Have Spammers Overcome the CAPTCHA? 330
thefickler writes "It appears that spammers have found a way to automatically create Hotmail and Yahoo email accounts. They have already generated more than 15,000 bogus Hotmail accounts, according to security company BitDefender. The company says that a new threat, dubbed Trojan.Spammer.HotLan.A, is using automatically generated Yahoo and Hotmail accounts to send out spam email, which suggests that spammers have found a way to overcome Microsoft's and Yahoo's CAPTCHA systems."
Quick! (Score:5, Funny)
FREE PR0N! (Score:5, Insightful)
Not really.
The way they've worked around it probably goes like this: "Free pr0n sets! See more of this hot chick! We don't want automated downloads of these sets, so you need to solve this code to get the download. What? It looks just like the hotmail cpachas? Yeah, we're using the same advanced technology here."
So I guess this approach would also solve other AI problems - by having bored RIs solve them. Maybe not such a bad solution after all?
Re:FREE PR0N! (Score:5, Interesting)
Re:FREE PR0N! (Score:5, Insightful)
Re:FREE PR0N! (Score:4, Interesting)
Re: (Score:3, Informative)
Re: (Score:3, Interesting)
Re: (Score:3)
Re: (Score:3, Insightful)
There's enough places in the world where $2.50 is not only a decent day's wage (especially if you can do more than one of these) but more importantly where there simply no industrial infrastructure to compete with this job. It's either this or an hour of sitting around and picking your nose. Or maybe an hour of backbreaking ditch digging for $1.
Re: (Score:3, Insightful)
People keep suggesting this. It might work, but no one has ever, to my knowledge, put it into practice. And by its nature, this would be pretty public. So if you don't have a URL, this is just an urban legend.
Actually, I think if put into practice, it would itself be attacked by anti-spammers. They'd t
Re: (Score:3, Interesting)
If it's not "very public" how are you going to get enough suckers to solve your captchas? You need a lot of exposure. Actually, a real porn site with the same hit rate could probably make more money from ads; and the captcha solving would just detract from that. Another reason this doesn't seem to have happened in reality.
Re: (Score:2)
Wooohoooo! Free pr0n! Link please.
Re: (Score:3, Funny)
Then, clearly, the only way to secure hotmail's captchas is to make them so odious that a statistically significant number of bored RIs won't want to solve them. Make all captchas images of latex-clad midgets having group sex while watching Fox News superimposed over stills from German World War II propaganda films.
Re:FREE PR0N! (Score:4, Funny)
Re:Quick! (Score:4, Funny)
And while the problem remains unsolved, you can use it for distributed problem-solving! Instant sponsoring opportunities from the big industry!
"So you want to sign up for an account? Okay, we need your name, email, and password twice... and could you figure out the optimal shipping route that goes through all of these cities, and only visits each of them once?"
(Turns out to be a route for some annoying door-to-door salesman. Boy, wonder what he feels like when he finds out someone sent a completely misleading solution! At least sanity-check them first =)
Have they? (Score:5, Insightful)
Could be, according to this /. article (Score:5, Insightful)
Spammers Learn To Outsource Their Captcha Needs
Posted by Zonk on Saturday November 25, @05:36AM
from the hearing-some-ominous-muttering dept.
lukeknipe writes
From the article:
Re: (Score:3, Interesting)
"Enter your solution to the Riemann hypothesis"
"Please submit a new prime number"
"What is a solution to the Arab-Israeli conflict?"
"Show a correct equation that joins the electro-weak and strong forces with gravity."
Re:Quick! (Score:4, Funny)
Cataloging CAPTCHA info (Score:4, Interesting)
Re:Cataloging CAPTCHA info (Score:5, Interesting)
The time has surely passed when M$, Yahoo et al needed huge numbers of email subscribers to prove how important they were.
How about a self-policing system? Rather than the typical 'black hole' that 'abuse@...' normally leads to, one could have an automated voting system. If 'n' people complain about 'x' address, then wham, it's blocked. Could check for individual IPs, or make people mail respond to a challenge, to check that it was real people complaining, and not a botnet...
Would enough people participate, though? I know I don't try and get all the spam I receive blocked, just the ones that get through the filter, and even then, just when I have time or the mood takes me...
