Blogs, too, can trick users to host spam

Blogs may be good to read but the blog you just visited and commented on, could be a storehouse of spam having links (URLs) pointing to pages that use social engineering tricks and infect your computer.

Splog or spam blog, are weblog sites designed to host spam and promote affiliate websites. These blog sites usually have nonsensical or ‘trash’ data, or don’t contain any real content at all. At times they even include contents stolen or ‘scraped’ from other weblogs and legitimate sites. However, they do contain links, ads and or banners to the aforementioned advertised affiliated websites. “On the other hand, we have what is called ‘spam in blogs’ or ‘comment spam’.

Spam in blogs is posting of comments, links or ads in clean, legitimate and real blog sites, wikis, forums and discussion boards found in the Internet. Spammers take advantage of these public mediums where they can leave their spam comments or links — any web application therefore that accepts and displays hyperlinks submitted by visitors may be a target,” said Abhinav Karnwal, APAC Technical Marketing Manager, Enterprise, Trend Micro.

Blog comments, instant message spam and malicious text ads are leading drivers to send users to these fake codec websites. Shantanu Ghosh, vice-president, India Product Operations, Symantec noted that attackers often use blog comment fields to post such links. Quite often, these comments have some catchy phrases to entice visitors to click on the link. By one estimate, about one in five blogs are spam blogs.

Analysts refer to Twitter, a social networking and micro-blogging service, affected by fake profiles that are proliferating in the micro-blogging site, initially annoying legitimate users with notifications. Such notifications could lead users to check out the ‘spammy’ profiles out of curiosity. Also in a recent prank, Twitter entries showed up containing links preceded by the warning ‘Don’t Click’, thus tricking curious users into actually clicking the link which inturn creates an exact copy of the entry, but on the clicker’s profile this time.

Analysts say that around 20 per cent of the reviewed blogs are classified as spam. So as a curious user, you will have to be careful while visiting blogs, reading and writing comments there because Trojans and other malware can appear as blog comments and other code embedded on web pages.

Some of the commonly used security measures include the use of Captcha that displays a combination of numbers and letters embedded in an image which must be entered literally into the reply form to be able to publish the content. “Blocking specific words from posts is one of the simplest and most effective ways to reduce spam,” said Kartik Shahani, Regional Director, McAfee India.

A word of caution here is that if a blog expects you to download and install something or expects you to share your personal details, most probably it is fishy. “Many blogs expect you to provide your email address be sure that you share your mail id only if you believe it would be not misused. Spammers and Phishers normally harvest open forums, blogs or social networks to build their spam databses,” cautions Vikas Desai, Lead Technology Consultant, India and SAARC, RSA, The Security Division of EMC.