Blog Owners Report Disabled Blogger Accounts

This week, we're seeing a few reports, in Blogger Help Forum: Something Is Broken, of disabled Blogger and GMail accounts, again with ominous warnings of "suspicious activity" or "unusual activity" on your account.

Besides a disabled Blogger account, loss of AdSense, Blogger, Picasa, and other services is reported. This is similar to an earlier experience from May 2011.

In many cases, people with disabled accounts should be automatically redirected to Google Accounts Help: Account has been disabled.

Start with the generic "disabled account" instructions.

You can start there, where you are advised, generically, why accounts are being disabled.

If your account was not righteously disabled, you'll find the appropriate instruction in the last paragraph.

Please start by reviewing the relevant Terms of Service. Then, if you think your account should not have been disabled, please contact us.

Clicking on "contact us", you see Google Accounts Help: My account is disabled. Here, you are advised

Please summarize what happened when your account became disabled so we can investigate. We'll follow up with you only if we require more information or we have additional information to share.

Make sure that you can be contacted - anonymity is not possible, now.

Be sure to provide an active email address, for contact. When you fill out the form, this is not the time for insisting on anonymity. Selecting "No", for

Do you currently have access to the email address that you use to sign in to your account?

you are asked for

An email address we can use to contact you

If you truly want your account reactivated, provide an email account which you use, or check, frequently.

You'll have to wait, patiently, for account and blog review.

Having filled out the form, and hit "Submit", you wait, as patiently as possible. The number of similar reports, combined with the time of year (such as the first week following end of year holidays, when many people receive new computers), may cause the queue, from this form, to be processed relatively slowly.

Note that fuzzy spam classification may result in various Google accounts and assets being taken off-line and even deleted - and the accounts and assets may not all be restored immediately - or even simultaneously.

Specifically, we have noted latency on restoration of Blogger blogs, after the owning Blogger accounts are brought back on-line. If your Blogger account is a victim of "suspicious / unusual activity", allow for your blogs to be off-line 24 to 48 hours after the account has been restored. Blogger Engineers are aware that this is a problem.

---

Blog Owners Report Disabled Blogger / GMail / Google Accounts - January 2012

Why Can't Blogger Just Tell Me The Email Address?

We see the pain, in Blogger Help Forum: Something Is Broken, of blog owners who do not understand the need for keeping the name of their Blogger account a secret.

I forgot the email address that I was using. Why can't Blogger just tell me the address??

and some ask

How did this unknown person "xxxxx xxxxx" get control of my blog?

Years ago, the local police would have to convince home owners

Please, stop leaving a spare key under a rock, near the door!

Both many blog owners (today) - like some home owners (years ago) - had the same basic problem - naivete.

Like the home owners of years ago, who kept a spare key under a rock near the front door, for emergencies, blog owners will use tricks to remember their password.

Don't - please don't - use a guessable password!

One favourite technique, for remembering the password, is so obvious.

Pick a password based upon something that you can remember.

For a blog owner who is married, the answer is obvious.

What is my spouse's name?

and there's your password. If you forget that, you have worse problems, that cannot be addressed here.

If the name of one's spouse was a secret, using the name would not be a problem. But knowing that many blogs either contain the name (and picture, maybe) of the whole family - or lead to a Profile page or website (FaceBook, Instagram, Twitter, ...) with similarly useful information - how secret is the password going to be?

Hackers love blogs with guessable passwords.

Knowing both the Blogger account name (email address) that owns any blog of interest, and the URL of the blog, any hacker has a simple enough task.

1. Scrape blog content, into a text analyzer.
2. Extract a few hundred details (spouse's name, and others) from the blog content, as analysed.
3. Run the known details through a password generation program.
4. Now, the hacker has a database, containing "10,000 good possible passwords", specifically relevant to this blog.
5. Go to "www.blogger.com", plug in the account name, and try out the 10,000 passwords, one by one.
6. That's a simple brute force password attack.
7. Sit back, and watch any botnet, controlled by the hacker, go to work.
8. Given enough time, the hacker very likely gets access to the Blogger account, and to the blogs owned by the account.

Steps 1 - 8, for any experienced hacker, will be summed into one step.

Plug in the URL of the blog.

Everything needed is just more coding - and a nice robust botnet or two.

The hacker, of course, will be targeting thousands of different blogs, simultaneously. So what if he (she) fails to find what details she (he) needs, to steal your blog? He'll (she'll) gladly settle for another - while the botnet works on yours.

Besides using a "strong" password (which carries it's own risks such as forgetting the password - and now we're here, again), the best way to prevent a brute force attack is by preventing step 5.

