Slashdot Log In
Understanding How CAPTCHA Is Broken
Posted by
CmdrTaco
on Sat May 17, 2008 10:10 AM
from the stuff-to-think-about dept.
from the stuff-to-think-about dept.
An anonymous reader writes "Websense Security Labs explains the spammer Anti-CAPTCHA operations and mass-mailing strategies. Apparently spammers are using combination of different tactics — proper email accounts, visual social engineering, and fast-flux — representing a strategy, explains their resident CAPTCHA expert. It is evident that spammers are working towards defeating anti-spam filters with their tactics."
Related Stories
Submission: Anti-Captcha and spamming strategy well explained! by Anonymous Coward
[+]
News: reCAPTCHA Hard At Work, Rescuing Fading Texts 112 comments
sciencehabit writes "Computer scientists have developed a program, called reCAPTCHA, which is being used in lieu of CAPTCHA by several sites, to help digitize old books and newspapers. The reCAPTCHA takes entries from old and faded texts that optical scanners and digital-text readers have trouble with. So every time you solve that string of crooked letters, you may actually be helping historians digitally reconstruct a page from the 1908 New York Times." The Science Now story links to the longer and more informative article at Ars Technica. (We last mentioned this program last year — and now it's good to get some sense of how well it's working.)
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Really? (Score:5, Funny)
Sounds like news to me!
Re:Really? (Score:5, Insightful)
Parent
Re: (Score:2)
Re:Really? (Score:4, Insightful)
Would I give a bank my SS#? Sure.
Would I give my SS# to Yahoo? Not as long as there are other places where I can get free email and play fantasy sports.
Parent
A more practical approach - 3 grades of service (Score:5, Interesting)
* verified user, someone using a credit card or providing some other ID that, if faked, can be prosecuted criminally
* established regular user, a person with a reasonably long and regular history, say, at least 10 logins a month, at least 10 outbound messages a month, and at least 10 inbound messages a month, for 3 of the past 6 months, and a minimal history of complaints.
* other - anyone else
On outbound messages, include a tag that the recipient's mail provider can use as part of its trust-assessment.
The "minimal history of complaints" is a potential problem due to false allegations and joe-jobbing.
Lack of ID could be a problem for users from countries whose IDs are not deemed trustworthy. If I give Yahoo my Nigerian passport number....
Parent
Re:A more practical approach - 3 grades of service (Score:5, Insightful)
Parent
Re:Really? (Score:4, Funny)
(X) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
(X) It will stop spam for two weeks and then we'll be stuck with it
(X) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
(X) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
(X) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
(X) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(X) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
(X) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(X) Sorry dude, but I don't think it would work.
(X) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Parent
Page design (Score:2, Insightful)
Re:Page design (Score:4, Informative)
Parent
Re:Page design (Score:5, Funny)
Pure genius. Even cleverer than those blacked out PDFs...
Parent
I guess I've gotten used to it (Score:4, Interesting)
Re:I guess I've gotten used to it (Score:5, Informative)
Parent
Re:I guess I've gotten used to it (Score:4, Insightful)
Parent
Re: (Score:3, Funny)
Wooh! Mexico is a country with mature wireless industries! (We don't pay to receive SMS)
Re:I guess I've gotten used to it (Score:4, Insightful)
Parent
Re:I guess I've gotten used to it (Score:5, Informative)
Originally, everyone had to pay to make a phone call, but it was free to receive a call. Local calls were less expensive than long-distance calls, but both charged by the minute. Decades ago, phone companies started offering a monthly flat rate for unlimited local calls, and it was so popular that it's all they offer now. Long distance calls are still a per-minute charge for the caller (free to the recipient), except for some newer companies like Vonage that include unlimited long distance calls.
Enter cellular phones. Early adopters (mostly businessmen) wanted the convenience of being able to take a telephone with them in their car, without the rest of the world necessarily needing to know anything about what technology they were using, or having to pay any extra fees. The owner of the cell phone pays per minute for both incoming and outgoing calls, because the only alternative would be to treat all cell phones as long-distance numbers (requiring a 1 dialed in front of the number, and adding a per-minute charge to the calller's bill). People wouldn't have wanted to do that. Remember, the vast majority of calls to cell phones were from land lines, not from other cell phones (because the vast majority of people didn't have cell phones yet).
