47

We've been having a sock-puppet attack on the GameDev Stack Exchange site over the last few days. I am not fully aware of the details but there seem to be two exploits being used:

First - the threshold for flagging comments and having them auto-delete seems to be way too low. With enough accounts - this guy seems to be able to delete other people's comments at-will. (Including comments by people with vastly more rep.)

GDSE mod Tetrad tells me that the tools for detecting and reversing this are very limited. I think there needs to be some kind of counter-balance to the automatic deletion. Either a higher threshold, or a easier way to restore comments after an attack like this.

His latest tactic for using this is as follows: He deletes a bunch of comments, then, using the same username as an existing user, posts a fake screenshot of the comments with people saying inflammatory things. He then deletes any comments that point out that the screenshot or his account is fake.

Second - the guy seems to be able to rapidly recreate accounts on the GDSE, from the same original SO account as its "base" account, giving him an account with 100 bonus starting rep.

Specifically this account created this account - which was soon deleted (don't know by who) - only for him to immediately create this account.

This is particularly impacting GDSE at the moment, as we're currently holding moderator elections over there. This guy's doing everything he can do attack one of the candidates.

Improve this question
19
  • 2
    Looks like it is the same user as in meta.stackexchange.com/questions/184842/…
    – fuxia
    Commented Jun 18, 2013 at 8:56
  • Meta GameDev would have been more appropriate for this, and the issue has already been raised there: How can the moderators and community managers ensure a fair election?
    – yannis
    Commented Jun 18, 2013 at 8:57
  • 24
    @Yannis Actually this Meta seems to be labeled as being OK for questions about the SE Network (see the text on the "Ask Question" page). I feel this needs to be reported to the network folks (not the GDSE mods - who are obviously well aware of this ongoing issues). Especially as it involves possible exploits of the SE software.
    – Andrew Russell
    Commented Jun 18, 2013 at 8:59
  • 2
    This question appears to be off-topic because it is about an issue on the Gamedev Stack Exchange. Such issues should be raised in their Meta: meta.gamedev.stackexchange.com
    – Bart
    Commented Jun 18, 2013 at 8:59
  • @AndrewRussell Didn't mean to imply that posting here was wrong, just that the site's own Meta would have been a better place for your question. Also, if you check the question I linked to you'll notice that SE is already aware of this (Anna, a community manager, has posted an answer there).
    – yannis
    Commented Jun 18, 2013 at 9:01
  • 25
    @Bart These exploits are applicable network-wide. They just happen to be currently being employed there.
    – John Dvorak
    Commented Jun 18, 2013 at 9:06
  • 1
    @Yannis Fair enough. I shall leave this here though, as I'm still of the opinion that this is something that could be improved in the SE software. This guy is especially bad - he's using the username of existing users, then and posting fake screenshots of inflammatory comments by other users. Then he deletes the comments of anyone calling him out for it.
    – Andrew Russell
    Commented Jun 18, 2013 at 9:09
  • 1
    I agree with posting here (though, it should be a little bit cleaned up and more generalized), but if it comes to getting help when you need it immediately you should go to chat, contact your moderators and/or devs directly instead of posting it on Meta.
    – Time Traveling Bobby
    Commented Jun 18, 2013 at 9:10
  • @JanDvorak Myeah. In hindsight...no big deal to leave it here. I'm sure they are on to this user anyway. Given his comments on SU, this users merely seems to be proving a point.
    – Bart
    Commented Jun 18, 2013 at 9:10
  • 1
    @M.NightDemonbobby Yep. I should mention that I did try chat (no one online), and I don't have contact details for our mods.
    – Andrew Russell
    Commented Jun 18, 2013 at 9:16
  • So your basic point is that once an account has been deleted, a new one can be created and again gets the association bonus? In that case said user should not be deleted but be put on suspension.
    – Tobias Kienzler
    Commented Jun 18, 2013 at 9:16
  • @Tobias TBH I'm not 100% sure how it works (did he delete his own account? I think so, but I'm not sure). Just that it's a problem.
    – Andrew Russell
    Commented Jun 18, 2013 at 9:23
  • @AndrewRussell Posting on the site's Meta is a great way of getting the mods' attention, mods get inbox notifications for all Meta questions (but not for questions on MSO). Also, you shouldn't really worry for SE missing a somewhat urgent Meta question because it was posted on the site's Meta and not MSO. Mods have a direct line to SE, and we are extremely skilled at relentlessly harassing Community Managers if need be.
    – yannis
    Commented Jun 18, 2013 at 9:27
  • 1
    In that case you should flag a post by the user and state your concerns. Maybe also do so at the SE site where said user gets their rep bonus from. This sounds like a case of inter-site abuse so meta.SO is the correct place IMHO
    – Tobias Kienzler
    Commented Jun 18, 2013 at 9:27
  • 1
    He's deleting comments? Seems like we should be enabling him, if anything.
    – casperOne Mod
    Commented Jun 18, 2013 at 11:58

