Charcoal HQ

SevenSidedDie

00:00

A link + repeated words miss: rpg.stackexchange.com/a/91616

Seems unlikely as a miss, but I guess it could have just been when Smokey was down though.

Rob

@Undo If you're able to get something to overrun a buffer with your input, your input can become executable machine code

Undo

!!/test t90xplodecanada.us/rejuvonus-cream-review

@Rob How do you make sure it gets executed, though?

Rob

Well, that's the hard part ;)

One way to do it is to overwrite x number of bytes with NOPs

and hope whatever called the vulnerable code jumps into it

at the end of your NOPs you place your desired paylaod

Undo

And by doing that, you increase the width of your payload and thus the chance that something jumps into the memory you overwrote with your nastyness.

Huh, makes sense

Rob

Basically, yeah

Undo

00:06

!!/test supplementlab.org/stack-xtreme

SmokeDetector

> Url in title, pattern-matching website in body, pattern-matching website in title
----------
Title - Position 8-25: supplementlab.org
Title - Position 1-25: http://supplementlab.org
Body - Position 8-25: supplementlab.org

SevenSidedDie

Haven't found more more spellcaster spam, but here's another odd one. It's a copy-paste from elsewhere on the page with a URL tacked on the end. Gardening spam, of all things: rpg.stackexchange.com/a/90657

URL is http://www.tnnursery.net/maple-trees/

Thomas Ward

!!/test tnnursery.net/maple-trees

SmokeDetector

> Url in title
----------
Title - Position 1-25: http://www.tnnursery.net

Undo

mostly copied from another answer. Clever.

Thomas Ward

00:07

heh

SevenSidedDie

Oh, here's an interesting one. Spellcaster spam, and they double-spammed by commenting on their own post: rpg.stackexchange.com/a/88966

Kaz Wolfe

@SevenSidedDie on an rpg question about spells? cool.

dorukayhan

> WATSAP

how hard could it possibly be to at least pay attention to spelling

Kaz Wolfe

Also, how do you become a verified spell caster? Is there like a test or something?

5

SevenSidedDie

@dorukayhan It's likely on purpose. Makes it harder to catch with filters.

Undo

00:13

hard. Exhibit A: stackoverflow.com/questions/tagged/android

SevenSidedDie

@KazWolfe Most of our spellcaster spam is. It's almost like they think their spam will fit right in. ^^

Kaz Wolfe

@SevenSidedDie So you're saying is that these are the LARPers that take things too far and forget about reality?

NobodyNada

Why weren't those caught by "Bad keyword with email?" It checks for spell(caster)? on line 136 of findspam

Kaz Wolfe

@NobodyNada IIRC smokey has a detection threshold, and those aren't spammy enough to trigger Smokey's "o noes" mode.

(ofc i have no actual idea because i'm not here too often ^~^)

SevenSidedDie

@KazWolfe Nah, Peter David Carter-Poulsen spelled better.

NobodyNada

00:20

@KazWolfe Doesn't seem like it; keyword_email's logic is just if keyword and email, and it's directly in the list of checks.

SevenSidedDie

One more spellcaster: rpg.stackexchange.com/a/88932

Kaz Wolfe

@NobodyNada oh, i see. who knew that my reading the code would actually answer the questions and make me seem less dumb? lol

Undo

Email + Phone number at the end of a post might be a decent trigger

SevenSidedDie

FWIW my edit on that was just to revert it to its original form after someone “helpfully” removed the email address.

NobodyNada

hmm... spell with an email should be triggering the filter

SevenSidedDie

00:22

@NobodyNada Wouldn't that get too many FP with the words-letters meaning of “spell”?

NobodyNada

but emails in posts are rarely legitimate

Kaz Wolfe

@NobodyNada right, but the majority of RPG.SE posts don't have e-mails so they don't raise flags.

NobodyNada

!!/test hacker [email protected]

SmokeDetector

> Would not be caught for title, body, and username.

NobodyNada

...what?

Anonymous

00:23

@SevenSidedDie What on earth? I feel dumber after reading that.

