Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×
Security Spam

Have Spammers Overcome the CAPTCHA? 330

thefickler writes "It appears that spammers have found a way to automatically create Hotmail and Yahoo email accounts. They have already generated more than 15,000 bogus Hotmail accounts, according to security company BitDefender. The company says that a new threat, dubbed Trojan.Spammer.HotLan.A, is using automatically generated Yahoo and Hotmail accounts to send out spam email, which suggests that spammers have found a way to overcome Microsoft's and Yahoo's CAPTCHA systems."
This discussion has been archived. No new comments can be posted.

Have Spammers Overcome the CAPTCHA?

Comments Filter:
  • Quick! (Score:5, Funny)

    by QuantumG ( 50515 ) <qg@biodome.org> on Monday July 09, 2007 @01:34AM (#19796713) Homepage Journal
    Get the rest of the difficult AI problems into CAPTCHAs. We've finally figured out a way to finance AI research!

    • FREE PR0N! (Score:5, Insightful)

      by pq ( 42856 ) <rfc2324&yahoo,com> on Monday July 09, 2007 @01:47AM (#19796801) Homepage
      Get the rest of the difficult AI problems into CAPTCHAs. We've finally figured out a way to finance AI research!
      Not really.

      The way they've worked around it probably goes like this: "Free pr0n sets! See more of this hot chick! We don't want automated downloads of these sets, so you need to solve this code to get the download. What? It looks just like the hotmail cpachas? Yeah, we're using the same advanced technology here."

      So I guess this approach would also solve other AI problems - by having bored RIs solve them. Maybe not such a bad solution after all?

      • Re:FREE PR0N! (Score:5, Interesting)

        by pchan- ( 118053 ) on Monday July 09, 2007 @02:40AM (#19797131) Journal
        It's the Mechanical Turk [wikipedia.org] approach. Amazon is doing it [mturk.com].
        • Re:FREE PR0N! (Score:5, Insightful)

          by AuMatar ( 183847 ) on Monday July 09, 2007 @03:04AM (#19797285)
          I'd be surprised if some spammers weren't using amazon's mechanical turk. Its cheap as hell, why not use an existing framework.
          • Re:FREE PR0N! (Score:4, Interesting)

            by MooUK ( 905450 ) on Monday July 09, 2007 @06:43AM (#19798423)
            I've seen plenty of bad-SEO tactics on mturk before, as well. "Comment on this blog entry using these two keywords somewhere in your comment."
        • So what if it's not 'real' AI, that doesn't mean you shouldn't take advantage of it. Just put some millennium problem as a captcha. Or your homework. Third order differential equations. Let them write pieces of code. Any web-user that will want to see free porn will find a solution to your captcha. ... Profit!
      • Re: (Score:3, Insightful)

        by 1u3hr ( 530656 )
        The way they've worked around it probably goes like this: "Free pr0n sets! See more of this hot chick! We don't want automated downloads of these sets, so you need to solve this code to get the download.

        People keep suggesting this. It might work, but no one has ever, to my knowledge, put it into practice. And by its nature, this would be pretty public. So if you don't have a URL, this is just an urban legend.

        Actually, I think if put into practice, it would itself be attacked by anti-spammers. They'd t

      • by syousef ( 465911 )
        The way they've worked around it probably goes like this: "Free pr0n sets! See more of this hot chick! We don't want automated downloads of these sets, so you need to solve this code to get the download. What? It looks just like the hotmail cpachas? Yeah, we're using the same advanced technology here."

        Wooohoooo! Free pr0n! Link please.
      • Re: (Score:3, Funny)

        by Anonymous Coward

        Then, clearly, the only way to secure hotmail's captchas is to make them so odious that a statistically significant number of bored RIs won't want to solve them. Make all captchas images of latex-clad midgets having group sex while watching Fox News superimposed over stills from German World War II propaganda films.

    • Re:Quick! (Score:4, Funny)

      by WWWWolf ( 2428 ) <wwwwolf@iki.fi> on Monday July 09, 2007 @03:53AM (#19797595) Homepage

      Get the rest of the difficult AI problems into CAPTCHAs. We've finally figured out a way to finance AI research!

      And while the problem remains unsolved, you can use it for distributed problem-solving! Instant sponsoring opportunities from the big industry!

      "So you want to sign up for an account? Okay, we need your name, email, and password twice... and could you figure out the optimal shipping route that goes through all of these cities, and only visits each of them once?"

