Sasi Parthasarathy sasip@microso - USENIX · • Search engines, at a very high level, care about two (2) things when ranking: – Content of the page (page‐level)

[email protected]

•  WhySpam?

•  Defini8onofSpam•  TypesofSpam:PageLevel&LinkLevel•  Newerthreats•  SecurityandSpam–hijackedsites,scareware•  Low‐Qualitypages•  ChallengingProblems

•  Aspampageisonethatusesoneormorespamtechniquestoinflateitsrankinginsearchresults,inawaythataddsnovaluetotheuser.

•  AtBing,wetrytoneutralizetheeffectofspamtechniquesonsearchranking

•  AtBing,wetakebothmanualandalgorithmicac8ononspam

•  Searchengines,ataveryhighlevel,careabouttwo(2)thingswhenranking:–  Contentofthepage(page‐level)–  Linkspoin8ngtothepage(link‐level)

•  Spammerstargetthecontentandthelinkstogainunfairadvantageoverothersinranking

•  Page‐levelspam

•  Linklevelspam

PageLevel

•  KeywordStuffing•  ParkedDomain

•  HiddenContent•  MachineGeneratedContent

•  SocialMediaSpam

LinkLevel

•  LinkFarms•  LinkExchanges

Keywordsaretypicallyaroundpopulartheme,buttheremaybemanythatareunrelatedandusedsimplytosurfacepageinunrelatedsearches

Domainparkingreferstotheregistra8onofaninternetdomainnamewithoutthatdomainbeingassociatedwithanyservices.Parkeddomainpagesarefullofads,highlyrepe88ve,andrarelyprovideinforma8vecontent.

HidingcontentfilledwithkeywordstopromotethepageTypes

•  HiddenTextonthepage•  Hiddenlinksonthepage–canberesultofhackingHow•  Use8nyfontswithsamecoloraspagebackground

•  Use<invisible>,<hidden>tags

•  <p><fontsize=1color=white>•  Rivertongymnas8cs,Lehigymnas8cs,Jordangymnas8cs,Herrimangymnas8cs,SaltLakeCitygymnas8cs,gymnas8cssaltlake,gymcatsut,gymcats

ut,parentsnightoff,parentsnightoutgymcats,gymcatsdraper,gymcatsdraper,gymnas8cscamp,•  backhandsprings,gymcatsofftrack,UtahGymcats,Gymcatsgymnas8cs,Utahgymcats,gymcats,gymcatsatthepoint,gymcat,gymcat•  Drapergymnas8cs,Bluffdalegymnas8cs,Rivertongymnas8cs,SaltLakegymnas8cs,Utahgymnas8cs,•  Bluffdaletumbling,Rivertontumbling,Drapertumbling,Draper,Bluffdale,Riverton,SaltLakeCity,Lehi,Herriman,SouthJordan,WestJordan,•  Utah,gymnas8cs,Drapergymnas8cs,BluffdaleGymnas8cs,Bluffdaletumbling,Rivertontumbling,Drapertumbling,LehiTumbling,Herriman

Tumbling,EagleMountaingymnas8cs,JordanTumbling,•  Rivertongymnas8cs,Lehigymnas8cs,Jordangymnas8cs,Herrimangymnas8cs,SaltLakeCitygymnas8cs,gymnas8cssaltlake,gymcatsut,gymcats

ut,parentsnightoff,parentsnightoutgymcats,gymcatsdraper,gymcatsdraper,gymnas8cscamp,•  backhandsprings,gymcatsofftrack,UtahGymcats,Gymcatsgymnas8cs,Utahgymcats,gymcats,gymcatsatthepoint,gymcat,gymcat•  Drapergymnas8cs,alpinegymnas8cs,Highlandgymnas8cs,AmericanForkgymnas8cs,Lehigymnas8cs,•  Bluffdaletumbling,Rivertontumbling,Drapertumbling,Draper,84065,84095,84020,84043,Herriman,SouthJordan,WestJordan,•  Utah,gymnas8cs,Drapergymnas8cs,BluffdaleGymnas8cs,Bluffdaletumbling,Rivertontumbling,Drapertumbling,LehiTumbling,Herriman