So, the owner of the cell phone pays for the privilege of having a mobile phone, paying for both sending and receiving calls. Over time, calling between cell phones becomes increasingly popular, but if one person with a cell phone calls another person with a cell phone, BOTH people pay per minute for the call.
And if you're going to pay for sending and receiving phone calls, you're gonna pay for sending and receiving text messages.
Of course, the per-minute fees are exorbitant, so to soften the blow, companies start offering "free" minutes included with the monthly plan, along with a certain number of "free" text messages. The more money you pay per month, the more "free" minutes and text messages are included.
Enter the marketing department. In an attempt to differentiate themselves from the competition, somebody starts offering unlimited calls during non-peak hours (nights and weekends), and all their competitors jump on board. Then, as mobile-to-mobile calling becomes increasingly popular, companies start offering "free" mobile-to-mobile calls within their own network, to entice people to recommend that everyone they know sign up with the same company. But since most people don't even know how to use text messages (my first cell phone didn't support them), there's no marketing reason to offer free text messaging. It's much more profitable to charge $0.10 per message (after the first few hundred per month that are included with the plan).
We now have a new generation who has grown up with cell phones and is perfectly comfortable typing entire conversations on a keypad, abbreviating anywhere they can save keystrokes just as we did when chatting on computer bulletin boards and IRC in the late 80s and early 90s. Some people here remember the days before 300baud modems; abbreviating was essential.
As demand for text messaging increases among this new generation and improving technology reduces actual per-call and per-message costs, marketing departments will decide that they stand more to gain from offering unlimited calls and text messages (because they can advertise it to attract customers) in their standard monthly rate than then do from charging $0.10/message. They're already moving in this direction, offering unlimited calls and texts to/from a certain number of "favorite" people. Eventually we'll all have one flat monthly rate for unlimited usage, and the whole question of paying to receive calls and text messages will be irrelevant.
I was about to say it will be forgotten, but it has never occurred to most Americans that things could work differently in the rest of the world, so there's no question to forget.
Parent
Re: (Score:2)
Re: (Score:3, Informative)
a. No SMS has a subject line, it is a "Short Message Service" (max 160 chars)
b. How the hell does the network know whether you have opened the message or not -- either it has been sent to your phone, or it has not. Any other way, and people would be publishing "free-SMS" hacks for phones.
Wrong title (Score:5, Informative)
Im surprised they're not using them to break the spam filter of yahoo/hotmail/gmail though, I mean if they all started sending each other spam and marketing it as ham, wouldn't that pretty much break any feedback based system that their using to protect their users.
Re:Wrong title (Score:5, Informative)
Parent
Re: (Score:2)
Wouldn't collaborative baysian [paulgraham.com] filtering mitigate that problem? The preferences of people who actually enjoy receiving spam would be combined with the preference of other similar-minded individuals. So then the people who like spam get their sp
Sometimes It Comes as an Easy Fix (Score:5, Informative)
Re: (Score:2)
1) Make a css hidden field, that must be submitted blank or else the account creation or post fails. Bots try to enter data into every field provided, but users can't see the field and will leave it blank.
2) Have the robots.txt file actually dynamic, and anything that hits it is labeled as a bot, and then if they try to register an account, ban the IP for a while. Then put a hidden link (via css again) to a page with a form to submit. If anything hits t
Re: (Score:3, Insightful)
This is more about subverting CAPTCHA (Score:4, Informative)
This is the scam part, not the technology part of their operations, which would actually tell us about the possible weakenesses for the CAPTCHA tests and give hints how to fix them.
Animated CAPTCHAs? (Score:5, Interesting)
Re:Animated CAPTCHAs? (Score:5, Interesting)
Parent
Re:Animated CAPTCHAs? (Score:5, Informative)
But that captcha on e-gold would be trivial to break. Over the course of the animation all parts of all numbers are visible with no variation or noise around them. If they rotated, though, and were slightly larger than the image, it might just work. That would be such a pain in the ass for humans to read I don't think it would be used at all.
The most likely captcha technologies to win, I think, are the ones that require some amount of contextual knowledge about our world. Nobody's really created an anti-captcha bot that can distinguish a kitten from a tiger, for instance. Tests like these, even though they're also obnoxious to humans, are much more effective.
Parent
Re: (Score:2)
Or even something like "please check the objects you see in the animation", followed by, say, 10 radio buttons?