Re:Cataloging CAPTCHA info (Score:5, Funny)
Re: (Score:2)
Renewing my
Just musing about how concerned people could actively contribute to spam reduction by getting a 'real' response to their mails to ISPs. Central anti-spam sites are repeatedly attacked, and sometimes closed. Perhaps if it were managed on a 'per ISP / email provider' basis this would be harder for the botnetters to attack.
What's the alternative, do nothing?
Re: (Score:2)
Making a system this easy to do a denial of service attack is essentially making a broken system.
Re:Cataloging CAPTCHA info (Score:4, Informative)
Most CAPTCHAs use images and random marks or dots in the background but those can be filtered out in a pre-processing step if you know they're drawn using a limited set of colors or don't use the same line thickness as the font. Photographic backgrounds will be limited so they could be filtered easily by detecting which background the CAPTCHA used for that session. Using an oversized background and shifting it by an offset would present difficulty, but Yahoo and Hotmail don't use background images. If backgrounds are rendered gradients, I think it's relatively easy to detect the font color by scanning for broken runs of a continuous single color. The gradient colors would deviate slightly, within a small percent change. If there is any repetitive pattern, which there is if it's a gradient, it only helps the filter breaking the CAPTCHA.
A lot of the easier to crack CAPTCHAs use only a single font and render all the letters in 90 degree angles. The smarter ones jumble and warp the letters by shifting the each letter by an offset and rotating by a small angle. If you could figure out the direction of the warp or rotation, by checking the background you could unwarp or untwist the letters before running OCR on it. Or, you could test each isolated character by rotating every few degrees of rotation and selecting the result that outputs the most number of OCR'd characters from the least amount of rotation.
Regardless, the algorithm doesn't have to be perfect. It could be right 5% of the time and still generate thousands of email accounts. It doesn't care about rejections, because it's got all day to keep trying.
FYI:
http://en.wikipedia.org/wiki/Captcha [wikipedia.org]
http://www.cs.sfu.ca/~mori/research/gimpy/ [cs.sfu.ca]
By the way, some CAPTCHAS have been broken by not deleting sessions in the server, but I doubt Yahoo and Hotmail would be open to that bug.
Re:Cataloging CAPTCHA info (Score:4, Interesting)
it's easy... (Score:4, Insightful)
Re:it's easy... (Score:4, Funny)
Re: (Score:3, Insightful)
I don't think there is any shortage of porn on the net. There is no point in "collecting it all". So, that the same content of one site is available on another distribution medium too, does not matter at all.
Re:it's easy... (Score:5, Funny)
Re: (Score:2)
More so if you get the porn you offer by downloading stolen porn via bittorrent in the first place.
500 accounts created every hour? (Score:5, Insightful)
Re: (Score:3, Interesting)
Things get real economical real fast if you think globally and happen to be evil.
In a point of irony I would like to mention that the capcha for this slashdot comment was "disturbs"
Re:500 accounts created every hour? (Score:4, Insightful)
Defeating *any* capcha is an AI problem. Defeating the capcha for a website (or group of websites that use the same software) is just a programming task.
Re: (Score:3, Funny)
Hotmail internal security breach (Score:3, Interesting)
I and some other people I know give out unique disposable email addresses to our contacts. There is a different unique address for each of our friends and family.
Yesterday I and they received spam emails sent to several of the disposable email addresses. This points us to several of our friends and family as having had their email addres
Work opportunities for developing nations (Score:4, Informative)
http://www.getafreelancer.com/projects/Data-Proce
Of course, there are those who seek to use the IT talent of the sub-continent for a more direct attack:
http://www.getafreelancer.com/projects/PHP-ASP/ya
And as an upstream poster pointed out, there's always the old "Free Porn - solve this CAPTCHA for access" approach.
captcha guide by vulnerability (Score:4, Informative)
OCR or humans (Score:4, Insightful)
If a human is used to read the captcha then there is not much that can be done as that is what a captcha is for: to make sure a human only will be able to bypass it....
Re:OCR or humans (Score:4, Insightful)
How do I make questions that are simple enough to be obvious to legitimate members, but obscure for outsourced human spammers?
I then wondered exactly WHY I'd want to use simple questions anyway, surely I'd want people posting intelligently, so why not moderate at the first access point! Elitism, sure, but I don't think that asking for some mathematically obscure reference for a forum catering to that userbase is Evil, nor any other purpose-specific odd questions. The truly determined can always google the answers.
