45

We've been having a sock-puppet attack on the GameDev Stack Exchange site over the last few days. I am not fully aware of the details but there seem to be two exploits being used:

First - the threshold for flagging comments and having them auto-delete seems to be way too low. With enough accounts - this guy seems to be able to delete other people's comments at-will. (Including comments by people with vastly more rep.)

GDSE mod Tetrad tells me that the tools for detecting and reversing this are very limited. I think there needs to be some kind of counter-balance to the automatic deletion. Either a higher threshold, or a easier way to restore comments after an attack like this.

His latest tactic for using this is as follows: He deletes a bunch of comments, then, using the same username as an existing user, posts a fake screenshot of the comments with people saying inflammatory things. He then deletes any comments that point out that the screenshot or his account is fake.

Second - the guy seems to be able to rapidly recreate accounts on the GDSE, from the same original SO account as its "base" account, giving him an account with 100 bonus starting rep.

Specifically this account created this account - which was soon deleted (don't know by who) - only for him to immediately create this account.

This is particularly impacting GDSE at the moment, as we're currently holding moderator elections over there. This guy's doing everything he can do attack one of the candidates.

  • 2
    Looks like it is the same user as in meta.stackexchange.com/questions/184842/… – fuxia Jun 18 '13 at 8:56
  • Meta GameDev would have been more appropriate for this, and the issue has already been raised there: How can the moderators and community managers ensure a fair election? – yannis Jun 18 '13 at 8:57
  • 24
    @Yannis Actually this Meta seems to be labeled as being OK for questions about the SE Network (see the text on the "Ask Question" page). I feel this needs to be reported to the network folks (not the GDSE mods - who are obviously well aware of this ongoing issues). Especially as it involves possible exploits of the SE software. – Andrew Russell Jun 18 '13 at 8:59
  • 2
    This question appears to be off-topic because it is about an issue on the Gamedev Stack Exchange. Such issues should be raised in their Meta: meta.gamedev.stackexchange.com – Bart Jun 18 '13 at 8:59
  • @AndrewRussell Didn't mean to imply that posting here was wrong, just that the site's own Meta would have been a better place for your question. Also, if you check the question I linked to you'll notice that SE is already aware of this (Anna, a community manager, has posted an answer there). – yannis Jun 18 '13 at 9:01
  • 25
    @Bart These exploits are applicable network-wide. They just happen to be currently being employed there. – John Dvorak Jun 18 '13 at 9:06
  • 1
    @Yannis Fair enough. I shall leave this here though, as I'm still of the opinion that this is something that could be improved in the SE software. This guy is especially bad - he's using the username of existing users, then and posting fake screenshots of inflammatory comments by other users. Then he deletes the comments of anyone calling him out for it. – Andrew Russell Jun 18 '13 at 9:09
  • 1
    I agree with posting here (though, it should be a little bit cleaned up and more generalized), but if it comes to getting help when you need it immediately you should go to chat, contact your moderators and/or devs directly instead of posting it on Meta. – Time Traveling Bobby Jun 18 '13 at 9:10
  • @JanDvorak Myeah. In hindsight...no big deal to leave it here. I'm sure they are on to this user anyway. Given his comments on SU, this users merely seems to be proving a point. – Bart Jun 18 '13 at 9:10
  • 1
    @M.NightDemonbobby Yep. I should mention that I did try chat (no one online), and I don't have contact details for our mods. – Andrew Russell Jun 18 '13 at 9:16
  • So your basic point is that once an account has been deleted, a new one can be created and again gets the association bonus? In that case said user should not be deleted but be put on suspension. – Tobias Kienzler Jun 18 '13 at 9:16
  • @Tobias TBH I'm not 100% sure how it works (did he delete his own account? I think so, but I'm not sure). Just that it's a problem. – Andrew Russell Jun 18 '13 at 9:23
  • @AndrewRussell Posting on the site's Meta is a great way of getting the mods' attention, mods get inbox notifications for all Meta questions (but not for questions on MSO). Also, you shouldn't really worry for SE missing a somewhat urgent Meta question because it was posted on the site's Meta and not MSO. Mods have a direct line to SE, and we are extremely skilled at relentlessly harassing Community Managers if need be. – yannis Jun 18 '13 at 9:27
  • 1
    In that case you should flag a post by the user and state your concerns. Maybe also do so at the SE site where said user gets their rep bonus from. This sounds like a case of inter-site abuse so meta.SO is the correct place IMHO – Tobias Kienzler Jun 18 '13 at 9:27
  • 1
    He's deleting comments? Seems like we should be enabling him, if anything. – casperOne Jun 18 '13 at 11:58
40