      (Turns out to be a route for some annoying door-to-door salesman. Boy, wonder what he feels like when he finds out someone sent a completely misleading solution! At least sanity-check them first =)

    • Have they? (Score:5, Insightful)

      by ady1 ( 873490 ) on Monday July 09, 2007 @04:11AM (#19797671)
      Or is it just that making new hotmail accounts is being outsourced to china/india/?
      • by I)_MaLaClYpSe_(I ( 447961 ) on Monday July 09, 2007 @07:03AM (#19798593)
        Could be, according to this /. article [slashdot.org]


        Spammers Learn To Outsource Their Captcha Needs

        Posted by Zonk on Saturday November 25, @05:36AM
        from the hearing-some-ominous-muttering dept.

        lukeknipe writes

        "Guardian Unlimited reporter Charles Arthur speaks with a spammer, discussing the possibility that his colleagues may be paying people in developing countries to fill in captchas. In his report, Arthur discusses Nicholas Negroponte's gift of hand-powered laptops to developing nations and the wide array of troubles that could arise as the world's exploitable poor go online."

        From the article:

        "I've no doubt it will radically alter the life of many in the developing world for the better. I also expect that once a few have got into the hands of people aching to make a dollar, with time on their hands and an internet connection provided one way or another, we'll see a significant rise in captcha-solved spam. But, as my spammer contact pointed out, it's nothing personal. You have to understand: it's just business."
    • Re: (Score:3, Interesting)

      by Hoi Polloi ( 522990 )
      There is a better use of all of this untapped genius:

      "Enter your solution to the Riemann hypothesis"
      "Please submit a new prime number"
      "What is a solution to the Arab-Israeli conflict?"
      "Show a correct equation that joins the electro-weak and strong forces with gravity."
  • by JonathanR ( 852748 ) on Monday July 09, 2007 @01:38AM (#19796731)
    Wouldn't it be feasible to record and catalog the fonts and manipulations done by a particular site's CAPTCHA engine, and then script some type of automatic "OCR" to suit? Are these CAPTCHA's dynamically generated from an extended "character set" or are the distortions generated in real-time?
    • by Bearhouse ( 1034238 ) on Monday July 09, 2007 @02:41AM (#19797135)
      Agreed. It's the 'myspace' of the 'free' email providers. The irony is that it had to be easy to use, and therefore abuse, so that kids can could use it. But now they all use MSN Messenger... Time for an update?

      The time has surely passed when M$, Yahoo et al needed huge numbers of email subscribers to prove how important they were.

      How about a self-policing system? Rather than the typical 'black hole' that 'abuse@...' normally leads to, one could have an automated voting system. If 'n' people complain about 'x' address, then wham, it's blocked. Could check for individual IPs, or make people mail respond to a challenge, to check that it was real people complaining, and not a botnet...

      Would enough people participate, though? I know I don't try and get all the spam I receive blocked, just the ones that get through the filter, and even then, just when I have time or the mood takes me...
      • by Mr2cents ( 323101 ) on Monday July 09, 2007 @03:28AM (#19797419)

        or make people mail respond to a challenge
        You mean... like... a CAPTCHA over e-mail? That seems like a fool-proof plan to me!
        • No, that's not what I meant, and of course, as the article illustrates, nothing is foolproof.
          Renewing my /. or ebay password seems to work, however...

          Just musing about how concerned people could actively contribute to spam reduction by getting a 'real' response to their mails to ISPs. Central anti-spam sites are repeatedly attacked, and sometimes closed. Perhaps if it were managed on a 'per ISP / email provider' basis this would be harder for the botnetters to attack.

          What's the alternative, do nothing?
      • by zCyl ( 14362 )

        If 'n' people complain about 'x' address, then wham, it's blocked.

        Making a system this easy to do a denial of service attack is essentially making a broken system.
    • by lena_10326 ( 1100441 ) on Monday July 09, 2007 @06:05AM (#19798227) Homepage

      Wouldn't it be feasible to record and catalog the fonts and manipulations done by a particular site's CAPTCHA engine, and then script some type of automatic "OCR" to suit? Are these CAPTCHA's dynamically generated from an extended "character set" or are the distortions generated in real-time?
      That's how CAPTCHAs are broken, although you don't have to use a general OCR program. If you're going to attack a single type of CAPTCHA, you could tailor your code to take advantage of known properties of that specific CAPTCHA such as: backgrounds, background colors, repeated markings, fonts, font colors, font size, font orientation, and direction of any image warping.

