This is a couple of days old now, so forgive me for writing this post a little late. I did start it over the weekend when i got news of the release but didn’t finish my blog post until today.

Saturday saw the release of Syndk8’s Auto Pligg Submitter, for those who aren’t aware, Syndk8 is pretty much the top black forum on the net and Pligg is a sort of content management system which is effectively a clone of the much loved Digg.com. Pligg allows members to submit news stories about various topics and then vote and comment on said stories. This in turn effects what shows up on the front page, and how long for, its a social media news site.

The Pligg Auto submitter is being sold for $189 which for what it actually does is peanuts. Basically the software will allow you to mass spam almost any Pligg based site out in the wild. You would be forgiven in thinking that it isn’t a big deal until you realise that some high profile sites such as Sphinn.com are using the Pligg engine.

Lets look at some of the features that the Pligg spammer (i mean auto submitter) has…

• Automatically register for accounts. Even breaks CAPTCHAs!!
• Create UNLIMITED profiles and identities
• Submit stories and comment to 1000’s of sites
• Automated pinging after each submission
• Stats to show succesful submissions
• Proxy support

So as you can see, it’s a pretty rounded product, and the big thing here is that it can break captcha’s which is a pretty big deal in the world of spamming. Basically you are getting a piece of software which can automate the posting of hundreds of stories and links back to your site without you hardly lifting a finger.

So lets look at this from the point of spamming and building your site up, you could spend $180 on this product and be able to spam a hell of a lot of sites and get some decent links in or you could spend $180 one ok quility link. If you do a Google Search for “powered by pligg” you can see that the results number in the 1,380,000 range. Even if you assume that 25% of those sites no longer exist then you still have a massive amount of sites at your disposal to spam. Lets also check out the number of Google Searches going on at the moment…

As you can see from the image above, even though this software has only been out for four days, the amount of people searching for “powered by pligg” to spam the sites is pretty high, so what can webmasters do about it?

• Remove the “powered by pligg” footprint in your template
• Take a look at using ReCaptcha instead of Pliggs built in Captcha system, there is a (sort of) guide on the Pligg forum
• Add in another layer of capture which asks a questions such as “is water a liquid or gas?”
• Ensure that you monitor the number of users in the admin area, if you see this number shooting up then its safe to say that you are being targetted
• Like the above point, watch to see the number of stories being submitted, if they jump up then you are probably being targetted

I would imagine that within the next couple of releases Pligg will probably address a lot of the loopholes that the auto submitter is using to work, however it seems that this is an on going project from Syndk8 so it looks like this battle will last for some time. I must admit the Pligg development cycle can be a bit hit and miss so only time will tell what will happen.

In closing, i have tried to write this post from both the positive view points of a spammer and also the negative viewpoints of a Pligg admin, who knows, i may even use this software to promote my own Pligg based site

If you liked this post give it a Sphinn over at Sphinn.com

Posted in Blackhat