Have Spammers Overcome the CAPTCHA? 330
thefickler writes "It appears that spammers have found a way to automatically create Hotmail and Yahoo email accounts. They have already generated more than 15,000 bogus Hotmail accounts, according to security company BitDefender. The company says that a new threat, dubbed Trojan.Spammer.HotLan.A, is using automatically generated Yahoo and Hotmail accounts to send out spam email, which suggests that spammers have found a way to overcome Microsoft's and Yahoo's CAPTCHA systems."
Cataloging CAPTCHA info (Score:4, Interesting)
Arguably Impractical but Satisfying Suggestions (Score:2, Interesting)
* 25 year jail and a $2M fine for those who use spammers. Tracking spammers is hard. Typical the fools that reply to spam give their details to a spammer web site, who sells a call list to a mortgage agency, who then calls you, supposedly unaware of the source. Some journalists have done this and followed the trail. Now if journalists can do it, maybe the FBI can do it? If the FBI aren't up to the task, bounty hunters maybe?
* Same thing: Have law enforcement respond to spam, trace the payment and throw the lowlife on the other end into the slammer: 25 years jail and a $2M fine.
* Conan the Barbarian has some advice here: "Savages are more polite than so-called civilized men, because a civilized man knows he can insult someone without getting his skull split". The reason spammers do it isn't just because it can make money, but because they know they can get away with it. The chance of getting prosecuted at the moment is next to nothing. Give them a fair chance of getting imprisoned, and they'll change their tune.
Comes down to the same thing: Congress drafting laws and supplying the funds to enforce it. Do I hear a Presidential Candidate with an anti-Spam policy?
The solution is simple; (Score:3, Interesting)
You can thank me later.
Re:500 accounts created every hour? (Score:3, Interesting)
Things get real economical real fast if you think globally and happen to be evil.
In a point of irony I would like to mention that the capcha for this slashdot comment was "disturbs"
Re:FREE PR0N! (Score:5, Interesting)
Re:Cataloging CAPTCHA info (Score:5, Interesting)
The time has surely passed when M$, Yahoo et al needed huge numbers of email subscribers to prove how important they were.
How about a self-policing system? Rather than the typical 'black hole' that 'abuse@...' normally leads to, one could have an automated voting system. If 'n' people complain about 'x' address, then wham, it's blocked. Could check for individual IPs, or make people mail respond to a challenge, to check that it was real people complaining, and not a botnet...
Would enough people participate, though? I know I don't try and get all the spam I receive blocked, just the ones that get through the filter, and even then, just when I have time or the mood takes me...
Re:Too bad MS ignores RFC 2821 (Score:3, Interesting)
Auto-replies that confirm that a message has been received are OK ("Hi, thanks for writing to postmaster@foo.com; your message was received and will be dealt with by a staff member"), but only if there's eventually some followup. The RFC is pretty clear that the abuse and postmaster addresses should be monitored by a person; everything else is just optional window dressing.
Microsoft just blackholes both of those addresses. I've never gotten any further messages from them in response to any of the spam I've ever forwarded their way, but I suppose it's possible, or was possible at one point, that they were looking at it. But I've never gotten jack from them, and they're on the rfc-ignorant.org shitlist. (Which is a tremendously easy shitlist to get removed from, so I doubt it's in error.) What Hotmail/MS would like you to do is apparently go to some page on their site that relates to spam, but I've never visited.
Yahoo is likewise on the rfc-ignorant list, although they apparently just bounce with a "552 mail size or count over quota [rfc-ignorant.org]" error; although I think I've sent them stuff and not gotten a bounce message of any kind. (So either they're reading it and just haven't bothered to click the link to get themselves off the rfc-ignorant list, or they blackhole incoming messages silently, which would be very evil.)
Interestingly, Gmail.com and Google.com are not on the list, and neither is hushmail.com, aim.com, or inbox.com, although Lycos and its subdomains (I didn't even know they were still in business) are.
unsurprising (Score:5, Interesting)
The most effective (surprisingly) were form fields hidden with CSS so the users don't enter data in to them, but bots will. You can reject the entire post at that point. It's not universally effective (some bots will actually look at your CSS to determine if you're doing this) but it sure cuts down on a lot of bogus posts. Another method is to generate a form key of some kind, and use that to verify that the form is only good once. this slows spammers down because in order to post again and again, they have to reload the page in order to get a new key. many don't do this, and will attempt to use the same key over and over. if you use a few of these methods, and track repeat offenders, you can add them to your firewall rules so they can't even load the page. Of course, most serious spammers will use hundreds of IPs, so it's difficult to get them all.