      Most CAPTCHAs use images and random marks or dots in the background but those can be filtered out in a pre-processing step if you know they're drawn using a limited set of colors or don't use the same line thickness as the font. Photographic backgrounds will be limited so they could be filtered easily by detecting which background the CAPTCHA used for that session. Using an oversized background and shifting it by an offset would present difficulty, but Yahoo and Hotmail don't use background images. If backgrounds are rendered gradients, I think it's relatively easy to detect the font color by scanning for broken runs of a continuous single color. The gradient colors would deviate slightly, within a small percent change. If there is any repetitive pattern, which there is if it's a gradient, it only helps the filter breaking the CAPTCHA.

      A lot of the easier to crack CAPTCHAs use only a single font and render all the letters in 90 degree angles. The smarter ones jumble and warp the letters by shifting the each letter by an offset and rotating by a small angle. If you could figure out the direction of the warp or rotation, by checking the background you could unwarp or untwist the letters before running OCR on it. Or, you could test each isolated character by rotating every few degrees of rotation and selecting the result that outputs the most number of OCR'd characters from the least amount of rotation.

      Regardless, the algorithm doesn't have to be perfect. It could be right 5% of the time and still generate thousands of email accounts. It doesn't care about rejections, because it's got all day to keep trying.

      FYI:
      http://en.wikipedia.org/wiki/Captcha [wikipedia.org]
      http://www.cs.sfu.ca/~mori/research/gimpy/ [cs.sfu.ca]

      By the way, some CAPTCHAS have been broken by not deleting sessions in the server, but I doubt Yahoo and Hotmail would be open to that bug.
    • by choongiri ( 840652 ) on Monday July 09, 2007 @02:50PM (#19804887) Homepage Journal
      It wouldn't surprise me if this is a direct result of the work on open-source optical character recognition [apache.org] being done specifically to prevent the increased prevalence of captcha-style image spam. It would be rather ironic if the open source model meant the spammers are now turning our own anti-spam tools around and using them against us.
  • it's easy... (Score:4, Insightful)

    by naeim ( 1066626 ) on Monday July 09, 2007 @01:39AM (#19796739)
    Make a porn site that give you credit to download smut in exchange for solving captchas. Have your automatic account creator redirect the captcha to a human user of your porn site, and if you're lucky and it gets solved within the time period for which te captcha is valid, you're set.
  • by patio11 ( 857072 ) on Monday July 09, 2007 @01:46AM (#19796791)
    That doesn't sound like a CAPCHA has been broken, except perhaps by the sophisticated AI device known as a human being. 8 and a half CAPCHAs a minute? No problem for one person with a tolerance for boredom and CTS. Heck, you can even put the job up on Amazon Turk and charge a penny an account for the signups, or use cheap labor in any of a number of countries to do it.
    • Re: (Score:3, Interesting)

      ..and if this person or persons happen to be, say a 12 year old semi-literate war refugee in Sub-Saharan Africa, He'd probably be willing to do a whole day of it for a bowl of soup and a big shiney nickel, or even just for a semi-serious promise not to beat him again that evening...

      Things get real economical real fast if you think globally and happen to be evil.

      In a point of irony I would like to mention that the capcha for this slashdot comment was "disturbs"
    • by Tony Hoyle ( 11698 ) <tmh@nodomain.org> on Monday July 09, 2007 @05:06AM (#19797951) Homepage
      You don't need AI to beat a capcha. They follow a fixed pattern on a single website, so to break the hotmail one you just need to look at a few hotmail sites and figure out how to reverse the graphical munging that has been done. Once that's done you chuck that in a script and churn them out as fast as you like.

      Defeating *any* capcha is an AI problem. Defeating the capcha for a website (or group of websites that use the same software) is just a programming task.
    • I think it is much more likely that Hotmail's IT systems have been compromised following a security breach by the spammers. I have indirect evidence that this has happened.

      I and some other people I know give out unique disposable email addresses to our contacts. There is a different unique address for each of our friends and family.

      Yesterday I and they received spam emails sent to several of the disposable email addresses. This points us to several of our friends and family as having had their email addres

  • by Mr. Roadkill ( 731328 ) on Monday July 09, 2007 @01:50AM (#19796831)
    Indians are fast, accurate and cheap:

    http://www.getafreelancer.com/projects/Data-Proces sing-Data-Entry/Data-Entry-Solve-CAPTCHA.html [getafreelancer.com]

    Of course, there are those who seek to use the IT talent of the sub-continent for a more direct attack:

    http://www.getafreelancer.com/projects/PHP-ASP/yah oo-ocr-bypass-captcha.157160.html [getafreelancer.com]

    And as an upstream poster pointed out, there's always the old "Free Porn - solve this CAPTCHA for access" approach.
  • by dattaway ( 3088 ) on Monday July 09, 2007 @01:54AM (#19796857) Homepage Journal
  • OCR or humans (Score:4, Insightful)

    by drgonzo59 ( 747139 ) on Monday July 09, 2007 @01:55AM (#19796861)
    If OCR was used, then it is as simple as having a mathematical quiz captcha. For example, the answer to "34 + 2" or "first 3 digits of e" (well, ok maybe not this one, unless it's a math forum...). This will not stop the spammers as they would probably just try to parse the math expressions and post the result but it will slow them down a bit.