Tumbling,EagleMountaingymnas8cs,JordanTumbling,•  </p>

<divstyle="width:150px;height:1px;padding:0px;font:11pxTahoma;overflow:hidden;">

•  <ahref="hlp://medicalpioneers.com/images/thumbs/v9/viagra‐ivf‐frozen‐embryo.php">viagraivffrozenembryo</a><ahref="hGp://www.snugjazz.com/siteold/log/viagra‐or‐cialis‐which‐is‐healthier.php">viagraorcialiswhichishealthier</a><ahref="hGp://medicalpioneers.com/images/thumbs/v9/viagra‐user‐staNsNcs.php">viagrauserstaNsNcs</a><ahref="hlp://www.seafdec.org/cms/language/v8/suppository‐viagra‐100mg.php">suppositoryviagra100mg</a><ahref="hlp://www.snugjazz.com/siteold/log/viagra‐patent‐length‐cialis‐levitra.php">viagrapatentlengthcialislevitra</a><ahref="hlp://www.seafdec.org/cms/language/v8/gm‐spends‐millions‐on‐viagra‐salaried‐employees.php">gmspendsmillionsonviagrasalariedemployees</a><ahref="hlp://www.seafdec.org/cms/language/v8/viagra‐m‐portugal.php">viagramportugal</a><ahref="hlp://www.seafdec.org/cms/language/v8/laughing‐gas‐viagra‐and‐lipitor.php">laughinggasviagraandlipitor</a><ahref="hlp://www.snugjazz.com/siteold/log/women‐who‐take‐cialis‐heart‐alack.php">womenwhotakecialisheartalack</a><ahref="hlp://medicalpioneers.com/images/thumbs/v9/mmm‐viagra‐t‐shirts.php">mmmviagratshirts</a><ahref="hlp://www.snugjazz.com/siteold/log/so0‐sale‐in‐europe‐viagra‐cialis‐levitra.php">so0saleineuropeviagracialislevitra</a><ahref="hlp://medicalpioneers.com/images/thumbs/v9/viagra‐developed.php">viagradeveloped</a><ahref="hlp://www.snugjazz.com/siteold/log/instruc8ons‐for‐taking‐viagra‐cialis‐levitra.php">instruc8onsfortakingviagracialislevitra</a><ahref="hlp://medicalpioneers.com/images/thumbs/v9/women‐viagra‐study‐low‐testosterone.php">womenviagrastudylowtestosterone</a><ahref="hlp://www.snugjazz.com/siteold/log/cialis‐costume.php">cialiscostume</a><ahref="hlp://medicalpioneers.com/images/thumbs/v9/how‐to‐make‐viagra‐and‐alcohol.php">howtomakeviagraandalcohol</a><ahref="hlp://medicalpioneers.com/images/thumbs/v9/take‐too‐much‐viagra‐stuffy‐nose.php">taketoomuchviagrastuffynose</a><ahref="hlp://www.seafdec.org/cms/language/v8/what‐happens‐iif‐a‐woman‐takes‐a‐viagra.php">whathappensiifawomantakesaviagra</a><ahref="hlp://www.snugjazz.com/siteold/log/ii‐bathtubs‐cialis.php">iibathtubscialis</a><ahref="hlp://www.seafdec.org/cms/language/v8/footwear‐sell‐viagra.php">footwearsellviagra</a><ahref="hlp://www.seafdec.org/cms/language/v8/viagra‐lisinopril.php">viagralisinopril</a><ahref="hlp://www.snugjazz.com/siteold/log/bri8sh‐cialis.php">bri8shcialis</a><ahref="hlp://medicalpioneers.com/images/thumbs/v9/viagra‐for‐female‐2008.php">viagraforfemale2008</a><ahref="hlp://www.snugjazz.com/siteold/log/discussion‐groups‐viagra‐vs‐cialis.php">discussiongroupsviagravscialis</a><ahref="hlp://www.seafdec.org/cms/language/v8/viagra‐dose‐speed.php">viagradosespeed</a><ahref="hlp://medicalpioneers.com/images/thumbs/v9/viagra‐and‐iraq.php">viagraandiraq</a><ahref="hlp://www.seafdec.org/cms/language/v8/viagra‐clinical‐trials‐phosphodiesterase‐inhibitors.php">viagraclinicaltrialsphosphodiesteraseinhibitors</a><ahref="hlp://www.snugjazz.com/siteold/log/suppliers‐of‐viagra‐cialis‐levitra.php">suppliersofviagracialislevitra</a><ahref="hlp://medicalpioneers.com/images/thumbs/v9/viagra‐from‐beijing.php">viagrafrombeijing</a><ahref="hlp://www.snugjazz.com/siteold/log/uk‐online‐viagra‐cialis.php">ukonlineviagracialis</a><ahref="hlp://medicalpioneers.com/images/thumbs/v9/low‐testosterone‐viagra‐gel‐group.php">lowtestosteroneviagragelgroup</a><ahref="hlp://medicalpioneers.com/images/thumbs/v9/viagra‐changes‐in‐vision‐ischemic‐op8c‐neuropathy.php">viagrachangesinvisionischemicop8cneuropathy</a><ahref="hlp://www.seafdec.org/cms/language/v8/how‐long‐effec8ve‐viagra‐cialis‐levitra.php">howlongeffec8veviagracialislevitra</a><ahref="hlp://medicalpioneers.com/images/thumbs/v9/coldwell‐banker‐viagra‐board.php">coldwellbankerviagraboard</a><ahref="hlp://www.seafdec.org/cms/phocadownload/SP/v/viavra.php">viavra</a><ahref="hlp://www.snugjazz.com/siteold/log/hot‐dogs‐and‐cialis.php">hotdogsandcialis</a><ahref="hlp://medicalpioneers.com/images/thumbs/v9/template‐of‐viagra.php">templateofviagra</a><ahref="hlp://www.snugjazz.com/siteold/log/buy‐pfizer‐viagra‐cialis‐levitra.php">buypfizerviagracialislevitra</a><ahref="hlp://medicalpioneers.com/images/thumbs/v9/viagra‐side‐effects‐depression.php">viagrasideeffectsdepression</a><ahref="hlp://medicalpioneers.com/images/thumbs/v9/viagra‐for‐free‐in‐usa.php">viagraforfreeinusa</a><ahref="hlp://www.seafdec.org/cms/language/v8/viagra‐banned.php">viagrabanned</a><a