It's important to realize that this is a fight you simply can't win - if they're serious about getting through, they'll get through. The most you can hope to achieve is to slow them down long enough to come up with an improved solution.
Creative CAPTCHA (Score:5, Interesting)
The site just asked the user to check off each image representing a living thing.
Simple, and brutally effective against current AI. I can think of various tricks one can use to make the comparison more difficult as well.
How long until we're using the kind of tests we saw in Blade Runner?
NoSpam! (Score:2, Interesting)
spam only hurts the ignorant... (Score:2, Interesting)
My guess is that most experienced and/or properly educated internet users do this or something similar. Truth is, if you want a quality, reliable product you have to pay for it. Imagine if yahoo or google had $1 for each of their 10s of Millions of accounts. That'd be a lot of legal capital to pursue and hunt down spammers, not to mention the ability to create a class action lawsuit which would carry more weight. Now, imagine if they got $10 or $20 per account. I'm definately not proposing a per email charge here..simply requiring that some small charge be levied so that email accounts are only created by those who want them used for legitimate and expected communication.
Our lives are already overloaded with advertising from marketers who are desperately looking for ways to justify their jobs. Thank the powers for video recorders that allow us to skip commercials and pop up blockers that have reclaimed the web.
That being said...if someone wants to create a vigilante task force that hunts down and punishes top spammers, I'd gladly volunteer. There are just as many legal ways to harass these people and make their lives difficult as hell w/o resorting to violence. Unfortunately, the odds are that this guy did more than spam people (those who take the easy/lazy/annoying way of doing business probably also cheat/lie/scam as well..) and so the person(s) commiting this crime probably did not sleep better that night knowing their inbox would be a little less full.
Chinese CAPTCHA farmers (Score:0, Interesting)
WWCoreWar! (Score:1, Interesting)
Scorched Earth strategy works well against those who draw their strength from resources laying free for taking in the territory. Let all the webmorons who feed the botbarons with their resources feel the wraith!
Umm. You sure about Yahoo? (Score:4, Interesting)
If you've ever logged into Yahoo chat, you'll see names like warbot001 through warbot400. They're profiles which map to an email address and lame chatters use them to send DOS messages to other chatters. Kinda like the old days on IRC with ping flooding.
Anyway. I highly doubt they manually entered in 400 CAPTCHAS, and I've seen those accounts for a while now so I suspect that CAPTCHA has been defeated for quite some time.
Re:Work opportunities for developing nations (Score:1, Interesting)
Hotmail internal security breach (Score:3, Interesting)
I and some other people I know give out unique disposable email addresses to our contacts. There is a different unique address for each of our friends and family.
Yesterday I and they received spam emails sent to several of the disposable email addresses. This points us to several of our friends and family as having had their email address lists stolen by spammers.
The common factors are:
There is therefore no obvious way for the spammers to have obtained these unique email addresses, except by the spammers accessing Hotmail's internal systems via a security breach. The security breach could be technical (an unpatched vulnerability in one of Hotmail's systems) or human (one of their members of Hotmail's (outsourced?) staff copied the contents of some/all of their servers and sold them to the spammers)
Re:FREE PR0N! (Score:1, Interesting)
Re:FREE PR0N! (Score:3, Interesting)
If it's not "very public" how are you going to get enough suckers to solve your captchas? You need a lot of exposure. Actually, a real porn site with the same hit rate could probably make more money from ads; and the captcha solving would just detract from that. Another reason this doesn't seem to have happened in reality.
Re:OCR or humans (Score:3, Interesting)
Re:FREE PR0N! (Score:4, Interesting)
Re:Creative CAPTCHA (Score:3, Interesting)
So the bot gets a copy of the page, with the embedded talk back information, and begins a binary tree search for the combination to the lock, resubmitting the exact same form each time, thus preventing the combination from changing during the search.
