Jeremy Kirk
IDG News Service
June 30, 2008
One of the first social networking upstarts, MySpace, is facing continuing security problems that threaten to spoil many of the innovative features that make the site useful.
Hackers, spammers and Internet malcontents have turned many of the "group" sites, which are dedicated to interests such as home beer brewing, animal welfare and gay rights issues, into cyber-graffiti walls, filled with offensive comments and photographs.
Those trashing the group profiles are known as trolls, who delight in making a mess and try to one-up each another with aggressive vandalism. They post taunting videos on YouTube.com, egging each other on and making real-world threats.
It has left many MySpace users struggling to maintain order on their groups. They allege that MySpace has been lax in fixing several well-known glitches that persist on the site despite repeated efforts to contact security administrators. MySpace, which would not grant interviews for this story, contends it has beefed up its security department and does its best to patrol the site for misbehavior.
"Over the last two years, I have notified MySpace not only of the problems but given them possible solutions as well, but they have only responded with a thank you, but there never has been any result," said Corey Scott-Walton, of Sacramento, California, who runs a group for craft-beer enthusiasts.
Scott-Walton is one of several MySpace users who became fed-up with trolls and created their own tools for combating abuse.
One of the problems is a glitch that allows vandals to post comments on a group even when they aren't an approved member. Usually, a moderator must approve new people who join a group.
That glitch opens a door to two more. Another is "bombing," where dozens of empty comments can be posted in the group's discussion area using an automated tool. The boxes push down the real comments and create hundreds of empty comment pages, effectively ruining a conversation. Another problem is "pinning" where a new topic on a discussion thread can be pinned on any forum.
Even if the account of the vandal has been deleted, the offending posts are sort of halfway deleted, with no comments visible but page after page of blank space. Scott-Walton wrote a tool in Visual Basic called "Thread Cleaning" that allows moderators to delete those posts.
MySpace's terms of service forbid use of automated tools and scripts, but users say they've been left with no choice.
Another MySpace user who is a Web developer in Connecticut created a tool that will check his group every 20 seconds for spam and delete it. The Web developer, who did not want to be identified for fear of harassment, said he has used the "report abuse" feature hundreds of times.
"I've found that the more people that report an [abusive] account, the faster MySpace makes it go away," he said.
Trolls will often create hundreds of "sock-puppet" profiles that are used merely to harass other users. Once the particular profile has been shut down by MySpace, the troll will simply use another one to continue attacks.
Another moderator who runs a group concerning religion created a tool to "unpin" offensive topics. He said he has had sporadic contact with MySpace security officials but not been satisfied. "This admin has made a ton of empty promises," he said. "I feel like they're not doing anything to try and halt this harassment problem."
That moderator said he's created a fifth group profile now after hackers found a way to delete his other ones. He too fears harassment outside MySpace: "I don't include any friends or family on my site for their safety."
An unofficial group for followers of the U.S. Democratic Party has been hard hit, according to its moderator, who also did not want to be identified. Moving to another social networking platform isn't an option: "We already have a group of over 80,000 members," he said. "There's been such an investment in building this group up, I'd have a hard time just ditching it to start a new one."
MySpace often relies heavily on users to do the heavy lifting in reporting abusive material, said Caroline Dangson, research analyst for new media and entertainment at IDC.
"So far, we have seen MySpace do very little to address the issues of trolling," Dangson said. "Ultimately, it is in MySpace's best interest to find or develop technology that will block this type of abuse, or the social networking site will eventually lose users, maybe even groups of users, as well as advertisers who pay the bills."
The group moderators have several security suggestions for MySpace: First, fix the glitches. Second, implement flooding controls, which would limit the number of postings a person can make within a specific time period. Scott-Walton said he has also found another problem involving PHP scripts that could potentially be used to track users to a geographic region or exploit security vulnerabilities on a PC.
As far as the trolls, a few of the MySpace miscreants haven't done much to stay anonymous. The MySpace Democrats' moderator said he filed a report with the U.S. Federal Bureau of Investigation about a month ago after tracing the attacks to a quite surprising perpetrator: a graduate student at Carnegie Mellon University. Since then, the attacks have subsided, he said.
Another well-known troll has spammed naked photos of himself on profiles, while consistently posting video rants against those who cross him on YouTube. "It's pathetic, really," the MySpace Democrats moderator said. "You really have to wonder about the sanity of a guy who would troll with naked pictures of himself."
There was success in stopping one prolific troll known as "The Punisher" after the teenager left too many bits of personal information scattered around the Internet, said Chris Boyd, security research manager for Facetime Communications, who has extensively researched MySpace abuses. A call to the youth's high school principal prompted the attacks to stop, Boyd said.
MySpace spokeswoman Jamie Schumacher said the company would not grant interviews concerning the security issues discussed in this story.
However, a document from a recent court case where MySpace sued a company for spamming peoples' profiles give some insight into the evolution of its security department.
The case, which went to arbitration, was settled last month. Scott Richter of Westminster, Colorado, was ordered to pay MySpace $4.8 million in damages and $1.2 million in legal fees in relation to an August 2006 spam campaign. Richter was accused of using compromised MySpace accounts to send unsolicited "bulletins" to thousands of MySpace users.
According to a document signed June 12 by arbiter Philip W. Boesch, MySpace as recently as two years ago "only employed two relatively junior staff employees to deal with the [spam] issues throughout the entire network."
Since then, the security staff has been increased to 30 or 40 employees, Boesch wrote. MySpace has also hired high-power leadership in April 2006. The site's chief security officer, Hemanshu Nigam, is a former computer crimes prosecutor with the U.S. Department of Justice.
All of the spam, trolling and other cybervandalism are against the MySpace's "Terms of Use Agreement." But during the Richter trial, MySpace's director of security and enforcement, E. J. Hilbert, highlighted problems in enforcing the document.
"As Mr. Hilbert testified, nobody reads it," Boesch wrote.
No comments:
Post a Comment