Over the past two days you may have noticed a rash of spam posts on ThingWorx Community, across both the Developer Community and Academic Community spaces. This unfortunate attack resulted in a large volume of emails being sent to our members who were Following these spaces, and we sincerely apologize for the inconvenience this may have caused. We have now taken a number of steps to bolster our defenses and enabled some of Jive’s built-in spam prevention tools to better weed out these nefarious users and it's thanks to a lot of you for your help identifying the offending accounts and notifying us when a new wave begun so that we could stop these posts in real time, instead of being reactionary and cleaning up afterwards.
The good news is that we’ve been able to isolate the issues over past two days and feel confident we’ve got a hold on how the spammers got in. Here is a list of the changes we've made to help prevent any further attacks:
Changes to Content Moderation
This is a preventative measure we've had in place for a while now, but we have recently upped this limit to target more new user's content to review in moderation before being published. Moving forward all content posted by users with less than 10 points on ThingWorx Community will be automatically routed into our Moderation Queue. It will require a site administrator to review and approve before publishing and I'm committed to reviewing this queue periodically until we feel comfortable reducing this measure.
Removed an exploit within our Moderation Settings
We believe the spam accounts were leveraging an exploit in our status level settings which moderated users who had less than 5 points, but provided 1 point every time a spammer follows another community member. So to publish and bypass the moderation queue all a spammer would need to do is follow 6+ ThingWorx Community members. We’ve since resolved this by removing the point system trigger for following and being followed by other users. As a result we’ve restricted the points system to only activities that reward your contributions, or activity around your contribution (once it’s passed the Moderation Queue).
Increased message governor
We’ve also added restrictions to limit the rate at which members are allowed to post. By adding a “message governor” we’ve been able to remove the automated spam bots ability to send out multiple messages across the community within seconds. The current governor delay is set to 10 seconds, so members who quickly add two replies to a discussion will see a small error message alerting them to this delay. After a few seconds they should be able to post their message from there. We’ll continue to monitor this limitation as well to see how it performs and if it is impacting user experience.
Added new Keywords Interceptors
In the process of cleaning up all this content we also added a number of offending phrases including the websites mentioned and other specific text strings to our keyword filters. We have added several of these to our moderation process, for example all content containing the phrase “casino” in the Korean language will now be placed into our Moderation Queue.
Thank you all so much for your patience while we tracked this issue down. I’m confident that what we have in place should significantly reduce our risk of any further attacks.