Slashdot Log In
Have Spammers Overcome the CAPTCHA?
Posted by
kdawson
on Mon Jul 09, 2007 01:32 AM
from the turing-in-his-grave dept.
from the turing-in-his-grave dept.
thefickler writes "It appears that spammers have found a way to automatically create Hotmail and Yahoo email accounts. They have already generated more than 15,000 bogus Hotmail accounts, according to security company BitDefender. The company says that a new threat, dubbed Trojan.Spammer.HotLan.A, is using automatically generated Yahoo and Hotmail accounts to send out spam email, which suggests that spammers have found a way to overcome Microsoft's and Yahoo's CAPTCHA systems."
Related Stories
[+]
Carnegie Mellon CAPTCHA Digitization Project Now Underway 119 comments
tomandlu writes "The BBC is reporting that Carnegie Mellon University has found a novel use for CAPTCHAs — deciphering old texts. We've discussed this project before, but it was prior to it getting off the ground. Users Entering text acts as a sort of distributed computing project. Basically, the CAPTCHA is made up of two words — one of which is known to Carnegie, and one of which isn't. If the user correctly deciphers the known word, then the unknown word is assumed to be correct. Well, almost. Two different users must give the same answer to the same unknown CAPTCHA before it is taken off the list. 'Using the reCAPTCHA system von Ahn's team is digitizing documents and manuscripts as fast as the Internet Archive can supply them, and the good news for book lovers (and bad news for spammers) is that the supply of reCAPTCHAs is not likely to dry up any time soon.'"
[+]
Yahoo CAPTCHA Hacked 155 comments
Hell Yeah! reminds us of a 2-week-old development that somehow escaped notice here. A team of Russian hackers has found a way to decipher a Yahoo CAPTCHA, thought to be one of the most difficult, with 35% accuracy. The Russian group's notice, posted by one "John Wane," is dated January 16. This site hosts a rapidshare link to what looks to be demonstration software for Windows, and quotes the Russian researchers: "It's not necessary to achieve high degree of accuracy when designing automated recognition software. The accuracy of 15% is enough when attacker is able to run 100,000 tries per day, taking into the consideration the price of not automated recognition — one cent per one CAPTCHA."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Quick! (Score:5, Funny)
FREE PR0N! (Score:5, Insightful)
Not really.
The way they've worked around it probably goes like this: "Free pr0n sets! See more of this hot chick! We don't want automated downloads of these sets, so you need to solve this code to get the download. What? It looks just like the hotmail cpachas? Yeah, we're using the same advanced technology here."
So I guess this approach would also solve other AI problems - by having bored RIs solve them. Maybe not such a bad solution after all?
Re:FREE PR0N! (Score:5, Interesting)
Re:FREE PR0N! (Score:5, Insightful)
Re:FREE PR0N! (Score:4, Interesting)
Re: (Score:3, Insightful)
People keep suggesting this. It might work, but no
Re: (Score:3, Funny)
Then, clearly, the only way to secure hotmail's captchas is to make them so odious that a statistically significant number of bored RIs won't want to solve them. Make all captchas images of latex-clad midgets having group sex while watching Fox News superi
Re:FREE PR0N! (Score:4, Funny)
Re:Quick! (Score:4, Funny)
And while the problem remains unsolved, you can use it for distributed problem-solving! Instant sponsoring opportunities from the big industry!
"So you want to sign up for an account? Okay, we need your name, email, and password twice... and could you figure out the optimal shipping route that goes through all of these cities, and only visits each of them once?"
(Turns out to be a route for some annoying door-to-door salesman. Boy, wonder what he feels like when he finds out someone sent a completely misleading solution! At least sanity-check them first =)
Have they? (Score:5, Insightful)
Could be, according to this /. article (Score:5, Insightful)
Spammers Learn To Outsource Their Captcha Needs
Posted by Zonk on Saturday November 25, @05:36AM
from the hearing-some-ominous-muttering dept.
lukeknipe writes
From the article:
Re:Quick! (Score:4, Funny)
Cataloging CAPTCHA info (Score:4, Interesting)
Re:Cataloging CAPTCHA info (Score:5, Interesting)
The time has surely passed when M$, Yahoo et al needed huge numbers of email subscribers to prove how important they were.
How about a self-policing system? Rather than the typical 'black hole' that 'abuse@...' normally leads to, one could have an automated voting system. If 'n' people complain about 'x' address, then wham, it's blocked. Could check for individual IPs, or make people mail respond to a challenge, to check that it was real people complaining, and not a botnet...
Would enough people participate, though? I know I don't try and get all the spam I receive blocked, just the ones that get through the filter, and even then, just when I have time or the mood takes me...