I just vaporized a bunch that were copying answers on Stack Overflow to farm enough rep to game the association bonus, and I'm keeping an eye on it. A few of those accounts were initially deleted just on Stack Overflow and not network wide, this was before I realized the scope of what the person was doing. Initially, it just looked like someone rep farming socks on SO, something we see every day. They can try to come back, but they'll have to start from scratch.

Now that we know exactly what's going on - this is excruciatingly easy to deal with. They will get tired of trying to farm rep to keep this up way before I get tired of pushing my new favorite button. Additionally, even with the association bonus, they still won't be able to get enough rep to actually vote - so please don't worry too much about it.

As for the comments, I'm going to have a look now and see what I can do sure any legitimate comments that were spam flagged by this fool are now restored.

Update (12/13)

Systems recently put into place will stop the bulk of this sort of tomfoolery very quickly, based on the actions that you take as a moderator. You might get a little noise here and there, but the vast majority of it won't have a chance to even get into the system.

This was one of the specific design goals of the new system, and we did a pretty good job meeting it. In this severe of an instance, it might require a little manual help from us, but in all honesty this was quite the test case, and the work on our end would be minimal.

  • 10
    ...and perhaps we should stop counting the association bonus for the 150 rep required to vote in an election. /shameless self-plug – yannis Jun 18 '13 at 10:04
  • 1
    +1 for vaporization! :) – Travis J Jun 18 '13 at 10:06
  • Marvelous. Thank you. – Andrew Russell Jun 18 '13 at 10:09
  • 2
    Worth noting - the mods on the rest of the network currently active are also onto this, and they're watching closely. There's a lot of very patient people just waiting to see if they try it again. I think we've got it well in hand. – Tim Post Jun 18 '13 at 10:12
  • So - do you think this is something that requires re-thinking of how either of these two features (flagging, account recreation) work - from the point of view of their exploitability? Or is it a once-off thing and pretty-much sorted? – Andrew Russell Jun 18 '13 at 10:14
  • Also - this user just got called out in GDSE chat - new account, single answer, rapidly upvoted - with content copied from another site. And he has a Constituent badge with only 19 rep!? – Andrew Russell Jun 18 '13 at 10:17
  • 1
    Can you at least send a Stack Overflow shirt to the sock puppeteer for his efforts? With the text "We won, you lose"? :D – Shadow Wizard Jun 18 '13 at 10:17
  • 13
    @ShaWizDowArd A pair of Stack Overflow socks would be more appropriate than a shirt, don't you think? – yannis Jun 18 '13 at 10:19
  • Please check the Constituent badge page for GDSE and find a bunch of low-rep users - most are obviously the sock puppet guy - seemingly casting votes? Are they actual votes? I thought there was a 150-rep threshold?? – Andrew Russell Jun 18 '13 at 10:19
  • @Yannis genius! Dirty socks, of course. :) – Shadow Wizard Jun 18 '13 at 10:21
  • 2
    @AndrewRussell who is this user you speak of? <big, fat cheshire grin> – Tim Post Jun 18 '13 at 10:22
  • @AndrewRussell I did go through the list, there were 2 or 3 that were obviously this person - also gone now. Some of these accounts had been around since may, I'm not sure how many more he actually had, but it can't be too many. – Tim Post Jun 18 '13 at 10:31
  • Shouldn't it be impossible for him to get that badge at all, though? Or does the software give it to you even if your vote doesn't actually count? – Andrew Russell Jun 18 '13 at 10:32
  • 4
    Good to know the StackExchange Interpol never sleeps :-7 – Tobias Kienzler Jun 18 '13 at 11:19
  • 1
    @BoltClock Good evening then :-) Let me rephrase this: Just like in the British Empire, someone is always awake on SE – Tobias Kienzler Jun 18 '13 at 11:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .