Watch out for bogus alerts claiming a link is filled with malware...

[SidDithers]

kpete had a post hidden earlier this week:
http://www.democraticunderground.com/10025508615

Discussion about the hide in this thread:
http://www.democraticunderground.com/10025509052

The alerter submitted a bogus alert with the alerter message:
"Link is loaded with malware. Hide for safety of DUers."


Today, an alert was made on a thread by Luminious Animal:
http://www.democraticunderground.com/10025515399

Jury results were posted here:
http://www.democraticunderground.com/?com=view_post&forum=1002&pid=5515524

The alerter's message was virtually the same:
"Link is loaded with malware."


Don't let some asshat troll trick you into hiding an innocuous thread by claiming the linked page is full of malware.

Sid

[hobbit709]

1. Just like some people to get their jollies by screwing with people.

It doesn't say too much for some of the people on the juries that believed the alert without checking the link to see if it's true.

[NYC_SKP]

2. I hope Skinner and company see this AND clear the records of kpete and other victims.

I swear, the alerting and jury system is wrought with problems.

There should be a threshold of good posting history before members can be on a jury or alert, and a limited number of times one can alert.

[hlthe2b]

6. Agree and it is incomprehensible to me that admins still deny a problem with alert stalking as well

Last edited Wed Sep 10, 2014, 08:29 PM - Edit history (1)

The jury system is readily manipulated.

[Gormy Cuss]

48. Using one's best judgment fails in a situation like this.

If a juror doesn't recognize the link, it's easy to fall for this scam.

[JNelson6563]

81. Shameful, isn't it?

[bvf]

10. Yes.

"There should be a threshold of good posting history before members can be on a jury or alert, and a limited number of times one can alert."

I'll bet some people around here make quite a career out of the latter.

[Luminous Animal]

21. I posted about it in ATA.

[NYC_SKP]

24. Thank you.

I hope we get an answer. Not all ATA posts do, not publicly.

[ann---]

32. Agree

I think the jury system which allows "alerts" for frivolous reasons to result in hiding a benign post is uber politically-correct. Or whatever you want to call the way it is run. REAL violations are one thing - frivolous hidings are worrisome.

[busterbrown]

61. Someone pulled an alert on me..

because of my writing style.. Its not so good, ( probably because I hate writing..My father was an English Teacher..The good part was the support I received from the jury..
The guy thought I wrote like a Rethug.

[safeinOhio]

3. I go to them

on my Mac.

[ManiacJoe]

50. Macs get viruses, too.

[femmocrat]

58. Yes they do!

I had that nasty NSA malware just yesterday. I spent an hour and a half on the phone with Apple support to get rid of it. It completely locked up my computer.

I think I got it from the MSN home page.

I am not clicking on ANY links in the future.

[hlthe2b]

4. That is really despicable...

That said, about 18 months or so ago, a similar alert came through when I was on MIRT. Thinking I could click on it safely since I kept my antivirus/firewal/malware detection up to date, I did so. My laptop screen locked up, gave me the blue screen of death and I had to pay a computer service to recreate my hard drive and to get rid of it. My laptop was never the same afterwards, since some of the settings were irretrievably corrupted.

SO, while I agree this is a nasty prank and admins ought to look into this--the truth is there are rare instances when they could be right.

[TygrBright]

5. Good catch. Maybe we need a special "alert" category for this.

And route the posts alerted on for links to malware, etc., to a MIRT team member with access to a "sandbox" to check out the veracity of the assumptions.

speculatively,
Bright

[drm604]

7. I thought that the hiding of kpete's thread was weird.

At least now I understand what happened.

I went to the link (before the thread was hidden) and did not receive a warning, and my system is locked down pretty well.

[sheshe2]

8. Thanks for the heads up Sid.

[MerryBlooms]

9. Taking advantage of the jurors who don't bother to check things out for themselves.

[Glassunion]

27. I really can't fault the jurors on this.

Let's say you go to your favorite coffee shop, and are looking forward to a nice cup of coffee and a pastry to unwind. You go to open the door and someone standing there says "Don't open the door! You'll let the bobcat lose." Would you open the door, or would you be a tad apprehensive? Not everyone know how to safely check for malware on a website.