Undo

@NobodyNada There's a reasonably high frequency of "plz send teh codez to [email protected]" on SO

Kaz Wolfe

!!/test-q magic [email protected]

SmokeDetector

> Would not be caught as a question.

Kaz Wolfe

oh, wait, i'm dumb.

!!/test-q spell [email protected]

SmokeDetector

> Bad keyword with email in body
----------
Post - Keyword *spell* with email [email protected]

SevenSidedDie

00:24

@Mego Can you imagine who falls for these?!

Kaz Wolfe

there we go.

NobodyNada

!!/test-a hacker [email protected]

SmokeDetector

> Would not be caught as an answer.

NobodyNada

ohhhhh, example.com doesn't count as an email

Anonymous

@SevenSidedDie Hedge witches, probably

Kaz Wolfe

00:25

!!/test-a spellcaster [email protected]

SmokeDetector

> Bad keyword with email in answer
----------
Post - Keyword *spellcaster* with email [email protected]

Kaz Wolfe

yeah, so that does throw a trigger.

SevenSidedDie

@Mego You'd think they wouldn't need Dr. Midnight's help.

Kaz Wolfe

@SevenSidedDie But he has a cool, edgy name!

NobodyNada

!!/test-a A great spell caster called ([email protected]) blablabla [email protected]

SmokeDetector

00:25

> Bad keyword with email in answer
----------
Post - Keyword *spell* with email [email protected]

NobodyNada

then why was that not caught?

SevenSidedDie

@NobodyNada Smokey must've been down?

Undo

We might not have had that implemented in oct '16

NobodyNada

I was wondering that too; I'll check

Kaz Wolfe

@SevenSidedDie i feel like there's a good story here that I can't see.

SevenSidedDie

00:27

Hm, almost identical to the last one: rpg.stackexchange.com/a/88812

Kaz Wolfe

github.com/Charcoal-SE/SmokeDetector/blob/…

no it was there on october 5.

I'd usually attribute that to not testing in prod, but I remembered this is Charcoal SE.

!!/test-q baba ji

SmokeDetector

> Bad keyword in body
----------
Body - Position 1-8: baba ji

Kaz Wolfe

!!/test-q babaji

SmokeDetector

> Bad keyword in body
----------
Body - Position 1-7: babaji

SevenSidedDie

For contrast here's one Smokey caught: metasmoke.erwaysoftware.com/post/40951

Here's one last one for now. It's not spellcaster spam, but it's the same basic template but for a greed scam: rpg.stackexchange.com/a/86914

Undo

00:37

$36,000,00 sounds like a lot of money

NobodyNada

should have been caught, it contains "hacking" with an email

Rob

not in Zimbabwe

Kaz Wolfe

Blank ATM card? Um.... that one is literally impossible.

i mean, yeah, you could get a copy of a skimmed card, but that only goes so far, and you can't dynamically generate chip cards.

SevenSidedDie

@KazWolfe Hm, looks like all his posts on RPG were downvoted far enough that they're deleted now. Looks like you can taste some of the rainbow of weirdness on various SEs and metas by searching for mentions of the name on chat.SE: chat.stackexchange.com/search?q=peter+david+carter . He got around quite a bit before the network banhammer dropped.

Kaz Wolfe

@SevenSidedDie i'll browse through data.SE too

SevenSidedDie

00:41

@KazWolfe Spammers only need 1 in a few thousand to fall for their dumbness. :/

Email + testimony or testimonies might be a useful check?

I notice even the ATM scam there says “testimony”. They seem to like that word for some reason.

Kaz Wolfe

@SevenSidedDie oh my. one of those users.

SevenSidedDie

@KazWolfe Most of their posts on RPG were either asking how to better blur the line between life and their games, or asking for help understanding why they were getting banned from their local RPG clubs when doing that. That's why your message reminded me of him. :)

Kaz Wolfe

@SevenSidedDie yeah, i see a heap of "why was my question deleted" posts everywhere.

SevenSidedDie

Their Workplace posts were similarly odd, with a whiff of either making stuff up or honestly not being able to keep track of reality.

Kaz Wolfe

@SevenSidedDie well, if i get bored, i have another profile to stalk through.

SmokeDetector