Re: (Score:2)
Or even something like "please check the objects you see in the animation", followed by, say, 10 radio buttons?
Which is the point.
Re: (Score:2)
The animations can also be machine generated from a dictionary of images, with a random number of frames and a random frame position for each image.
This is all pointless, however, since spammers probably pay people to register new accounts for them.
CAPTCHA sucks (Score:3, Interesting)
This article is an advertisement (Score:5, Insightful)
This article links to what is basically an infomercial. What it links to is filled with pictures and seeming explanations, but it's written in scare-mongering language and not written with an eye towards the reader understanding it. It as an advertisement telling you that Websense is a fantastic company because they understand all this terribly scary stuff and already have the technology to defeat it for you.
Re:This article is an advertisement (Score:4, Interesting)
Parent
Re:This article is an advertisement (Score:4, Insightful)
It would be really nice if people would tag articles like this with 'slashvertisement'. :-)
Parent
Captchas (Score:2, Funny)
Fighting spam will either succeed or it will fail (Score:2, Insightful)
Mail services that don't provide good spam protection will fail.
If it becomes too hard to fight spam, mail as we know it will end and be replaced by something else, much like USENET was for most purposes replaced by other, less-spam-prone media.
This is getting silly. (Score:4, Funny)
That should keep the bots out, right?
Why are we so helpless? (Score:4, Insightful)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
How on earth would you actually request each individual email you want to receive? Fax your dad and tell him he's authorized to send you an email detailing his vacation cruise? Have people call you up, where you give them an ID number that must be in the subject line?
Even if you went as far as white-listing email addresses (which you actually can do now) you'd miss out when your buddy gave your email to someone who was looking to offer you a job at twice your current salary, or that gir
Web page redirection may have to go (Score:5, Interesting)
We're seeing the need for some limits on web page redirection. Most of these attacks involve putting something on a trusted place which redirects to an untrusted place. Google, with incredible sloppyness, allows Blogspot accounts to do this, and as a result, they are heavily exploited by spammers. (Try, for example, "nikaluti21040.blogspot.com", which will redirect, via some iframes and other tricks, to "selissia.com", which is hosted on "secureserver.net").
Exploitation of legitimate sites to get through spam filters is a problem, but it can be dealt with if you're willing to take a hard line. Our first step in that direction was our list of major domains being exploited by active phishing scams. [sitetruth.com] Our position is that one phishing attack from within a domain blacklists the whole domain. But within three hours after the problem is fixed, they're off the list. Major sites make the list now and then; Google, Dell, MSN, and Yahoo have all been on the list at one time or another. But they now know to take steps to get themselves off within hours. The Anti-Phishing Working Group and PhishTank have been helpful with this effort. We're down to 47 such domains today. It was about 175 when we started last fall. Most of the remaining entries are free web hosting services or DSL providers.
We and others have observed that there's an inverse relationship between the number of redirects and the legitimacy of a web page. We've been looking at this at SiteTruth [sitetruth.com]. For things like AdWords ads, where some sites use redirection as part of a tracking systems, it's typically the bottom-feeders who are using redirection. An advertiser promoting their own product or service doesn't need it; it's brokers, intermediaries, and made-for-Adwords sites that use redirection. Anything with more than one redirect is almost bad. We expect to use redirection as part of our legitimacy metric in the future.
It's thus time for browsers to limit their acceptance of redirection. One HTTP-level redirect, OK. Beyond that, put up a popup warning of suspicious redirection behavior. Redirects via META tags and Javascript should produce a popup. Sure, some site operators will look bad, but they will adapt.
Re: (Score:2)
Unfortunately, so will the spammers.
Every time we close off another way to hide business identity, filtering gets better. We can't actually stop the spam, but we can fix it so few humans ever see it.
Spammers trick - REuseable captcha (Score:4, Interesting)
Present Captcha image to 2 users (agreement = correct)
So the monkeys pull the right lever and get the reward
of viewing the next adult video, and the spammer gets
a near-realtime solution to even the best of captchas.
Can it break RapidShare's upcoming CAPTCHA? ;) (Score:4, Funny)
Re:My spam rules-- (Score:5, Funny)
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
It would be so easy to bankcrupt a site that tried this (phone number generator, script) that no sane site owner would try it.
Re: (Score:3, Insightful)
It's a classic case of Security through Obscurity, and this time it works.
However, SWF files have accessibility issues, and there are always people who love to block them.