[MerryBlooms]

30. It happens around here all the time

whether it's an accused bad source or misinformation, etc... jurors who can't/won't check things for themselves should just go ahead and excuse themselves from that jury duty. I have backed out of jury duty more than once.

[Glassunion]

52. True.

[hunter]

29. Many jurors, I'm guessing, are fearful of picking up malware themselves.

It's a nasty troll most likely, but it's also possible the person making the alert picked up malware somewhere else or is getting a false positive from their anti-malware tools.

[MerryBlooms]

31. Then they should just back out of that jury duty.

[RKP5637]

11. It's time to upgrade the Alert System to provide Alerts on Alerters. I've seen

some really bizarre alerts. The alert system is no way near perfect.

[Nye Bevan]

14. You already can. Just alert on the jury results, it goes to the admins (nt)

[RKP5637]

17. Didn't know that! Thanks! n/t

[Glassunion]

28. I thought that would be like dividing by zero...

[RKP5637]

12. K&R! n/t

[conservaphobe]

13. Wow, they are manipulative to the core. nt

[cyberswede]

79. Yes, "they" are

MIR Team (Skinner) banned conservaphobe

Mail Message
Reason:
Sending fake alerts claiming that links are infected with malware.

http://www.democraticunderground.com?com=profile&uid=315571&sub=trans

Real name:
DU Member for: 2 months, 11 days
Posts: 1,284
Recommendations: 421
Star member: No

[uppityperson]

83. Thank you Skinner for banning this jerk.

MIR Team (Skinner) banned conservaphobe

Mail Message
Reason:
Sending fake alerts claiming that links are infected with malware.

http://www.democraticunderground.com?com=profile&uid=315571&sub=trans

Real name:
DU Member for: 2 months, 11 days
Posts: 1,284
Recommendations: 421
Star member: No
Tiocfaidh ár lá

[Rex]

86. Says the repeat troll...serious, go bother another website!

So many repeat trolls...ugh.

[Rex]

15. I sent the alert to the admins.

Don't let someone fool you into hiding a thread, just because they say they found malware...most modern browsers come fully equipped to find malware...don't take my word for it, just go download some warez.

[SidDithers]

16. Thanks...

If it were some unknown site with strange content, then we should all be careful.

Or a blind, hidden text link.

But kpete was linking to vox.com, and LA to The Intercept. Those are both pretty safe, mainstream sites.

IMO, the alerts on those two posts were troll alerts hoping to get hides from juries that wouldn't take the time to verify the accusation.

And it worked in kpete's case.

Glad you alerted your results.

Sid

[Rex]

89. Looks like they got the troll!

These repeat trolls are sad little people, they need a better hobby.

conservaphobe
JournalProfileRecsTransparency Send DU MailIgnoreRSS feed
conservaphobe's Profile
Profile information
About conservaphobe

Statistics and Information

Account status: Posting privileges revoked
Member since: Tue Jul 1, 2014, 02:47 PM
Number of posts: 1,284
Number of posts, last 90 days: 1284
Favorite forum: General Discussion, 1222 posts in the last 90 days (95% of total posts)
Favorite group: NA
Last post: Wed Sep 10, 2014, 05:35 PM

Jury
Willing to serve on Juries: Yes
Eligible to serve on Juries: Yes
Chance of serving on Juries: 0% (explain)


Hosting
conservaphobe is not currently hosting any forums or groups.

[SidDithers]

90. Any day a troll bites it is a good day...nt

Sid

[Rex]

92. Agree!

Repeat trolls and repeat zombies abound! Good thing the hammer never gets tired.

[zappaman]

95. You better believe it! n/t

[Rex]

97. BBI!

[dickthegrouch]

39. Even if your browser is fully up-to-date

Many others are not, and new and improved malware is devised all the time by people who are quite well funded to do just that.
Keeping a modern system completely up-to-date has got marginally easier, but we have never claimed that it could be impregnable even with the latest set up updates.