    If a human is used to read the captcha then there is not much that can be done as that is what a captcha is for: to make sure a human only will be able to bypass it....

    • Re:OCR or humans (Score:4, Insightful)

      by coldcell ( 714061 ) on Monday July 09, 2007 @02:20AM (#19797005) Homepage Journal
      I was actually looking into securing a forum from spammers earlier when this question came into my head:

      How do I make questions that are simple enough to be obvious to legitimate members, but obscure for outsourced human spammers?

      I then wondered exactly WHY I'd want to use simple questions anyway, surely I'd want people posting intelligently, so why not moderate at the first access point! Elitism, sure, but I don't think that asking for some mathematically obscure reference for a forum catering to that userbase is Evil, nor any other purpose-specific odd questions. The truly determined can always google the answers.

      • by dysfunct ( 940221 ) * on Monday July 09, 2007 @03:24AM (#19797397)
        You mean a captcha like this one [thehumorarchives.com]?
      • Re: (Score:3, Informative)

        by kuzb ( 724081 )
        Your best bet for forum spam would probably be a bayes filter - much the way you'd deal with email. if it's small scale and non-commercial, you could use akismet [akismet.com]. This is generally not a viable solution if you're running a high traffic commercial forum (we looked in to it, it was going to cost us between $15 - $20k per month). In the end, it was more viable to develop our own solutions in house. This won't stop them from making bogus accounts, but it can help to cut down on the amount of garbage that li
      • Re: (Score:3, Interesting)

        I then wondered exactly WHY I'd want to use simple questions anyway, surely I'd want people posting intelligently, so why not moderate at the first access point!
        Good point. Actually I wondered what Slashdot would look like if, before posting comments, you had to answer a question that ensured you had actually read TFA. It would certainly make for far more intelligent discussions (yes, I know, I must be new here).
    • I think you're right about it not stopping spammers; I don't think it's even going to be much of a speed bump. It doesn't take a brilliant programmer to feed the output of an OCR program into a command-line calculator to evaluate simple mathematical expressions.

      You might be able to trip some calculators up by using complex math or logic problems that aren't easily parseable by machines*, but this would also trip up a lot of humans. (Whether that's a bug or a feature I'll leave up to you.)

      CAPTCHAs were, and
    • > "34 + 2" or "first 3 digits of e"
      > (well, ok maybe not this one, unless it's a math forum...)

      With the state of US education, I think that the first one might be a bit too difficult ;-)
    • One type of captcha that could work is asirra [microsoft.com] where they use images from petfinder.com [petfinder.com], display 12 of them and ask them to click on all of the cats. A computer finds this extra-ordinarilly difficult as the fur is very simmilar and the cats and dogs are all in different poses and all the lighting conditions are different, but a human can distinguish them very clearly.

      OK, so I know it's microsoft and why aren't they using it on hotmail already, but I think it's the right direction for Captchas.

  • Instead of trying to reduce the signal level in spam, bury the bastards in noise. Set up a nonprofit organization which people join (after giving real-life details and a deposit and being confirmed) which flags an email as spam. When that happens, participating clients (available to everyone) begin contacting the website given in the mail. Result: spammer website and ISP buried in noise and bandwidth bills.

    Either that, or someone needs to write the next massive-spread virus and have it break your compute
    • Sounds like BlueFrog (Score:5, Informative)

      by Kadin2048 ( 468275 ) * <slashdot@kadin.xoxy@net> on Monday July 09, 2007 @02:11AM (#19796957) Homepage Journal
      I think this was basically the idea behind BlueFrog; they had a pretty nice, aggressive system for going after the sites that profit from spam, by bouncing spam emails back at them and generally causing them a lot of grief.

      It was obviously working, as demonstrated by the concentrated fire they started to take from spammers. Unfortunately, they didn't have the resources (at least, I'd prefer to think it was a resource issue and not one of will) to fight the spammers, and after getting some really terrible legal advice, they got crushed.