Re:Cataloging CAPTCHA info (Score:5, Funny)
Re:Cataloging CAPTCHA info (Score:4, Informative)
Most CAPTCHAs use images and random marks or dots in the background but those can be filtered out in a pre-processing step if you know they're drawn using a limited set of colors or don't use the same line thickness as the font. Photographic backgrounds will be limited so they could be filtered easily by detecting which background the CAPTCHA used for that session. Using an oversized background and shifting it by an offset would present difficulty, but Yahoo and Hotmail don't use background images. If backgrounds are rendered gradients, I think it's relatively easy to detect the font color by scanning for broken runs of a continuous single color. The gradient colors would deviate slightly, within a small percent change. If there is any repetitive pattern, which there is if it's a gradient, it only helps the filter breaking the CAPTCHA.
A lot of the easier to crack CAPTCHAs use only a single font and render all the letters in 90 degree angles. The smarter ones jumble and warp the letters by shifting the each letter by an offset and rotating by a small angle. If you could figure out the direction of the warp or rotation, by checking the background you could unwarp or untwist the letters before running OCR on it. Or, you could test each isolated character by rotating every few degrees of rotation and selecting the result that outputs the most number of OCR'd characters from the least amount of rotation.
Regardless, the algorithm doesn't have to be perfect. It could be right 5% of the time and still generate thousands of email accounts. It doesn't care about rejections, because it's got all day to keep trying.
FYI:
http://en.wikipedia.org/wiki/Captcha [wikipedia.org]
http://www.cs.sfu.ca/~mori/research/gimpy/ [cs.sfu.ca]
By the way, some CAPTCHAS have been broken by not deleting sessions in the server, but I doubt Yahoo and Hotmail would be open to that bug.
Re:Cataloging CAPTCHA info (Score:4, Interesting)
it's easy... (Score:4, Insightful)
Re:it's easy... (Score:4, Funny)
Re: (Score:3, Insightful)
I don't think there is any shortage of porn on the net. There is no point in "collecting it all". So, that the same content of one site is available on another distribution medium too, does not matter at all.
Re:it's easy... (Score:5, Funny)
500 accounts created every hour? (Score:5, Insightful)
Re: (Score:3, Interesting)
Re:500 accounts created every hour? (Score:4, Insightful)
Defeating *any* capcha is an AI problem. Defeating the capcha for a website (or group of websites that use the same software) is just a programming task.
Hotmail internal security breach (Score:3, Interesting)
I and some other people I know give out unique disposable email addresses to our co
Work opportunities for developing nations (Score:4, Informative)
http://www.getafreelancer.com/projects/Data-Proce
Of course, there are those who seek to use the IT talent of the sub-continent for a more direct attack:
http://www.getafreelancer.com/projects/PHP-ASP/ya
And as an upstream poster pointed out, there's always the old "Free Porn - solve this CAPTCHA for access" approach.
captcha guide by vulnerability (Score:4, Informative)
OCR or humans (Score:4, Insightful)
If a human is used to read the captcha then there is not much that can be done as that is what a captcha is for: to make sure a human only will be able to bypass it....
Re:OCR or humans (Score:4, Insightful)
How do I make questions that are simple enough to be obvious to legitimate members, but obscure for outsourced human spammers?
I then wondered exactly WHY I'd want to use simple questions anyway, surely I'd want people posting intelligently, so why not moderate at the first access point! Elitism, sure, but I don't think that asking for some mathematically obscure reference for a forum catering to that userbase is Evil, nor any other purpose-specific odd questions. The truly determined can always google the answers.
Re:OCR or humans (Score:5, Funny)
Re: (Score:3, Informative)
Time to stick a fork in it? (Score:3, Informative)
Wow... (Score:5, Funny)
The solution is simple; (Score:3, Interesting)
You can thank me later.
Overcome with Manpower? (Score:3, Insightful)
A sophisticaed enough system could easily "pipe" these graphics to someone who just sits and types all day. At one capcha every 10 seconds, that's about 8000 in a day working 24/7.
Not everything these spammers do has to be automated.
unsurprising (Score:5, Interesting)
The most effective (surprisingly) were form fields hidden with CSS so the users don't enter data in to them, but bots will. You can reject the entire post at that point. It's not universally effective (some bots will actually look at your CSS to determine if you're doing this) but it sure cuts down on a lot of bogus posts. Another method is to generate a form key of some kind, and use that to verify that the form is only good once. this slows spammers down because in order to post again and again, they have to reload the page in order to get a new key. many don't do this, and will attempt to use the same key over and over. if you use a few of these methods, and track repeat offenders, you can add them to your firewall rules so they can't even load the page. Of course, most serious spammers will use hundreds of IPs, so it's difficult to get them all.
It's important to realize that this is a fight you simply can't win - if they're serious about getting through, they'll get through. The most you can hope to achieve is to slow them down long enough to come up with an improved solution.
Re: (Score:3, Informative)
I use a very effective method. Only javascript has to be activated.
The submit button is only enabled after 20 seconds.
Someone needing less time than 20s to write a post is a spammer or has nothing intelligent to say.
An bot will of course submit the form in
Creative CAPTCHA (Score:5, Interesting)
The site just asked the user to check off each image representing a living thing.
Simple, and brutally effective against current AI. I can think of various tricks one can use to make the comparison more difficult as well.