I would highly recommend against following anything which has a claim of malware against it unless you know exactly what you are doing.

Even with noscript and ghostery on my system I still use google to validate otherwise unknown destinations before I would even consider enabling them. Many sites link to 10 or more other sites according to noscript. I will not use any site that requires me to enable more than two others to see the content supposedly sourced by the original. I use my firewall to deny access to or from any Chinese, Russian, or other eastern european country's top-level domains ( ".cn", ".ru", etc.) just in case I inadvertently allow a site through some other means.

[kcr]

40. Not to mention someone genuinely concerned about malware wouldn't alert on it for a jury

They'd contact admin directly. It wouldn't make sense to just have a post hidden.

[Brother Buzz]

18. Here's another one:

Last edited Wed Sep 10, 2014, 07:19 PM - Edit history (1)

On Wed Sep 10, 2014, 11:32 AM an alert was sent on the following post:

Amnesty International implicates Ukrainian volunteer fascist unit in War Crimes.
http://www.democraticunderground.com/10025514359

REASON FOR ALERT

This post is disruptive, hurtful, rude, insensitive, over-the-top, or otherwise inappropriate.

ALERTER'S COMMENTS

The link in this OP attempted to hijack my browser and install spyware capable of monitoring all of my activity. Hide this dangerous leak to protect the data and privacy of DUers.

You served on a randomly-selected Jury of DU members which reviewed this post. The review was completed at Wed Sep 10, 2014, 11:39 AM, and the Jury voted 3-4 to LEAVE IT.

Juror #1 voted to HIDE IT
Explanation: It's bad enough that it links to RT, but the malware problem is an instant hide.
Juror #2 voted to HIDE IT
Explanation: I'd rather DU not become an affiliate of a Russian propaganda site.
Juror #3 voted to LEAVE IT ALONE
Explanation: No explanation given
Juror #4 voted to LEAVE IT ALONE
Explanation: The moderators should be notified. This can't be determined by jurors.
Juror #5 voted to LEAVE IT ALONE
Explanation: Horse pucky
Juror #6 voted to LEAVE IT ALONE
Explanation: Since I can't test the link to validate the alert, I would suggest you contact the mods directly.

Juror #7 voted to HIDE IT
Explanation: At first, I decided to leave it alone until i learned that this is a hijacking post. I'm on a linux platform so not to concerned about my computer. However, not everyone uses linux so I voted to hide it. I don't want others to be victims of this link.

Thank you very much for participating in our Jury system, and we hope you will be able to participate again in the future.

[NYC_SKP]

20. That's an item in your inbox, please copy and paste the full message, not the link.

Because what you've posted can only be read by you.

[Brother Buzz]

37. Are you trying to install spyware on me?

Fixed, I think. back at 'ya

[NYC_SKP]

38. Oh, we did that on you two years ago.

We jsut checked and it's working fine!

[Brother Buzz]

47. It may nee a tuneup

Can you fix my amn letter ' ' while you're at it? Running the keyboar through a full ishwasher cycle in't fix it at all.

[Mr.Bill]

19. It happened over in the Discusionist last night.

I had clicked on it and found no problems. I wonder if the alerter was the same one who was doing it here. The administrators should know.

[CreekDog]

22. Skinner would of course reverse this?

or maybe outright false alerts and resulting hides are what is meant by "you take your chances".

someone that doesn't have all their ATA questions ignored may want to ask Skinner this in ATA.

[NYC_SKP]

36. Historically, yes, that is the response to complaints about alerts and juries.

I wholeheartedly disagree with the responses, when they've been posted.

Sort of like, "just be civil and you won't have anything to worry about".

No, that might be true some of the time but other times it's just bullying and stalking and swarming.

Our Venn diagram has been revealed!

[Gormy Cuss]

49. "You take your chances..."

and even when the deck is stacked the jury is always right, even if the single hide kicks you out of hosting the Forums.