      Short of brutal vigilante justice [slashdot.org] (which I'm not opposed to here and there, but it tends to not scale very well), Blue Frog's approach seemed to be the only "supply-side" approach to spam that ever seemed to show a bit of effectiveness.
      • Wasn't there some guy that got revenge by finding a spammer's home address and subscribing him to every snail mailing list he could think of?

  • Are the spamming b.st.rds reusing the images for blog comments, or something like that? Do that for a hundred blog readers and they could get fast feedback.

    • by vidarh ( 309115 )
      There's been at least one case where someone set up a site offering free porn to anyone, all you'd need to do was fill in a CAPTCHA... It was used to create bogus accounts at one of the big webmail providers.
  • Bogus hotmail accounts!?!?! I don't believe it!!!
  • Wow... (Score:5, Funny)

    by superbus1929 ( 1069292 ) on Monday July 09, 2007 @02:12AM (#19796967) Homepage
    Judging by the amount of spammers I get on my Invision Power Board forums, which have been through two different styles of CAPTCHA, I'd file this one under the "No Shit" department.
    • I'm using a phpBB as my Bultin-Board System and I thought that such a well known BB would have state-of-the-art anti-Spam features. I was wrong, there is a Captcha but is by far too weak to stop any spam at all. I then installed the reCaptcha plugin and since haven't received any spam at all.
  • * Problem with Spam traffic from India and China? Fine. Make a declaration internet traffic from those countries will be served from the Internet within 21 days unless all Spam activity ceases. Impractical? Maybe, but I'll bet the Chinese Government can come down like a sledgehammer when it wants to! Same with this kind of threat to India. When the Indian Government smells its vast outsourcing revenues becoming unstuck, they'll have motivation to crack down on 'unscrupulous operators'

    * 25 year jail and a $2
    • by pe1chl ( 90186 ) on Monday July 09, 2007 @02:29AM (#19797065)
      * Problem with Spam traffic from India and China? Fine. Make a declaration internet traffic from those countries will be served from the Internet within 21 days unless all Spam activity ceases.

      There are problems with this approach.
      1. the allocation of IP addresses has been (and is continuing to be) done in a manner that makes it difficult to quickly block a whole country. AP-NIC allocates blocks of addresses in the entire Asian-Pacific region nearly sequentially and at very funny boundaries.

      2. the spam source country varies a lot. you may have a problem with spam from China, but I have a lot more spam from the USA so I need to block that. While I already blocked many DSL/Cable provider netblocks to reduce the crap from infected Windows PCs a bit, there is an increasing risk of collateral damage.
      • Technically, yeah, as the subject line said, impractical. It's meant as a political feint against those countries government. The problem with the net is people can harass you across country borders and there is nothing you can do about it. Ultimately only those countries governments can do that. A cutoff threat mightn't inconvenience the spammers, but it'd sure as hell inconvenience them, and that might push them to do something. A bigger problem is the US Government would never have the will to do anythin
        • by pe1chl ( 90186 )
          They may think that spam is a non-issue, but IMHO terrorism is a non-issue and they are still hunting that (only making it worse).

          The problem is that the politicians do not understand what issues are. Everyone is affected by spam, so that is an issue. Everyone is affected by changes in climate and environment, so that is an issue. They should focus on that, instead of trying to extinguish a fire by blowing into it.
          • by ajs318 ( 655362 )
            How about if we could somehow convince Bush that spam is funding terrorism? All the money people are making from selling counterfeit viagra, pirated "OEM" software and doing dodgy share trading deals could be buying weapons of mass destruction for the next country we don't like very much .....
      • Actually, you can download the assignment databases from AP-NIC and block quite easily (ditto for the other NIC's.) The list is on ftp.apnic.net. If you have a site / userbase that is US centric, there is no issue with blacklisting entire countries. This is not a viable anti-spam tool for most sites however.
    • by Alioth ( 221270 ) <no@spam> on Monday July 09, 2007 @03:51AM (#19797571) Journal
      That's great, but the United States will have to be cut off from the Internet first. The USA is the world's biggest spam source, according to Spamhaus.

      http://www.spamhaus.org/statistics/countries.lasso [spamhaus.org]

      The United States emits *four* times as much spam as its nearest competitor, China.
      Verizon is the world's spammiest ISP.
    • by 1u3hr ( 530656 ) on Monday July 09, 2007 @03:51AM (#19797573)
      * Problem with Spam traffic from India and China? Fine. Make a declaration internet traffic from those countries will be served from the Internet within 21 days unless all Spam activity ceases.

      Ever heard of proxies?