Keep the account name / email address a secret.

Additionally, if you have a blog and a business - or otherwise exchange email with strangers, separate your Blogger / Google account and your email account. Use two separate email addresses, for Blogger and email.

Learn to appreciate efforts made, by Google, keeping your account and blogs safe.

If you need to recover access to your Blogger account, don't expect to use the Blogger "Forgot?" wizard, plug in your blog URL, and get a reply

Email was sent to your address xxxxxxx@yyyyy.zzz

And, if you post in the forum.

Please email me advice, to "xxxxxxx@yyyyy.zzz"!

expect to get a stern warning

Please, do not post Blogger account names, or email addresses, in the forum.

People objecting to the recent Blogger policy of masking email addresses, in Blogger commenting and similar services, as "no-reply @ blogger . com", may also need to consider this very real issue. Possibly, even use Google+, instead of Blogger commenting, for networking with ones peers.

Google tries to identify brute force attacks, and takes action when possible.

And, if your Blogger / GMail / Google account is disabled - and you get a mysterious notice about

Suspicious / Unusual activity on your account

this could well be the other side of a brute force attack against your account, intercepted by Google.

Don't be offended by the various precautions.

• The unpopular "24 to 48 hour" waiting period, which you endure after getting the account enabled.
• The painful diagnosis of "hacking detected" against your account (aka "suspicious" / "unusual" activity).
• The annoying inability to access your Blogger account, when traveling.

If you find the precautions and problems to be unacceptable, consider using Google 2-step verification, to protect your account against brute force hacking.

This is not fiction here - it's all very real.

None of this is fiction or paranoia - it's based on some very real, recent events, and even involves a recent National Scandal - and leads to some very real conundrums.

Similarly, we have a very distasteful answer, to a seemingly worthy need. And another apparently "ceremonial" but necessary answer, to somebody in need of understanding and support, that can't be provided.

You have to make the effort, to maintain and protect your blog.

You will get no sympathy, when you complain how unsupportive Blogger is.

You have to make some effort - and remember some basic information - if you are going to maintain a Blogger blog. And, encourage your friends to keep their accounts and blogs safe.

What Is "403 Forbidden"?

In terms of Blogger problems, which occur seemingly randomly and have no obvious user solution, I can't think of too many that bring more dread into peoples hearts than

403 Forbidden

That message is actually where I started this blog - many, many years ago. It's come up, in discussion, several times.

The message "403 Forbidden" is literally a response by a computer somewhere, saying that you are not permitted to access this computer. For Blogger / Google customers, it generally has a slightly different origin.

The "403 Forbidden" message, for Blogger blog owners, is frequently the result of a networking technique, used by Google and owners of other large networks, for blocking suspicious network traffic.

"403 Forbidden" refers to suspicious network traffic, maybe from a bot cluster.

It generally means that some group of computers, in your ISPs address space, are controlled by somebody besides their legal owners - and are generating excessive network traffic which the Google networks are detecting as suspicious. The "suspicious activity" may involve brute force password guessing, or botnet driven new blog setup activity, or maybe excessive relaying of referer spam.

Some other Blogger account owner(s), somewhere else in the world, may be seeing a "Disabled account" notice, referring to "suspicious activity on your account", or maybe odd links to pornographic websites, from the Stats logs.

Google initially blocks the general address space, to examine the problem.

In order to continue service to the world in general, Google will block the problem computers, from access to their networks. If the Internet address used by your computer is similar to the addresses used by the problem computers, Google will block your computer, along with the other computers (your neighbours computers).

You may have to wait this problem out, as Google researches it.

If this happens to you, there's probably nothing that you can do but wait this out. One or more things will happen, eventually.

1. Other Google users will report the symptom - or validate their identity - and Google will research the problem.
2. Google will research the problem, reduce the range of addresses blocked, and remove the block on your specific address space.
3. The computers involved will go offline, or otherwise cease their attacks, and Google will remove the network block.

If you know how to, and if your Internet service allows you to do this, you may be able to change your Internet address. This solution won't be universally effective, though.

• Your Internet service ("Fixed IP") may not allow this.
• You may not know how to do this.
• Your Internet service may detect this change, by you, as suspicious activity.
• Your new address may also be blocked by Google, because of activity by another set of problem computers.
• Your new address may be blocked by another Internet service, and you'll have to start over with them.

So right now, I'll not go into the details of changing your address - though you may try doing this, if you wish. It's your computer, after all.

The Attack Of The Clones

One noticeable spam problem became visible in late 2009, thanks to yet another Blogger error.