[NYC_SKP]

53. IMO, that detail in the new rules only made matters worse.

Which is to say, yes, good hosts would have no hides, but also no, now people will target their alerts at people they want to prevent from becoming hosts.

It's like that fingers in the dike thing, unintended consequences.

Interesting evolution on this board and I do respect the admins for trying to make it better and never moving too hastily.

But in some ways it still needs work.

[CreekDog]

72. it's been 3 years under this system, what exactly have the admins done?

there's basically one small change per year to this system.

i can't give them credit for acting as slowly and as little as they have acted.

[NYC_SKP]

73. You make a fair point, it's been pretty slow....

I guess they're just spending less time on it.

I was thinking about the changes to hosting, that seems to have been done with care but you're right, and they don't respond to ATA questions with any regularity.

OTOH, do you remember that scoring system with the colored buttons? That was just silly, but could be an example of a failed idea.

Then there's Discussionist.

[cyberswede]

82. Looks like they will reverse the hides

http://www.democraticunderground.com/12596775#post1

The alerts were deliberately false. The Admins have never overturned juries in the past, but we feel this is a very specific and unique situation because jurors wanted to do the right thing for the community but could not verify the alerter's claims because did not want to get their own computers infected with malware. We will remove the hidden posts from the accounts of members whose posts were hidden. I'll ask Elad to do it when he gets online later today.

We are also going to think about this and figure out if there is something we can do so this is less likely to happen in the future.

[CreekDog]

84. Good on the Admins for taking quick action

thank you for passing on the news!

[uppityperson]

23. I wonder if either of them were Hosts and got kicked off for having a hidden post?

[kcr]

42. That's right. You can lost hosting privileges.

So glad I didn't listen when people suggested I try hosting. Why even bother?

[SidDithers]

44. Oh, sorry, I know what you mean now...

I thought you were talking about the alerter.

Only kpete's post was hidden. LA's was left by the jury. And I don't think kpete was a Host at the time.

I'm blaming my cluelessness on the couple of drinks I had with dinner tonight.

Sid

[uppityperson]

45. Thanks and happy happy

[Cha]

25. Thanks, Sid..

[hrmjustin]

26. These hides should be removed.

The alerts may or may not have been alerted in good faith but these hides are not fair if it is just based on possible malware.

[kcr]

33. Wow.

I just replied to Trumad's joke thread. I thought it was just random silliness. I had no idea it what it was about and that this was happening. Frigging jury system.

[progressoid]

34. That kpete hide was ridiculous. I was on that jury.

I went to the link and got no malware or spam. Just an article.

C'mon people, put a little effort into your jury vote.

[freshwest]

35. Sounds like the malware is in the Alerter. Troll malware, that is.

[Renew Deal]

41. It's possible that different people see different things on pages

Mostly because of different ads. Some people might see bad ads or link to infected content

[kcr]

43. Maybe. But this is a huge flaw in the jury system.

Mods can discuss and come to a consensus before a post is removed. These never would have been removed under those circumstances. This is ridiculous.

[muriel_volestrangler]

46. As I said, any member genuinely worried about malware should post in the thread

so that people see a warning. That also allows others to check it out and confirm or deny it, if they want to - rather than jurors who can't post until they vote, and who are a far smaller pool to draw people willing to check it from.

[yuiyoshida]

51. That JUST SUCKS...i wondered why I could no longer respond

in that first thread, and I was curious why it was locked.

[NYC_SKP]

54. Perhaps locked OPs need to automatically display the alert and the votes with comments.

Should I propose that in ATA?

[yuiyoshida]

55. Yes please...

It should be available.. don't ya think

[pnwmom]

57. good idea

[Warpy]

56. I've had a reasonably sophisticated antivirus refuse to allow me to

post a reply to a DU post now and then. I figure it's just a glitch somewhere and since I usually know who I'm replying to, I certainly don't suspect them of trying to hide malware somewhere. I suspect hamfisted activity by Agent Mike first.

[femmocrat]

59. I got a nasty trojan horse from a video link in DU awhile back.

It was when I still had a PC. So aggravating. Sorry, I don't remember which one it was, but when you clicked on the "X" to delete it, it would embed in your computer.

[Gormy Cuss]

60. Failed this time.

AUTOMATED MESSAGE: Results of your Jury Service

Mail Message
On Wed Sep 10, 2014, 03:13 PM an alert was sent on the following post:

Watch out for bogus alerts claiming a link is filled with malware...
http://www.democraticunderground.com/10025515644

REASON FOR ALERT

This post is disruptive, hurtful, rude, insensitive, over-the-top, or otherwise inappropriate.

ALERTER'S COMMENTS

Personal attack against me for alerting on malicious websites.

You served on a randomly-selected Jury of DU members which reviewed this post. The review was completed at Wed Sep 10, 2014, 03:19 PM, and the Jury voted 0-7 to LEAVE IT.

Juror #1 voted to LEAVE IT ALONE
Explanation: I'll let it stand...close, though.
Juror #2 voted to LEAVE IT ALONE
Explanation: No explanation given
Juror #3 voted to LEAVE IT ALONE
Explanation: No explanation given
Juror #4 voted to LEAVE IT ALONE
Explanation: Check your computer, dude. If you're seeing something malicious, it's on you box.
Juror #5 voted to LEAVE IT ALONE
Explanation: If Sid is correct, this manipulation should be handled by admin. If Sid is wrong, the alerter should take it to admin.
IOW, it's an admin issue, not a jury issue.
Juror #6 voted to LEAVE IT ALONE
Explanation: No explanation given
Juror #7 voted to LEAVE IT ALONE
Explanation: No explanation given

Thank you very much for participating in our Jury system, and we hope you will be able to participate again in the future.

[DeadLetterOffice]

62. Offs...

Somebody needs to have their 'alert' button rescinded...

[kcr]

65. Good thing they won't be able to alert for awhile

Stop alerting whoever you are and if you're genuinely concerned about a website send a note to Skinner.

[newcriminal]

63. I was on a jury for one of these today.

On Wed Sep 10, 2014, 11:37 AM an alert was sent on the following post:

Janay Rice defends husband, says she bobbed when she should have weaved
http://www.democraticunderground.com/1018664077

REASON FOR ALERT

This post is disruptive, hurtful, rude, insensitive, over-the-top, or otherwise inappropriate.

ALERTER'S COMMENTS

Malicious website link. My system tells me it's not safe to go to that site.

JURY RESULTS

You served on a randomly-selected Jury of DU members which reviewed this post. The review was completed at Wed Sep 10, 2014, 11:45 AM, and the Jury voted 5-2 to HIDE IT.

Juror #1 voted to HIDE IT
Explanation: The hosts should lock it because it does not fit The Lounge. I'll vote to hide for that reason. I am not about to click the link.
Juror #2 voted to LEAVE IT ALONE
Explanation: No explanation given
Juror #3 voted to HIDE IT
Explanation: No explanation given
Juror #4 voted to HIDE IT
Explanation: mine didn't give any warnings, but it looks like it might be spammy, will vote to hide so MIRT and admins can sort it out. alerter might also TELL the OP about the problem.
Juror #5 voted to LEAVE IT ALONE
Explanation: That link worked for me and I got no warning on it.
Juror #6 voted to HIDE IT
Explanation: Hiding so MIRT can check this out
Juror #7 voted to HIDE IT
Explanation: No explanation given

Thank you very much for participating in our Jury system, and we hope you will be able to participate again in the future.

I was juror number 2.

[CreekDog]

85. Admins need to reverse this one

Juror #1 should excuse themselves from jury duty until they can get a clue. The post wasn't malware and wasn't in the Lounge.

[Savannahmann]

91. Anyone who alerted, and anyone who voted to hide

Should have their accounts closed, locked, and labeled as trolls and enablers.

