A spam attack that affected open source X competitor Mastodon, Misskey and other apps highlights how the decentralized social web, also known as the fediverse, is open to abuse. In recent days, attackers have targeted smaller Mastodon servers, taking advantage of open registrations to automate the creation of spam accounts. Mastodon founder and CEO Eugen Rochko confirmed the attack with his post over the weekend, adding that Mastodon server admins should switch registration to approval mode and block spam email providers to help address the issue.
While this isn’t the first spam attack to affect Fediverse, Rochko notes that only larger servers like Mastodon.social have been targeted in the past. As this server is run by the Mastodon team themselves, they were able to mitigate these attacks themselves. What’s different this time is that spammers targeted smaller and even abandoned servers that offer open enrollment, allowing bad actors to quickly create accounts and create spam.
Image Credits: Eugen Rochko in Mastodon
This particular attack, which was fully automated once the attackers learned they could write spam, was caused by a dispute between two sides on Discord, where one side was trying to ban the other side’s Discord server, according to reports on Mastodon. (More details in this here.) Many of the other targets of spammers Mastodon wasn’t alone — they were also targeted Miski. (Misskey is an open-source, decentralized blogging platform that uses the ActivityPub protocol, like Mastodon, Pixelfed, PeerTube, and others, allowing its users to interact with those on other federated social media platforms.) As the origin of spam seems to be a Japanese forummany of the targets were also in Japan.
The spam attack highlighted one of the weaknesses that comes with the structure of the fediverse. Mastodon is open source software that anyone can install on their own server, essentially establishing their own instance or node, connected to other federated social networking servers supported by the ActivityPub protocol.
Because Mastodon’s smaller servers are often hobbyist projects run by enthusiasts, they were vulnerable to these types of attacks. If server admins didn’t pay attention to their servers on a daily basis and offered open registrations, they would likely be victims of spam.
Or as a server administrator, @Chris@mastodon.cosmicnation.co observed, “Some case managers recalled that they had an example. And we’ve also learned that there are a LOT of abandoned cases out there with the door wide open to registration without approval.”
In recent days, the server administrators they cooperated to create continuous lists abandoned cases that other administrators could use as a basis for a block list to protect their own users from spam attacks. Many servers were simply disabled as their admins decided it would be easier to wait out the attack or abandon Mastodon altogether.
The popular third-party app Mastodon Ivory, by Tapbots, an emergency update has been released which included a custom filter called “Potential Spam” under the Filter tab that would allow users to mute spam reports. Affected users could enable this filter to catch most spam, but could not stop spam push notifications, the company said.
The attack seems to be ending as of this morning. Technologist and researcher Tim Chambers (@tchambers@indieweb.social) noted that today was the first day in four days that he had fewer than 40 spam accounts to suspend on the server he manages, for example. Mastodon tells TechCrunch that on active servers with a reactive moderation team, Mastodon has several tools to prevent automated account registration, including approval mode, CAPTCHAs and various blocking tools, so the attacker is dealt with very quickly. He also noted that the spam attack has ended as the two hacker groups apparently made peace.
While some saw the experience as positive for the social network and the wider federation, as it exposed a weakness that could now be discussed and addressed, others were angry at the experience and Rochko’s lack of response in the early hours of the attack.
“This ruins my Mastodon experience for me. Makes me want to quit and quit,” wrote one Mastodon server admin sam@urbanists.social. “And Eugen’s continued silence on the problem doesn’t help matters,” they said.
Mastodon CTO Renaud Chaput said the attack will push the company to improve its software.
“Currently, there are no well-built tools to handle this, as this is a complex issue — federated networks are not easy! — but we have a lot of ideas about how to improve our anti-spam and anti-abuse capabilities,” he said. “These will be worked on in the coming months. We are always working on improving the software (the latest version introduced optional captcha support). Another measure we took today is to change the setting for new instances so that they are not wide open by default, and we added a banner to remind admins that fully open instances must be actively moderated, so this should be a careful decision by the administrator,” Chaput added.
Since the arrival of Instagram Threads, another Twitter/X competitor that also plans to merge using ActivityPub, Mastodon usage has dropped.
As of October last year, Mastodon had grown to include around 1.8 million monthly active users. By the time Threads went public, it had dropped to 1.5 million. Since the public release this month of Bluesky, another decentralized social network based on a different protocol (meaning it’s not part of the same fediverse, at least until a bridge is built), Mastodon’s use has he fell to 1 million monthly active users.
That’s where Mastodon’s usage remains today, according to the company’s homepage. The wider fediverse, which includes Mastodon and other apps, has around 2.9 million monthly active users. Entering threads at this time will overshadow other Mastodon servers and could offer Meta’s technical expertise in areas such as spam prevention, but many worry that Meta’s ultimate goal will be to essentially take over the fediverse by making it the default client that users choose and using it significant resources to scale the adoption of Meta’s application.
Updated 2/20/24, 1:31 p.m. ET to add Mastodon CTO comment