It makes no difference how many pictures you use, what they are of, or what the question is, since the end result is a true or false for each position in the matrix.
Certain assumptions can be made for the starting position to reduce the search space, as well. The distribution can be calculated after a few successes, building a extrapolated probability curve for the matrix as a whole, and for each position. Since the distribution is probably pseudo random, and patterns in the generation become trivial steps in the solution space.
This is the same problem with the Captcha, not that the search space is large, but that the programmers designing the solution fail to account for the view of the computer performing the search. A captcha is not a picture to the bot. It is a numeric lock, with a fixed combination space and rules for the combination, both of which can be exploited. Many captcha systems also fail to properly invalidate the capthca after a failed attempt, so once the bot has a tagged form, it can re use the same captcha over and over until it succeeds.
Thus there does not need to be AI or even necessarily OCR, just an intelligent search function with some knowledge of the rules for the search space (e.g. from x to y digits, always contains between a and b numbers, high probability of n capitals, etc).
From there it is a simple lock picking.
Set the computer theory books down for once and realize that computers are tireless, cheap, and networked. Search power and computational power are easy to come by, and all it really takes is one person who can analyze the patterns and feed the rules to the computer.
Red Herring captchas and time-delays and limits (Score:2, Interesting)
Example:
#1) What is 1+two?
#2) [image captcha]CoffeeCar
#3) [image captcha]Use the math captcha
Please type the correct answer: __________
Then put a 10+ second time delay and put a per-IP limit on the # of requests in any period of time, say, 10 per hour for most IPs and more for known corporate- or ISP-outbound-firewall-IPs.
Also, greatly limiting the number of messages per day free accounts can send during their first 30 days will cut down on their utility to spammers. Anyone who needs to waive that can either wait a month, buy an account, or if Yahoo, etc. is feeling generous, get an "authenticated free" account by providing the mail provider with identity verification.
Of course, all accounts that haven't explicitly requested a waiver AND authenticated themselves should be subject to normal spam-level-volume throttling. People who manage opt-in mailing lists and other legitimate high-volume users will normally request a waiver.
Re:Overcome with Manpower? (Score:2, Interesting)
but couldn't they use the audio funcion - hotmail can also read the number & letters if you are visally impaired...
voice recognition is quite good these days...
could they not just use speakeasy or the like to listen to the captcha being read out and type it in the box?
obviously its unlikly but never the less...
Re:Wow... (Score:3, Interesting)
The CAPTCHA does nothing, but a simple "Are you Human? yes/no" radio button option on registration blocked them for over a month.
Vietnam (Score:2, Interesting)
I talked with a manager there about it (I think they thought I was a potential customer) but I don't think they had any idea what they were doing, they even showed me around explaining that they specialise it all sorts things like Date Mining.
The software they were using looked like some custom application (Wasn't in English) which showed an image (In this case a CAPTCHA) with a few other entries fields and combo boxes on the right pane. They're were also a few people digitizing what appeared to be pages from books.
Well I got a free coffee, so I was happy, it certainly was interesting.
Now to type in my own CAPTCHA so I can submit this post...or I could hire the Vietnamese to do it
but... (Score:1, Interesting)
Also, wouldn't it be possible to limit the speed at which email can be sent from an account? I mean theres no human alive who can send out emails at the rate spam is produced or have a legitimate need to send single emails to even hundreds of people at a time.
Re:Quick! (Score:3, Interesting)
"Enter your solution to the Riemann hypothesis"
"Please submit a new prime number"
"What is a solution to the Arab-Israeli conflict?"
"Show a correct equation that joins the electro-weak and strong forces with gravity."
the solution was simple (Score:4, Interesting)
Re:FREE PR0N! (Score:3, Interesting)
I can't tell whether the current price structure suggests that this has already happened, or that the supply of human intelligence is so vast that it doesn't matter. I do know that several people have written tools to help them solve HITs faster, by grabbing new HITs in the background, and optimizing the display for their needs. But I wonder how much cheaper you could make HITs if you wrote the instructions in Chinese.
Re:Cataloging CAPTCHA info (Score:4, Interesting)