      Also, have a look at the ROKSO list [spamhaus.org]. Most spam originates in the USA. They may route it through Russia or China or Korea, but its source is the USA. Block China, say, and next week it'll be coming via Brazil, or .... faster than you can reconfigure.

      If the USA wants to take decisive action, something the government has actively avoided doing, it could shut down spammers in a week. How many spammers have been prosecuted and gone to jail? It's big news when they do, but only a handful have been prosecuted. The feds just don't care enough to build cases, even when the evidence is handed to them. Only if AOL or Microsoft push does anything happen.

      Spammers have to make money. Credit card companies do that for them, and they are all based in the USA. As for the pump-and-dump spammers, that's a bit harder, but the stock exchanges should be able to block suspicious activity based on that. Thay don't care now because it's just foolish home investors losing money when they try to "take advantage" of the tips.

  • by grasshoppa ( 657393 ) on Monday July 09, 2007 @02:18AM (#19796999) Homepage
    Block MSN and yahoo.

    You can thank me later.
    • by cp.tar ( 871488 )

      I do wonder... if mail from thousands of Hotmail and Yahoo! accounts gets to be tagged regularly as spam, maybe Gmail starts blocking them, thus making people jump ship from the first two... Therefore, I'd guess it's just GoogleSpammer Beta. An excellent plan, except...

  • But how much of the spam these bogus accounts are sending out is going to other bogus accounts? Eventually hotmail will eat itself... We can only hope.
    • by pe1chl ( 90186 )
      I always wonder (and I asked their support personnel several times) why they don't insert the same spamfilters in their OUTgoing mail flow as they do in their INcoming.
      That would almost solve their bad reputation as spam senders immediately.

      But probably they are not at all interested in their reputation, only in their number of users. Even a spammer is a user, that will count once they want to sell-off their service.
  • I was wondering why it seemed like the amount of spam I was getting DOUBLED this weekend. Usually I get about 50 or 60 spams per day, now I seems like I'm getting 120 or 130 per day. Really freaking annoying. I'm ready to spam myself, but I want to spam an uber destructive virus that'll force the world to do something about spammers. Only after email has been rendered useless will the world do anything about spam.
  • by DavidD_CA ( 750156 ) on Monday July 09, 2007 @02:36AM (#19797107) Homepage
    It wouldn't surprise me if the Capchas were overcomes simply by showing the graphics to some underpaid person who just types in the actual responses.

    A sophisticaed enough system could easily "pipe" these graphics to someone who just sits and types all day. At one capcha every 10 seconds, that's about 8000 in a day working 24/7.

    Not everything these spammers do has to be automated.
  • unsurprising (Score:5, Interesting)

    by kuzb ( 724081 ) on Monday July 09, 2007 @03:06AM (#19797293)
    One of the things I get tasked with at work is handling forum and service spam. Of all the methods I've used to deter spammers, captchas rank among the least effective. A lot of people seem to think the answer is in changing the nature of what the user has to interpret. I've had suggestions ranging from audio captchas to math problems, and dozens of others that lead to the same kinds of problems - you're making it hard, or in some cases, impossible for legitimate users to use your service. Language barriers rank among the biggest problem. Say you have a picture of an apple, and the user is supposed to type 'apple'. It falls short when you realize the person viewing it may not speak english at all, or may have no idea how to spell 'apple' in english. Same with audio captchas.

    The most effective (surprisingly) were form fields hidden with CSS so the users don't enter data in to them, but bots will. You can reject the entire post at that point. It's not universally effective (some bots will actually look at your CSS to determine if you're doing this) but it sure cuts down on a lot of bogus posts. Another method is to generate a form key of some kind, and use that to verify that the form is only good once. this slows spammers down because in order to post again and again, they have to reload the page in order to get a new key. many don't do this, and will attempt to use the same key over and over. if you use a few of these methods, and track repeat offenders, you can add them to your firewall rules so they can't even load the page. Of course, most serious spammers will use hundreds of IPs, so it's difficult to get them all.

    It's important to realize that this is a fight you simply can't win - if they're serious about getting through, they'll get through. The most you can hope to achieve is to slow them down long enough to come up with an improved solution.
    • The most effective (surprisingly) were form fields hidden with CSS so the users don't enter data in to them, but bots will. You can reject the entire post at that point. It's not universally effective (some bots will actually look at your CSS to determine if you're doing this) but it sure cuts down on a lot of bogus posts. Another method is to generate a form key of some kind, and use that to verify that the form is only good once. this slows spammers down because in order to post again and again, they have to reload the page in order to get a new key. many don't do this, and will attempt to use the same key over and over. if you use a few of these methods, and track repeat offenders, you can add them to your firewall rules so they can't even load the page. Of course, most serious spammers will use hundreds of IPs, so it's difficult to get them all.

      All of these seem like they'd only work against random spammers -- bots trolling for forums and what have you. But if a spammer was targeting you, like they targeted Hotmail, these methods would be useless.

      • by kuzb ( 724081 )
        "All of these seem like they'd only work against random spammers [..]"

        That is correct. It's only meant to slow them down, not to eliminate or make it impossible. It's an amazingly difficult problem. At most you really can only hope to make the path rocky enough to buy yourself time, and possibly collect a few IPs.
    • Re: (Score:3, Informative)

      by Gunstick ( 312804 )

      I use a very effective method. Only javascript has to be activated.
      The submit button is only enabled after 20 seconds.
      Someone needing less time than 20s to write a post is a spammer or has nothing intelligent to say.

      An bot will of course submit the form in less than 20s, there comes the timestamping into play. If the form display and form submit events are less than 20s apart it's considered spam too.

      Catches 99% of the posts.
      0% false positives.

      Of course if a big site like yahoo implements this, it's easy fo
  • Spammers are like that Simpsons episode where all the ad billboards come alive - if you ignore them, they'll go away. But everyone has to ignore them.

    We're pouring so many resources into fighting them... it just strikes me that if we just tried to ignore the bastards, they'd find something better (or more profitable) to do than spam.
    • Pouring resources into fighting them is not the problem. The problem is pouring resources into -them-, as in buying their products, purchasing stuff from malware popup sites, generally giving them money.

      I'm the first to start a campaign "Punch a spammer's customer today". If you hear someone bought something from a spammer, punch them and explain "That's for funding another 1000 messages to flood my mailbox."
    • We're pouring so many resources into fighting them... it just strikes me that if we just tried to ignore the bastards, they'd find something better (or more profitable) to do than spam.

      My inbox has been spammed to death. I open it every 6-8 weeks to delete the stuff. Eventualy when nobody has an e-mail account except spammers, the spammers will go away (to try to find you). Expect more IM spam since e-mail is dying under the load.

      I love getting hot stock tips a couple months late. I look them up to see
    • by vidarh ( 309115 )
      The problem is that the people who need to ignore them are the people who buy from them because they fall for the messages, not people who think "it's a spam, delete". If the rest of us ignore spam, that just makes it more profitable, as they won't have to deal with us.
  • Yahoo! and Hotmail are both USA companies, which is also where most spam originates [spamhaus.org], so the solution is simple.

    Route-around the United States, and the problem is solved for most of us. They can rejoin the world when lawmakers take spam seriously.
  • Creative CAPTCHA (Score:5, Interesting)

    by QuoteMstr ( 55051 ) <dan.colascione@gmail.com> on Monday July 09, 2007 @03:42AM (#19797513)
    As luck would have it, I stumbled across a twist on the captcha concept while registering for a site. Instead of asking the human user to correctly enter the word displayed in an image, it presented the user with a grid of images. About half of them were of cars. The other half were cats.

    The site just asked the user to check off each image representing a living thing.

    Simple, and brutally effective against current AI. I can think of various tricks one can use to make the comparison more difficult as well.

    How long until we're using the kind of tests we saw in Blade Runner?
    • Simple, and brutally effective against current AI.
      You'd need a very, VERY large pool of images, otherwise it's brutally simply to bruteforce.
      • by ajs318 ( 655362 )
        No, you randomise the image filenames every time, as well as the positions. If there is no correlation between the image filename and the content, then there's one less thing for the spammers to pick up on.
        • You're joking, right? The filename means nothing. Comparing two images is relatively easy, even if you were to add random noise to the image or mess with the colors.
        • Re: (Score:3, Interesting)

          Of course, while this sounds good on the surface, what you are really presenting to the bot's point of view is nothing more than a binary grid problem: living or not living.

          So the bot gets a copy of the page, with the embedded talk back information, and begins a binary tree search for the combination to the lock, resubmitting the exact same form each time, thus preventing the combination from changing during the search.

          It makes no difference how many pictures you use, what they are of, or what the question
    • by Fred Ferrigno ( 122319 ) on Monday July 09, 2007 @04:50AM (#19797863)
      This, and all other forms of CAPTCHAs, are ultimately vulnerable to some poor bastard in India or Africa or wherever sitting in front of a computer and filling out the form manually for a few cents.

      From another post above: http://www.getafreelancer.com/projects/Data-Proces sing-Data-Entry/Data-Entry-Solve-CAPTCHA.html [getafreelancer.com]
  • NoSpam! (Score:2, Interesting)

    On my forum somedays we'd get 5/6 bots per day. It's a vB board and it used the standard vB captcha. One day I installed a plugin called NoSpam! which asks the user a simple question when registering. Questions such as 2+2=, what do you do when a traffic light goes red, etc. The questions are simple, if somebody can't answer them I'd be suprised that the made it as far as the registration page. Since I've installed it there hasn't been even one bot through so it is 100% efective so far. I know it won't las
  • I never have spam issues. My real email address is rarely used..only for friends and legitimate sites(Secure businesses w/ encryption, like my credit card). My real email address is from a privately registered domain, which costs me only $20/yr. When I sign up for anything else (including this site), I use one of my free accounts. I don't check them frequently and I only whitelist domains I expect to see. The problem with "free" email addresses is that they end up costing us all. If all users paid for
  • by lena_10326 ( 1100441 ) on Monday July 09, 2007 @05:20AM (#19798003) Homepage
    Yahoo's CAPTCHA just recently being broken that is.

    If you've ever logged into Yahoo chat, you'll see names like warbot001 through warbot400. They're profiles which map to an email address and lame chatters use them to send DOS messages to other chatters. Kinda like the old days on IRC with ping flooding.

    Anyway. I highly doubt they manually entered in 400 CAPTCHAS, and I've seen those accounts for a while now so I suspect that CAPTCHA has been defeated for quite some time.

  • Good! (Score:2, Insightful)

    by godfra ( 839112 )
    Hopefully this spells the begininng of the end for the web plague known as CAPTCHA. I am heartily sick of having to squint at barely recognisable characters, only to be informed that I've got it wrong, and then have to enter all my details again.

    So bye-bye CAPTCHA, I won't miss you.
  • by haraldm ( 643017 ) on Monday July 09, 2007 @05:42AM (#19798097)

    Spam behaves like a flood caused by heavy thunderstorms and rain. It will start to flood your basement no matter what. You can start to build a little dam here, put some sandbags there, board up your windows, etc. The sad fact ist, it won't help much. You will only save your home if you stop the rain.

    That being said, as long as spam does not really hurt large corporations or governments, in terms of more and more expensive resources (machines, energy, air conditioning, administrators etc.) being used to just process the amount of spam coming in, nothing is going to change. Still, these entities are only going to protect themselves, not the public.

    Me, I'm going to filter all hotmail and yahoo generated mail to /dev/null. Sorry folks, but just get another mail provider if you want to talk to me.

    Mind you, if you filter mail by any means (like spam or virus filtering), never send auto replies. You will only hit innocent bystanders and generate lots of bounces, and run the risk of getting blacklisted by Spamcop or somebody else (if you autoreply to a spamtrap address, for example). I've been using Linux exclusively for more than 14 years on my mail server @ home, and I cannot count the number of autoreplies saying my machine sent this or that W32...blablabla thing, with no Windows client attached or anything. The better part of spam and virus mails uses fake From: addresses.

  • by I)_MaLaClYpSe_(I ( 447961 ) on Monday July 09, 2007 @07:16AM (#19798683)
    Aleksey Kolupaev [...] develops and sells software that can thwart captchas by analyzing the images and separating the letters and numbers from the background noise. They charge $100 to $5,000 a project, depending on the complexity of the puzzle.


    Quoted from this article [nytimes.com]. No wonder someone used it for a worm.


    Also discussed here on /. [slashdot.org]:


    Evolution of the 'Captcha'
    Posted by CmdrTaco on Monday June 11, @08:36AM
    from the why-can't-i-even-read-them-half-the-time dept.

    FireballX301 writes

    "The New York Times is running an article about the small word puzzles various sites use in order to defeat automated script registration while still letting humans through. It seems many people can't actually solve them anymore, so new alternatives (image recognition) are being created. This, of course, seems breakable as well -- is there a feasible alternative to the captcha, or are we stuck jumping through more and more hoops to register at places?"
  • by Khyber ( 864651 ) <techkitsune@gmail.com> on Monday July 09, 2007 @10:07AM (#19800713) Homepage Journal
    just hire people to get past the captchas and let a form bot do the rest. It's not that hard to figure out. I stopped this using animated gifs cut from anime videos. Can't guess the anime that clip comes from, you don't get in. Haven't had spammers on my forum since I moved to that type of captcha system.

The unfacts, did we have them, are too imprecisely few to warrant our certitude.

Working...