Re:OCR or humans (Score:5, Funny)
Re: (Score:3, Informative)
Re: (Score:3, Interesting)
Time to stick a fork in it? (Score:3, Informative)
You might be able to trip some calculators up by using complex math or logic problems that aren't easily parseable by machines*, but this would also trip up a lot of humans. (Whether that's a bug or a feature I'll leave up to you.)
CAPTCHAs were, and
Re: (Score:2)
> (well, ok maybe not this one, unless it's a math forum...)
With the state of US education, I think that the first one might be a bit too difficult
Re: (Score:2)
One type of captcha that could work is asirra [microsoft.com] where they use images from petfinder.com [petfinder.com], display 12 of them and ask them to click on all of the cats. A computer finds this extra-ordinarilly difficult as the fur is very simmilar and the cats and dogs are all in different poses and all the lighting conditions are different, but a human can distinguish them very clearly.
OK, so I know it's microsoft and why aren't they using it on hotmail already, but I think it's the right direction for Captchas.
Fight fire with fire (Score:2)
Either that, or someone needs to write the next massive-spread virus and have it break your compute
Sounds like BlueFrog (Score:5, Informative)
It was obviously working, as demonstrated by the concentrated fire they started to take from spammers. Unfortunately, they didn't have the resources (at least, I'd prefer to think it was a resource issue and not one of will) to fight the spammers, and after getting some really terrible legal advice, they got crushed.
Short of brutal vigilante justice [slashdot.org] (which I'm not opposed to here and there, but it tends to not scale very well), Blue Frog's approach seemed to be the only "supply-side" approach to spam that ever seemed to show a bit of effectiveness.
Re: (Score:2)
Wasn't there some guy that got revenge by finding a spammer's home address and subscribing him to every snail mailing list he could think of?
Are they reusing them in e.g. blog accounts? (Score:2)
Are the spamming b.st.rds reusing the images for blog comments, or something like that? Do that for a hundred blog readers and they could get fast feedback.
Re: (Score:2)
Zut alors! (Score:2)
Wow... (Score:5, Funny)
..use Recaptcha (Score:2)
Re: (Score:3, Interesting)
The CAPTCHA does nothing, but a simple "Are you Human? yes/no" radio button option on registration blocked them for over a month.
Arguably Impractical but Satisfying Suggestions (Score:2, Interesting)
* 25 year jail and a $2
Re:Arguably Impractical but Satisfying Suggestions (Score:4, Insightful)
There are problems with this approach.
1. the allocation of IP addresses has been (and is continuing to be) done in a manner that makes it difficult to quickly block a whole country. AP-NIC allocates blocks of addresses in the entire Asian-Pacific region nearly sequentially and at very funny boundaries.
2. the spam source country varies a lot. you may have a problem with spam from China, but I have a lot more spam from the USA so I need to block that. While I already blocked many DSL/Cable provider netblocks to reduce the crap from infected Windows PCs a bit, there is an increasing risk of collateral damage.
Re: (Score:2)
Re: (Score:2)
The problem is that the politicians do not understand what issues are. Everyone is affected by spam, so that is an issue. Everyone is affected by changes in climate and environment, so that is an issue. They should focus on that, instead of trying to extinguish a fire by blowing into it.
Re: (Score:2)
Re: (Score:2)
Re:Arguably Impractical but Satisfying Suggestions (Score:4, Informative)
http://www.spamhaus.org/statistics/countries.lass
The United States emits *four* times as much spam as its nearest competitor, China.
Verizon is the world's spammiest ISP.
Re:Arguably Impractical but Satisfying Suggestions (Score:5, Insightful)
Ever heard of proxies?
Also, have a look at the ROKSO list [spamhaus.org]. Most spam originates in the USA. They may route it through Russia or China or Korea, but its source is the USA. Block China, say, and next week it'll be coming via Brazil, or .... faster than you can reconfigure.
If the USA wants to take decisive action, something the government has actively avoided doing, it could shut down spammers in a week. How many spammers have been prosecuted and gone to jail? It's big news when they do, but only a handful have been prosecuted. The feds just don't care enough to build cases, even when the evidence is handed to them. Only if AOL or Microsoft push does anything happen.
Spammers have to make money. Credit card companies do that for them, and they are all based in the USA. As for the pump-and-dump spammers, that's a bit harder, but the stock exchanges should be able to block suspicious activity based on that. Thay don't care now because it's just foolish home investors losing money when they try to "take advantage" of the tips.