1 Answer 1

Reset to default
41

I just vaporized a bunch that were copying answers on Stack Overflow to farm enough rep to game the association bonus, and I'm keeping an eye on it. A few of those accounts were initially deleted just on Stack Overflow and not network wide, this was before I realized the scope of what the person was doing. Initially, it just looked like someone rep farming socks on SO, something we see every day. They can try to come back, but they'll have to start from scratch.

Now that we know exactly what's going on - this is excruciatingly easy to deal with. They will get tired of trying to farm rep to keep this up way before I get tired of pushing my new favorite button. Additionally, even with the association bonus, they still won't be able to get enough rep to actually vote - so please don't worry too much about it.

As for the comments, I'm going to have a look now and see what I can do sure any legitimate comments that were spam flagged by this fool are now restored.

Update (12/13)

Systems recently put into place will stop the bulk of this sort of tomfoolery very quickly, based on the actions that you take as a moderator. You might get a little noise here and there, but the vast majority of it won't have a chance to even get into the system.

This was one of the specific design goals of the new system, and we did a pretty good job meeting it. In this severe of an instance, it might require a little manual help from us, but in all honesty this was quite the test case, and the work on our end would be minimal.

Improve this answer
21
  • 10
    ...and perhaps we should stop counting the association bonus for the 150 rep required to vote in an election. /shameless self-plug
    – yannis
    Commented Jun 18, 2013 at 10:04
  • 1
    +1 for vaporization! :)
    – Travis J
    Commented Jun 18, 2013 at 10:06
  • Marvelous. Thank you.
    – Andrew Russell
    Commented Jun 18, 2013 at 10:09
  • 2
    Worth noting - the mods on the rest of the network currently active are also onto this, and they're watching closely. There's a lot of very patient people just waiting to see if they try it again. I think we've got it well in hand.
    – user50049
    Commented Jun 18, 2013 at 10:12
  • So - do you think this is something that requires re-thinking of how either of these two features (flagging, account recreation) work - from the point of view of their exploitability? Or is it a once-off thing and pretty-much sorted?
    – Andrew Russell
    Commented Jun 18, 2013 at 10:14
  • Also - this user just got called out in GDSE chat - new account, single answer, rapidly upvoted - with content copied from another site. And he has a Constituent badge with only 19 rep!?
    – Andrew Russell
    Commented Jun 18, 2013 at 10:17
  • 1
    Can you at least send a Stack Overflow shirt to the sock puppeteer for his efforts? With the text "We won, you lose"? :D
    – Shadow Wizard
    Commented Jun 18, 2013 at 10:17
  • 13
    @ShaWizDowArd A pair of Stack Overflow socks would be more appropriate than a shirt, don't you think?
    – yannis
    Commented Jun 18, 2013 at 10:19
  • Please check the Constituent badge page for GDSE and find a bunch of low-rep users - most are obviously the sock puppet guy - seemingly casting votes? Are they actual votes? I thought there was a 150-rep threshold??
    – Andrew Russell
    Commented Jun 18, 2013 at 10:19
  • @Yannis genius! Dirty socks, of course. :)
    – Shadow Wizard
    Commented Jun 18, 2013 at 10:21
  • 2
    @AndrewRussell who is this user you speak of? <big, fat cheshire grin>
    – user50049
    Commented Jun 18, 2013 at 10:22
  • @AndrewRussell I did go through the list, there were 2 or 3 that were obviously this person - also gone now. Some of these accounts had been around since may, I'm not sure how many more he actually had, but it can't be too many.
    – user50049
    Commented Jun 18, 2013 at 10:31
  • Shouldn't it be impossible for him to get that badge at all, though? Or does the software give it to you even if your vote doesn't actually count?
    – Andrew Russell
    Commented Jun 18, 2013 at 10:32
  • 4
    Good to know the StackExchange Interpol never sleeps :-7
    – Tobias Kienzler
    Commented Jun 18, 2013 at 11:19
  • 1
    @BoltClock Good evening then :-) Let me rephrase this: Just like in the British Empire, someone is always awake on SE
    – Tobias Kienzler
    Commented Jun 18, 2013 at 11:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .