Mastodon

Social Media Thread-Hijacking is Nothing More Than Targeted Spam

18 April 2018

I have a vehement dislike of spam. Right there, that's something you and I have in common because I'm yet to meet a person who says "well actually, I find those Viagra emails I receive every day kinda useful". We get bombarded by spam on a daily basis and quite rightly, people get kinda cranky when they have to deal with it; it's an unwanted invasion that takes a little slice of unnecessary mental processing each time we see it. Sure, junk mail filters catch a lot of it, but even the best implementations will still let a few slip through now and then.

But for the most part, spam is indiscriminate; you're on a list so bam - you get emails about improving your bedroom life. Increasingly though, it's much more targeted than that and is invading channels beyond just email:

Now just to avoid any shadows of doubt, yes, this meets the very definition of spam:

the use of electronic messaging systems to send an unsolicited message (spam), especially advertising, as well as sending messages repeatedly on the same site

You'll also see the Twitter example above referred to as "thread-hijacking", that is someone interjecting in a discussion in order to divert it in a different direction. In the case above, HostGator was being taken to task for storing passwords in a retrievable fashion (i.e. not as a strong cryptographic hash), and rightly so too. The hijacking then came via Nodestack who decided that this was the perfect opportunity to try and sell their services.

I'm going to talk more about Nodestack's behaviour in a moment, but let me clear about this - spam and thread-hijacking in this fashion is all too common:

It's the same deal - targeted spam. Someone at SignNow had decided that Mister Johnson met their target demographic and thus deserved an unsolicited advertisement. Don't confuse this with a Twitter ad either; we as users of the free platform know that the trade-off is companies pay to highlight their tweets, each of which is clearly flagged as "promoted". SignNow's approach was likely highly automated based on keywords in Mister Johnson's tweet rather than them thinking he genuinely needed their services - there's very little likelihood that someone complaining about phishing emails impersonating DocuSign is going to turn around and then start using an alternative electronic signature platform. It was probably just a case of him mentioning @docusign in the same way as the Nodestack spam was likely triggered by the mention of @HostGator.

Often, you'll see this pattern play out ad nauseam as the organisation involved takes the shotgun approach of blasting their message out over and over again:

Having watched this pattern play out over the years, the offending Twitter accounts do seem to eventually realise that the strategy is either ineffective or simply pisses too many people off and cease the spam after a little while. Nodestack haven't quite evolved to that level of understanding yet and as of today, still appear to be hijacking disgruntled threads containing keywords of "HostGator", "Bluehost" or "GoDaddy", among others. (Amusingly, they also appear to be attempting to woo happy Ghost customers - or those considering Ghost - over to WordPress.)

And just the day after first seeing Nodestack's behaviour:

The point is that Nodestack is not the sole offender here, although they are exceptionally bad in other ways. I'll come back to that.

One of the arguments I've seen bandied around in favour of this strategy is that "it's useful to people". The position here is that in a case like that last tweet by Guardian Digital, they believe that the original tweet demonstrated a need and they're simply trying to help that person out with a solution. But let's try it like this: what if every hosting company that offered a service took the same approach? I mean suspend reality for a moment and assume that AWS, Azure, Digital Ocean et al all decided this marketing strategy "enhanced consumer value" - how would that look? Well it would be unmanageable, of course, as the noise of all the spam would drown out every conversation it was interjected into. So it's one of those things where even those who promote this means of unsolicited messaging agree that it only works so long as they're the only ones doing it!

The premise of interjecting into a conversation and promoting a service to someone at a time of need goes by another name too:

So how do organisations respond once the penny drops that this practice is usually received in a very negative way? The responsible ones acknowledge the mistake and promise to do better in future:

Expecting that Nodestack would follow suite, I suggested this was a strategy worth reconsidering:

Surprisingly though, Nodestack decided to double-down and dig themselves in deeper:

I won't reproduce all the to-and-for here, but you can easily recap by browsing the thread above. Long story short, they remained defiant so I put the question out to the masses:

Again, I'll avoid reproducing all the responses here, but it's worth a spin through the thread to see Nodestack's reaction (get popcorn first - it gets weird). As for other respondents, without manually counting them all, I'd say it's somewhere in order of a 4:1 ratio of those who are staunchly against the practice (many people were very direct about those feelings), versus those who'd accept it, or at least put up with it. I appreciate that we all have different tolerances to criticism, but when the vast majority of people are saying "don't do this", you really want to think about not doing it!