The solution is simple; (Score:3, Interesting)
You can thank me later.
Re: (Score:2)
I do wonder... if mail from thousands of Hotmail and Yahoo! accounts gets to be tagged regularly as spam, maybe Gmail starts blocking them, thus making people jump ship from the first two... Therefore, I'd guess it's just GoogleSpammer Beta. An excellent plan, except...
Feedback loop (Score:2)
Re: (Score:2)
That would almost solve their bad reputation as spam senders immediately.
But probably they are not at all interested in their reputation, only in their number of users. Even a spammer is a user, that will count once they want to sell-off their service.
Aha! That explains everything (Score:2)
Re: (Score:2)
Thanks, gmail!
Overcome with Manpower? (Score:3, Insightful)
A sophisticaed enough system could easily "pipe" these graphics to someone who just sits and types all day. At one capcha every 10 seconds, that's about 8000 in a day working 24/7.
Not everything these spammers do has to be automated.
unsurprising (Score:5, Interesting)
The most effective (surprisingly) were form fields hidden with CSS so the users don't enter data in to them, but bots will. You can reject the entire post at that point. It's not universally effective (some bots will actually look at your CSS to determine if you're doing this) but it sure cuts down on a lot of bogus posts. Another method is to generate a form key of some kind, and use that to verify that the form is only good once. this slows spammers down because in order to post again and again, they have to reload the page in order to get a new key. many don't do this, and will attempt to use the same key over and over. if you use a few of these methods, and track repeat offenders, you can add them to your firewall rules so they can't even load the page. Of course, most serious spammers will use hundreds of IPs, so it's difficult to get them all.
It's important to realize that this is a fight you simply can't win - if they're serious about getting through, they'll get through. The most you can hope to achieve is to slow them down long enough to come up with an improved solution.
Re: (Score:2)
The most effective (surprisingly) were form fields hidden with CSS so the users don't enter data in to them, but bots will. You can reject the entire post at that point. It's not universally effective (some bots will actually look at your CSS to determine if you're doing this) but it sure cuts down on a lot of bogus posts. Another method is to generate a form key of some kind, and use that to verify that the form is only good once. this slows spammers down because in order to post again and again, they have to reload the page in order to get a new key. many don't do this, and will attempt to use the same key over and over. if you use a few of these methods, and track repeat offenders, you can add them to your firewall rules so they can't even load the page. Of course, most serious spammers will use hundreds of IPs, so it's difficult to get them all.
All of these seem like they'd only work against random spammers -- bots trolling for forums and what have you. But if a spammer was targeting you, like they targeted Hotmail, these methods would be useless.
Re: (Score:2)
That is correct. It's only meant to slow them down, not to eliminate or make it impossible. It's an amazingly difficult problem. At most you really can only hope to make the path rocky enough to buy yourself time, and possibly collect a few IPs.
Re: (Score:3, Informative)
I use a very effective method. Only javascript has to be activated.
The submit button is only enabled after 20 seconds.
Someone needing less time than 20s to write a post is a spammer or has nothing intelligent to say.
An bot will of course submit the form in less than 20s, there comes the timestamping into play. If the form display and form submit events are less than 20s apart it's considered spam too.
Catches 99% of the posts.
0% false positives.
Of course if a big site like yahoo implements this, it's easy fo
Ignore them? (Score:2)
We're pouring so many resources into fighting them... it just strikes me that if we just tried to ignore the bastards, they'd find something better (or more profitable) to do than spam.
Re: (Score:2)
I'm the first to start a campaign "Punch a spammer's customer today". If you hear someone bought something from a spammer, punch them and explain "That's for funding another 1000 messages to flood my mailbox."
Re: (Score:2)
My inbox has been spammed to death. I open it every 6-8 weeks to delete the stuff. Eventualy when nobody has an e-mail account except spammers, the spammers will go away (to try to find you). Expect more IM spam since e-mail is dying under the load.
I love getting hot stock tips a couple months late. I look them up to see
Re: (Score:2)
Block the United States (Score:2)
Route-around the United States, and the problem is solved for most of us. They can rejoin the world when lawmakers take spam seriously.
Creative CAPTCHA (Score:5, Interesting)
The site just asked the user to check off each image representing a living thing.
Simple, and brutally effective against current AI. I can think of various tricks one can use to make the comparison more difficult as well.