Seriously, MIRT, ban those who voted to hide. Ban the user who alerted. This is the internet equivalent to swatting.

[Cleita]

64. I was a juror on one of those and voted to leave it because the alert

didn't have any facts or source to make it credible. I decided that it was a troll.

[deafskeptic]

66. I got a similar summons to jury regarding malware ridden links..

In the future, if I should receive a similar summon again, I will recommend that who ever alerted us to this should forward this to moderators - not to jury.

Link seemed ok but I was on a Linux platform and I didn't want to risk using Windows 7 on this link. I decided to hide it as a precaution. It didn't occur to me that the alerter may have had a malicious purpose in mind.

[Warren DeMontague]

67. Admin knows who sends every alert.

I suspect that they may think they'll get away with it, but they won't for long.

Seems to me a fairly clear violation of both the "don't screw with the system" and "don't push your luck" portions of the TOS.

[lonestarnot]

68. So take a look at this.

http://www.democraticunderground.com/?com=view_post&forum=1002&pid=5517994

what the hell was that about? Snort... didn't stop me although it was attempted.

[Warren DeMontague]

69. Jury system doesn't always get it right, and people do misrepresent posts in alerts too.

Still, I would think deliberately misrepresenting links posted on DU as malware would be enough of a fucking-with-the-system that admin might take notice. Sort of like how they banned someone a while back for changing a hotlinked picture in their photobucket account that someone had posted, and then alerted on the post as though the poster had deliberately posted the offending image, trying to get that person banned.

They banned the person who changed the image and sent the bogus alert on it.

So you never know. I think they do pay attention to that kind of thing.

[lonestarnot]

70. Not that silly rabbit! It posted 5 fucking times.

I took care of the posting part.

[Warren DeMontague]

71. Ah, ha. Now I see.

Sorry, a liitle sloooooow on the uptake here. yeah, that is weird.

Perhaps you were stuck in a strange loop, like that time I tried to xerox a mirror.



Actually thats weird enough you might want to bring it to elad's attn. i do know the system is normally supposed to catch duplicate posts. Certainly not replicate them itself!

[LanternWaste]

74. I'd think that should a jurist be unaware of whether the alleged malware exists or not...

I'd think that should a jurist called to duty be unaware of whether the alleged malware exists or not and the only reason to believe it as such is a warning from the alerter, the appropriate course of action would be to simply excuse themselves from jury duty in those instances.

[hrmjustin]

75. MIR Team (Skinner) banned conservaphobe

MIR Team (Skinner) banned conservaphobe

Mail Message
Reason:
Sending fake alerts claiming that links are infected with malware.

http://www.democraticunderground.com?com=profile&uid=315571&sub=trans

Real name:
DU Member for: 2 months, 11 days
Posts: 1,284
Recommendations: 421
Star member: No
Tiocfaidh ár lá

[MerryBlooms]

94. Eesh, what a jerk. You'd think people had better things to do with their time.

[MohRokTah]

76. Thanks Sid, I'll refuse to vote to hide any post due to alleged malware. eom

[leftstreet]

87. Google Malware Check Tool

http://webconfs.com/google-malware-check.php

[MohRokTah]

88. No need.

I have good protection on all of my computers.

Plus, I have that link in my bookmarks already.

[Ptah]

77. conservaphobe PPR -- Sending fake alerts claiming that links are infected with malware.

http://www.democraticunderground.com/?com=profile&uid=315571&sub=trans

[L0oniX]

78. Alerting!

[Sissyk]

80. As you see above,

Detective Skinner detected the culprit, gathered evidence, and banned the intruder.

[Spitfire of ATJ]

93. Malware? That would be microsoft.com.

[herding cats]

96. Thanks for taking the time to bring this to the admin and DU's attention.

Even with that one gone, there would likely be other trolls out there now trying to abuse this method of alerting. It's good to know to be on the lookout for it.

[Union Scribe]

98. Props to you and the admins.

I'm glad this was caught and handled.

[SomethingFishy]

99. Thanks Sid... Nice catch..

Sincerely...