So why take this approach? I mean why blast people with spam given how much it's disliked? Apparently it's a conscious target all the people strategy where you just bombard targets with enough adverts that if some bite, then you're all good (think along the lines of the economics of Nigerian scams). The fundamental misunderstanding at play in that tweet (and other similar ones) is that everyone is free to just ignore spam, so what's the problem? Of course, that's simply not how it works and indeed that's why we have laws protecting consumers from it.

Look, perhaps contrary to what the vocal opposition they received suggests, Nodestack really do pick up business by thread-hijacking, you'll have to make your own mind up on how trustworthy that statement is. But consider the truthfulness of that assertion in the context of all sorts of other oddities with the way they're doing business ranging from a fake Trustpilot rating to missing business registration data to cohabitation with spam sites to a poor SSL Labs rating to excessive open ports on the web site to a failing "F" grade on their security headers (that last one was in response to a claim their security is "water tight", a claim somehow made in ignorance of how a similar claim wound up for T-Mobile Austria only the week before). The Twitter account went uncharacteristically quiet in response to these issues, other than when demonstrating a lack of understanding as to why forward secrecy is important in this day and age. I tried to find some further info on who was behind the service, but a LinkedIn search only came up with a Rails developer in Portugal and a bloke in Bangladesh; it's not clear whether that "nodestack" is the same org nor whether those two guys are running a business from afar whilst implying it's based in the UK having only setup the website and Twitter account in Jan (although it may explain all the typos in their tweets). This is not intended purely to berate Nodestack (for all I know it's a guy in a shed just trying to make a good go of things), rather it's to illustrate the pattern of professionalism that thread-hijacking fits into.

When this blog post is later shared in the wake of subsequent thread-hijacking behaviour from other accounts, I want it to be clear that this is the sort of company spammers will be keeping. It may well work in the same way as other advertising many of us find sleazy works; if enough people pay for the service based on those ads then the end justifies the means, right? Regardless, it's hard to imagine anyone who actually values their reputation behaving in this way. Seeing this unfold last week, it immediately made me think back to my "Hack Your Career" talk from last year at NDC:

Your social media profile is your opportunity to demonstrate your character

It's just a question of how valuable your reputation and character is to you.

By pure coincidence, only a couple of days ago I saw another case of thread-hijacking in response to the same original thread:

I thought I'd see how my earlier approach would go with these guys - would they push back equally as hard against common sense advice? I copied and pasted exactly the same tweet I sent to Nodestack, just for scientific purposes:

And true to their word, that was that - they cleaned up their act. It's nice to see common sense prevail.

Twitter
Tweet Post Update Email RSS

Hi, I'm Troy Hunt, I write this blog, create courses for Pluralsight and am a Microsoft Regional Director and MVP who travels the world speaking at events and training technology professionals

Troy Hunt

Hi, I'm Troy Hunt, I write this blog, run "Have I Been Pwned" and am a Microsoft Regional Director and MVP who travels the world speaking at events and training technology professionals

Upcoming Events

I often run private workshops around these, here's upcoming events I'll be at:

Must Read

Don't have Pluralsight already? How about a 10 day free trial? That'll get you access to thousands of courses amongst which are dozens of my own including:

  1. OWASP Top 10 Web Application Security Risks for ASP.NET
  2. What Every Developer Must Know About HTTPS
  3. Hack Yourself First: How to go on the Cyber-Offense
  4. The Information Security Big Picture
  5. Ethical Hacking: Social Engineering
  6. Modernizing Your Websites with Azure Platform as a Service
  7. Introduction to Browser Security Headers
  8. Ethical Hacking: SQL Injection
  9. Web Security and the OWASP Top 10: The Big Picture
  10. Ethical Hacking: Hacking Web Applications