How long until we're using the kind of tests we saw in Blade Runner?
Re:Creative CAPTCHA (Score:4, Insightful)
From another post above: http://www.getafreelancer.com/projects/Data-Proce
Umm. You sure about Yahoo? (Score:4, Interesting)
If you've ever logged into Yahoo chat, you'll see names like warbot001 through warbot400. They're profiles which map to an email address and lame chatters use them to send DOS messages to other chatters. Kinda like the old days on IRC with ping flooding.
Anyway. I highly doubt they manually entered in 400 CAPTCHAS, and I've seen those accounts for a while now so I suspect that CAPTCHA has been defeated for quite some time.
It's like a flood wave (Score:3, Informative)
Spam behaves like a flood caused by heavy thunderstorms and rain. It will start to flood your basement no matter what. You can start to build a little dam here, put some sandbags there, board up your windows, etc. The sad fact ist, it won't help much. You will only save your home if you stop the rain.
That being said, as long as spam does not really hurt large corporations or governments, in terms of more and more expensive resources (machines, energy, air conditioning, administrators etc.) being used to just process the amount of spam coming in, nothing is going to change. Still, these entities are only going to protect themselves, not the public.
Me, I'm going to filter all hotmail and yahoo generated mail to /dev/null. Sorry folks, but just get another mail provider if you want to talk to me.
Mind you, if you filter mail by any means (like spam or virus filtering), never send auto replies. You will only hit innocent bystanders and generate lots of bounces, and run the risk of getting blacklisted by Spamcop or somebody else (if you autoreply to a spamtrap address, for example). I've been using Linux exclusively for more than 14 years on my mail server @ home, and I cannot count the number of autoreplies saying my machine sent this or that W32...blablabla thing, with no Windows client attached or anything. The better part of spam and virus mails uses fake From: addresses.
You can buy software that can thwart captchas (Score:4, Informative)
Quoted from this article [nytimes.com]. No wonder someone used it for a worm.
Also discussed here on
Evolution of the 'Captcha'
Posted by CmdrTaco on Monday June 11, @08:36AM
from the why-can't-i-even-read-them-half-the-time dept.
FireballX301 writes
the solution was simple (Score:4, Interesting)
Too bad MS ignores RFC 2821 (Score:5, Informative)
What a cesspool. Hotmail has always been the ghetto of the internet, but now it's clear that it's infested with criminals, as well as just the technologically illiterate.
Time to blackhole it.
Re: (Score:3, Informative)
report_spam@hotmail.com
abuse@hotmail.com
However, there is a script behind it that usually replies back that the abuse is not from their systems. Even when it is.
When you get past that fil
Re: (Score:3, Interesting)
Sounds like BlueFrog (Score:5, Informative)
It was obviously working, as demonstrated by the concentrated fire they started to take from spammers. Unfortunately, they didn't have the resources (at least, I'd prefer to think it was a resource issue and not one of will) to fight the spammers, and after getting some really terrible legal advice, they got crushed.
Short of brutal vigilante justice [slashdot.org] (which I'm not opposed to here and there, but it tends to not scale very well), Blue Frog's approach seemed to be the only "supply-side" approach to spam that ever seemed to show a bit of effectiveness.
Re:Arguably Impractical but Satisfying Suggestions (Score:4, Insightful)
There are problems with this approach.
1. the allocation of IP addresses has been (and is continuing to be) done in a manner that makes it difficult to quickly block a whole country. AP-NIC allocates blocks of addresses in the entire Asian-Pacific region nearly sequentially and at very funny boundaries.
2. the spam source country varies a lot. you may have a problem with spam from China, but I have a lot more spam from the USA so I need to block that. While I already blocked many DSL/Cable provider netblocks to reduce the crap from infected Windows PCs a bit, there is an increasing risk of collateral damage.
Re:Arguably Impractical but Satisfying Suggestions (Score:4, Informative)
http://www.spamhaus.org/statistics/countries.lass
The United States emits *four* times as much spam as its nearest competitor, China.
Verizon is the world's spammiest ISP.
Re:Arguably Impractical but Satisfying Suggestions (Score:5, Insightful)
Ever heard of proxies?
Also, have a look at the ROKSO list [spamhaus.org]. Most spam originates in the USA. They may route it through Russia or China or Korea, but its source is the USA. Block China, say, and next week it'll be coming via Brazil, or .... faster than you can reconfigure.
If the USA wants to take decisive action, something the government has actively avoided doing, it could shut down spammers in a week. How many spammers have been prosecuted and gone to jail? It's big news when they do, but only a handful have been prosecuted. The feds just don't care enough to build cases, even when the evidence is handed to them. Only if AOL or Microsoft push does anything happen.
Spammers have to make money. Credit card companies do that for them, and they are all based in the USA. As for the pump-and-dump spammers, that's a bit harder, but the stock exchanges should be able to block suspicious activity based on that. Thay don't care now because it's just foolish home investors losing money when they try to "take advantage" of the tips.