Spammers Targeting Microsoft's Revised CAPTCHA 303
toomuchtoomuchspam writes "According to Websense, Microsoft's CAPTCHA has been busted again. CAPTCHA was surely a logical move for different service providers to fight against spammers, but it seems to be melting down. 'Realizing the potential for massive abuse from spammers with anti-CAPTCHA capabilities, who could use the clean IP reputation to carry out various attacks over Email and Web space, Microsoft attempted to increase the complexity of their CAPTCHA system. The CAPTCHA system was revised in an attempt to both prevent automatic registrations from computer programs or automated bots, and preserve CAPTCHA's usability and reliability. As this attack shows, those efforts have failed,' says Websense security researcher Prasad. Could there be any better CAPTCHA? A better solution?"
Key exchange. (Score:5, Funny)
Re:Key exchange. (Score:5, Funny)
(X) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
(X) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(X) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(X) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
(X) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
(X) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
(X) Outlook
and the following philosophical objections may also apply:
( ) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
(X) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(X) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!
Re:Key exchange. (Score:5, Insightful)
That form is amusing and enlightening for first-time proposals at solving spam. But as far as I can tell, it also rules out all solutions because it assumes there is a solution that doesn't have any cost or compromise.
The likely reality is that someone will have to pay or be inconvenienced to solve spam.
Re:Key exchange. (Score:5, Funny)
The form doesn't assume there is a solution without cost or compromise.
It just assumes it's really, really easy to make fun of other ones. ;^)
Re:Key exchange. (Score:5, Funny)
Personally I think the form would be fine if you just took off the vigilante box. Spam can be solved by a few guys with a list of names, free air travel for a month and a box of bullets.
Re:Key exchange. (Score:4, Funny)
SpammerAssassin.org? What do we need to get this project off the ground?
Re: (Score:2)
Re:Key exchange. (Score:4, Insightful)
"What do we need to get this project off the ground?"
first, you need to weed out the pansies who say 'killing people, for trying to make a living sending commercial e-mail, that's horrible'
secondly, you need a large budget and specialized training in invading hostile territory and killing possibly armed men in ambushes and guerrilla tactics. remember not all spam originates from the united states.
since you'll never get both of the above, you're left with technical and legal counter measures... which ultimately just doesn't work.
how many times have you gotten a call from a telemarketer? during dinner? there are (or were) laws against machine dialing apparatus here in the USA, but then some wiener designed a computer modem, and the downfall was quick, it was now quick and easy to use stock parts to auto dial and even give people pre-recorded messages over telephone.
spam ultimately is suffering the problem that much to the technology involved has substantial other uses besides spamming, so spammers get free reign. captchas did make a difference in the arms race. for a while. but now captchas are obsolete. they don't work they can't be fixed, and you're never going to get a really good test for determining a human from a bot..
simple distorted words aren't good enough, what you need to do, is switch to something humans are insanely good at that machines can't even be coded for. puns and homonyms. so basically what you wind up with is say a paragraph of text, with a single sentence response from the end user.
but even this will wind up getting cracked, unless you come up with a way of distorting the paragraphs slightly without changing the response from users, so they can't just match the paragraph to the answer... but this is a lot of work, to get a sophisticated captcha system based on a database of giving one paragraph of text and expecting a one line response that is obvious to a human but not to bot and reuse them but always with something different done to the paragraph. and even with such a hard test, the free porn sites give free access to a porn site for answering 5 captchas, teenagers have a lot of hormones and loads of free time...
i know microsoft and yahoo and google don't like the fact that spam originates from their networks, because spammers broke their captchas... but the problem isn't going away. there is no way to make it better. compuserve tried to curtail spam by having 'electronic postage' on sending e-mail, compuserve eventually went under. but electronic postage is realistically the only way spam will ever be controllable without killing all the spammers, because if it costs $0.15 cents per e-mail recipient they're going to suddenly get very good at figuring out who responds to spam. just like bulk mail comes to people based on information companies can find out about them.
and there are countless people who would be angry at paying to e-mail people. so it's not going to happen.
Re: (Score:3, Insightful)
There IS an EXTREMELY simple technical solution to this very problem.
First let's define the problem:
1) Spammers desire the ability to send their messages through Microsoft's systems since the IP addresses are so clean and therefore usually possess a higher level of trust with remote MTA's.
2) Microsoft, like others, has its head up its ass on how to solve it.
3) Microsoft has determined the best method to stop it is to determine if it is a person, or a machine at the other end.
The solution is simple:
1) Limit
Re: (Score:3, Insightful)
Actually you are wrong. What you are saying has a certain logic to it, that is true, but you just don't have the numbers right.
1) Botnets are irrelevant. It is just an issue of IP addresses, pure and simple. Whether or not the signup is a zombie or a real person, the number is limited. The REAL issue is if the policy would prevent the signups of legitimate people. That is doubtful since most people tend not to have more than 10 different email accounts at one provider. I would say the *average* is far
Where do I sign up? (Score:5, Funny)
I will provide my own rifle, bullets, and bayonet.