</div>

•  Contentiss8tchedwithkeywordstakenfromquerylogstorankhighforthosewords

•  Nologicalmeaningwhentryingtoreadthecontentonthepage

hlp://kessebohmer.t35.com/orz.4chan.org‐e‐res‐621947.html.html

hlp://www.ipci‐comurnat.org/page/2hlp://www.predrepka6.bezsternika.pl/movado‐museum‐piece‐watches.html

Searchenginecrawlerseescontentfilledwithkeywordswhiletheusersarere‐directedtoadifferentpagefromsearchresults

Canbeinten8onalorcanbeduetothesitebeinghijacked

SourcePage:hlp://www.oie.pl/posturas‐lesbicas.html

Des8na8onPage:hlp://sexnet.sexyweb.es/

R‐ratedcontent

Pageswithlilleornousefulcontentlinktoeachother.Mostofthelinkfarmsarecreatedasnetworksofsitesthatcontainnumerouslinkstooneanother.

•  3e2v.org‐>eazishopping.com•  3e2v.org‐>5olde.com•  5olde.com‐>eazishopping.com•  netprivacypower.org‐>eazishopping.com•  netprivacypower.org‐>5olde.com•  angelcityoutcasts.com‐>netprivacypower.org•  angelcityoutcasts.com‐>eazishopping.com

•  Aspam‐orientedlinkexchangeoccurswhencompletelyunrelatedwebsitesreciprocallyexchangelinks.Thisisdonetoinflateranking

•  Alllinksintendedtomanipulatesearchengineresultswillbediscounted

•  Hijackedsites•  Scareware•  LowQualityusergeneratedcontent

•  Partofthesiteishijackedtohostadultcontentorsellinteres'ng()products

•  EDUsites(studentpages,departmentpages)andsocialdiscussioncomponentsofsiteslikeforums,blogsarethemostvulnerable

hlp://ltss.edu/shared/tmpl_c/FBEF8076/buy‐viagra‐on‐line.htmlhlp://www.math.rutgers.edu/mdnews/cheapest‐place‐to‐buy‐viagra‐online.html

hlp://forums.plexapp.com/index.php?/user/13257‐bbviagra/

•  Targetspikyqueriesthatfollowpopularevents{gaddafilibyanprotests},{racheloberlinpictures}•  Hijackpartofpopularsitestogetauthority/popularityfor

free(no8mefororganicspamminghere)

•  Stuffthehijackedpagewithkeywordstarge8ngthelatestevents–searchenginebotsseethispage

•  Redirecttoscarewarepagewhenclickedasasearchresult

WhatisContentFarm?

“Contentfarmsarenetworksofprovidersaimedatgenera'nglargeamountsofsubjectspecific,butgenerallysuperficialcontentforthepurposeofsearchenginemone'za'on”

Mo8va8on?

Syndica8on‐basedmone8za8on

Ad‐basedmone8za8on

Algorithmicandmanualac8on

Detec8onmechanismperspamtechniqueLookforawaytoaggregate

•  Neutralizingspamwithouthur8ngusersisnotaneasyproblem–  Bignamesitesbuyingpaidlinks–  Dealingwithlowqualitycontentpagesfromsitesthathavegood

pagestoo

•  Certaintypesofspamishardtodetectthanothers–linklevelspam

•  Certainspamtechniquesarehardtodetectbyrelevancejudges–linklevelspam,lowqualitycontent–  Weakcorrela8onbetweenspamandrelevance–  Determiningtheactualimpactofspamonrelevanceishard

hlp://likedrop1.info/

hlp://www.likedatstuff.com/like.php?id=479hlp://www.coolslikes.com/like.php?id=28

Withsocialsignalsbecomingpopular,itisonlynaturalthattheyaregoingtobetargetedbyspammersmore

•  Eggs,bacon,spam,spam,andspam(SEM101)•  Theperniciousperfidyofpage‐levelwebspam(SEM101)

•  Theliabilityofloathsome,link‐levelwebspam(SEM101)

Four part series on website security:

•  http://www.bing.com/community/blogs/webmaster/archive/2009/09/11/the-merciless-malignancy-of-malware-part-1-sem-101.aspx




Documents

Sasi Parthasarathy sasip@microso - USENIX · • Search engines, at a very high level, care about two (2) things when ranking: – Content of the page (page‐level)