This error left a lot of bloggers (some legitimate and others actually spammers) reporting both confusion and indignation.

The confusion was seen, in two (seemingly) separate topics of indignation.

My blog seems to be locked, but when I fill out the CAPTCHA, I get

Your blog is not locked, and does not need review.

What do I do, now?

and

My blog is not spam! Honestly, how could Blogger legitimately call my blog spam?

Both of these reports, echoed by dozens of bloggers and spammers, show two sides of the same story.

The first report was typically about blogs that were righteously locked - yet a mistake caused the message

Your blog is not locked, and does not need review.

The second report exemplifies the despair and frustration felt by thousands of honest people who simply want to publish to their blogs. And there are dozens of similar, and dissimilar reports.

Note: This isn't fiction - I'm not stealing content from the Tom Clancy "Net Force" novels. This is real.

Spammers publish new blogs, constantly, using botnets.

Spammers, in order to publish one or two active splogs (blogs containing actual hacking, porn, and / or spam content), use the power of the Internet. Each splog publisher ("splogger"), who may have at his control thousands of hijacked computers, publishes thousands of blogs each day.

A spammer starts with empty blogs, which do not appear spammy.

A splogger starts by simply publishing empty blogs, in a constant, all day activity. You may see the empty blogs some time, if you go "Next Blog" surfing. They have a title, an archives gadget in the sidebar, and maybe one or two posts with random garbage. And a Profile gadget, with a link to the "owner", each "owner" with 10 blogs.

He then adds random content, scraped from the web - maybe, from your blog.

The splogger next takes one legitimate blog - in this case, your blog. He scrapes content from your blog, takes a dozen or so of his empty blogs, adds your content to each, and republishes each blog. Now, there are a dozen clones of your blog, plus your original, in BlogSpot.

He then adds spammy content, to a few of his blogs.

Next, the splogger takes a couple of his recently created clones, adds the payload - hacking, porn, and / or spam content, or possibly, links to other blogs or websites containing the payload - and republishes his now active splogs.

Each time, he just uses a couple blogs (cloned from your blog), and keeps the others as reserve. He has dozens of other splogs with active content out there too, using content scraped from other legitimate blogs. The clones of your blog, joining the clones of other blogs, are now active members of his splog farm.

As Blogger deletes discovered spammy blogs, the spammer uses more like yours.

As the splogs with active content are detected and removed by Blogger, the splogger simply activates other reserves, placing payload into each, in turn. By the time all of the reserves, that are clones of your blog, are used up, the well designed spam blog farm will have clones of still more legitimate blogs, ready to be activated.

A spam blog has a distinctive life cycle.

Considering this process, we see the 5 Stage life cycle, of each blog in the splog farm.

1. Empty (just published).
2. Reserve (previously empty, republished with scraped content added).
3. Active (previously reserve, republished with payload added).
4. Detected (previously active, locked by the Blogger Spam Classification bot).
5. Deleted.

The plan here is that each splog will pass through each stage in the life cycle, in proper sequence. Since the splogger publishes thousands of splogs daily, if Blogger were to simply lock then delete the active splogs, the splogger simply activates the reserve splogs, as needed. This is good project management, by the sploggers.

Blogger shortens the life cycle, using fuzzy blog identification.

Blogger aims to shorten the splog life cycle. When the anti-spam bot detects an active splog, they search their database of suspected splogs, find similar blogs with no active content (the reserves), and lock the reserves too.

Unfortunately, when Blogger locks the reserve splogs, they are also going to lock your blog. Fuzzy spam detection techniques can't tell the difference between your blog, and the clones, because there is no difference.

If a spammer clones your blog, your blog will look just like a spam blog.

A successful clone is a non distinguisable replica of the original blog. Your blog looks like one of the reserve splogs. This leaves you, and bloggers like you, reporting

My blog is not spam! Honestly, how could Blogger legitimately call my blog spam?

If the spam blogs went untouched, the search engines would index your blog.

When you look at this differently, though, you see that Blogger is actually helping you. Were your blog, and the clones, to remain in BlogSpot undisturbed, the search engines would see the clones, and levy a huge duplicated content penalty on all aliases of the content - including your original blog.

If you are able to declare your blog as legitimate to Blogger, Blogger can later delete the sploggy clones - and the search engines will, hopefully, continue to index your blog, as legitimate and unique content.

In 2012, Blogger took the Next Step, and made "Next Blog" a less productive launching ground for splog farms. With blog owners carelessly deleting and renaming their blogs, however, the blog clone farm continues as a useful model for spam distribution.