum troll

I'm a forum moderator for our local newspaper. We have a poster who's causing problems on our forum and we're trying to ban him. We've deleted his posts, banned his username and IP address. The problem is he keeps logging on under a new name shortly after we've banned him and the problems start all over again. Can you give me some insight as to how he is doing this? What programs could he be using and more importantly how can we stop him? Your assistance in this matter would be GREATLY appreciated.

How do we know you aren't said banned forum troll and are trying to use your tricky troll ways to get us to tell you how to get around your ban?

[IBTrippin]

I'm a forum moderator for our local newspaper. We have a poster who's causing problems on our forum and we're trying to ban him. We've deleted his posts, banned his username and IP address. The problem is he keeps logging on under a new name shortly after we've banned him and the problems start all over again. Can you give me some insight as to how he is doing this? What programs could he be using and more importantly how can we stop him? Your assistance in this matter would be GREATLY appreciated.