How long until we're using the kind of tests we saw in Blade Runner?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Interesting)
So the bot gets a copy of the page, with the embedded talk back information, and begins a binary tree search for the combination to the lock, resubmitting the exact same form each time, thus preventing the combination from changing during the search.
It makes no difference how many pictures you use, what they are of, or what the question
Re:Creative CAPTCHA (Score:4, Insightful)
From another post above: http://www.getafreelancer.com/projects/Data-Proce
NoSpam! (Score:2, Interesting)
spam only hurts the ignorant... (Score:2, Interesting)
Umm. You sure about Yahoo? (Score:4, Interesting)
If you've ever logged into Yahoo chat, you'll see names like warbot001 through warbot400. They're profiles which map to an email address and lame chatters use them to send DOS messages to other chatters. Kinda like the old days on IRC with ping flooding.
Anyway. I highly doubt they manually entered in 400 CAPTCHAS, and I've seen those accounts for a while now so I suspect that CAPTCHA has been defeated for quite some time.
Good! (Score:2, Insightful)
So bye-bye CAPTCHA, I won't miss you.
It's like a flood wave (Score:3, Informative)
Spam behaves like a flood caused by heavy thunderstorms and rain. It will start to flood your basement no matter what. You can start to build a little dam here, put some sandbags there, board up your windows, etc. The sad fact ist, it won't help much. You will only save your home if you stop the rain.
That being said, as long as spam does not really hurt large corporations or governments, in terms of more and more expensive resources (machines, energy, air conditioning, administrators etc.) being used to just process the amount of spam coming in, nothing is going to change. Still, these entities are only going to protect themselves, not the public.
Me, I'm going to filter all hotmail and yahoo generated mail to /dev/null. Sorry folks, but just get another mail provider if you want to talk to me.
Mind you, if you filter mail by any means (like spam or virus filtering), never send auto replies. You will only hit innocent bystanders and generate lots of bounces, and run the risk of getting blacklisted by Spamcop or somebody else (if you autoreply to a spamtrap address, for example). I've been using Linux exclusively for more than 14 years on my mail server @ home, and I cannot count the number of autoreplies saying my machine sent this or that W32...blablabla thing, with no Windows client attached or anything. The better part of spam and virus mails uses fake From: addresses.
You can buy software that can thwart captchas (Score:4, Informative)
Quoted from this article [nytimes.com]. No wonder someone used it for a worm.
Also discussed here on
Evolution of the 'Captcha'
Posted by CmdrTaco on Monday June 11, @08:36AM
from the why-can't-i-even-read-them-half-the-time dept.
FireballX301 writes
the solution was simple (Score:4, Interesting)
Re:Economically driven Turing test (Score:2, Informative)
Since brain damage can cause very peculiar and specific cognitive problems, probably every kind of CAPTCHA will give trouble to someone. So I suppose there will be a variety
Re: (Score:2, Informative)
Regardless, CAPTCHAs will obviously have to evolve* to cover current 'hard problems' in AI as state of the art improves and 'hard' turns into 'not so hard'.
* or wait, should that be 'be intelligently designed'?
Too bad MS ignores RFC 2821 (Score:5, Informative)
What a cesspool. Hotmail has always been the ghetto of the internet, but now it's clear that it's infested with criminals, as well as just the technologically illiterate.
Time to blackhole it.
Re: (Score:3, Informative)
report_spam@hotmail.com
abuse@hotmail.com
However, there is a script behind it that usually replies back that the abuse is not from their systems. Even when it is.
When you get past that filter, you get a reply that thanks you for the report, but never any further followup.
(this used to be different in the past: then you sometimes got a reply about 3 weeks later from someone working at an outsourcing company in India complaining that they had
Re: (Score:3, Interesting)
Auto-replies that confirm that a message has been received are OK ("Hi, thanks for writing to postmaster@foo.com; your message was received and will be dealt with by a staff member"), but only if there's eventually som
Re: (Score:2)
Re: (Score:2)
Poor bastard when it does, though.
Re: (Score:2)
For some time I have been thinking about having "field-of-endeavour-specific" human-detection; that is, using some piece of information which will be generally known within a specific field of endeavour but perhaps not to some third world click-monkey. So, for instance, if you are running a Star Trek fansite, you could have something along the lines of "click on William Shatner to continue" a