Re: (Score:3, Funny)
The Form has already accounted for this:
(X) No one will be able to find the guy or collect the money
(X) The police will not put up with it
(X) Anyone could anonymously destroy anyone else's career or business
(X) Laws expressly prohibiting it
(X) Jurisdictional problems
(X) Feel-good measures do nothing to solve the problem
(X) Killing them that way is not slow and painful enough
Comment removed (Score:4, Funny)
Re: (Score:3, Interesting)
Re: (Score:2, Funny)
There, fixed that for ya.
Re:Key exchange. (Score:4, Funny)
There, fixed that for you.
There, fixed that for you both.
Re: (Score:2)
Re: (Score:2)
I'm convinced that today's SPAM prevention methods used together (including end user*) is about as good as it's ever going to get.
* The most effective SPAM filter is a human, sitting in front of their e-mail client, deleting mail that they know is SPAM from the subject line.
I know it's annoying. But I think we're stuck with it.
Re: (Score:3, Insightful)
First of all, stop calling it SPAM. It's not an acronym -- it's just named after the actual meat, used in a certain context.
But more importantly...
The most effective SPAM filter is a human, sitting in front of their e-mail client, deleting mail that they know is SPAM from the subject line.
Incorrect.
Firstly, I don't know about the rest of you, but I get far too much spam to read every subject line. It's already impractical, and getting to where it would be physically impossible without hiring people to read my email for me.
But also, a human is not necessarily the most accurate filter:
http://www.paulgraham.com/wsy.html [paulgraham.com]
Granted, if you actually read e
Re:Key exchange. (Score:5, Insightful)
Why not cut it down to this:
"Your post advocates
[x] a solution
to the problem of spam. It won't work, because
[x] I am a spammer myself and I want to instill a sense of hopelessness in people
[x] I only care about problems, not solutions
[x] any solution that covers less than 100% of all cases is unacceptable to me
[x] I like spam"
Your post surely applies to the antispam measures taken by my provider, but between them they keep my mailbox pretty much free of unwanted messages. And by posting this every time any kind of potential solution is discussed, you are ruling out the possibility of a solution altogether.
Re: (Score:3, Funny)
ctrl+c. ctrl+v.
Or you can find the definitive version here [justfuckinggoogleit.com].
Sales or support (Score:2)
Thus, when you give out your email to people, you could give them a key that they would need in order to send you an email, and similar methods would apply to other communication mechanisms.
Under your system, when one opens a means of contact for sales or support of his products or services, I'd assume he would give out the key for that. So how would he prevent that name:key@host from getting spammed?
Re:Sales or support (Score:4, Funny)
easy, you just need to encrypt the first key with a second key. surely, there's no way for a spammer to get a hold of all 3 pieces of vital info now needed to send an e-mail.
but if by some off chance that spammers manage to get a hold of all 3 pieces of info (because users have to give out these keys just as they would an e-mail address), we'll just add another key to the system, and another...
we'll all need to get bigger business cards.
Re: (Score:2)
I suppose it would make sense if you had to make an exchange of keys with someone before initiating communication. Thus, when you give out your email to people, you could give them a key that they would need in order to send you an email
What you described is called, "only giving your email to people you trust." Except we call it an e-mail address, not a key. It is already available, and does not require any sort of special software other than an e-mail client. It is a good practice for most people. Unfortunately, it does not solve the problem for people who need to receive email from strangers, such as contractors.
Re: (Score:2)
Re: (Score:2)
Yeah, I used to think that was a good idea...
Your post advocates a
(X) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
(X) Mailing lists and other legitimate email uses would be affected
( ) No one wil
Re: (Score:2)
On the minus side, encryption and signing are far les
Re:Key exchange. (Score:4, Informative)
Cut it out with the finger pointing at China and Russia. The vast majority of spam comes from the US, initiated by US citizens. It's not "the Russians" at fault. Anyway, what is this? The 80s?
I don't buy that. Accuse me of over-indulging on Kool-Aid if you must. Most spam streams out of America - That's no surprise. We've got a helluva lot of computers with broad-band access and clueless users who basically bend over and hand lube to zombie-lords.
I've seen cyber-intelligence numbers (disclaimer - collected by US intelligence) and they indicate pretty clearly that the bots are being controlled by people in Russia and China (Poland, Switzerland, and Holland house a surprising number too). Those people may be Russians, Chinese, Americans, whatever, but they're running their armies from overseas (relative to the US). I'm actually surprised fewer are operating out of Africa - It seems to be a relative safe-house.
It's not paranoia once you've got data supporting it. (Let me be the first to criticize myself for not supplying a link...)
Re: (Score:3, Insightful)
I believe the link I posted, in the comment to which you are actually replying, suggests otherwise. The number one spammer on the Spamhaus lists is a US citizen who uses Chinese servers to control his botnet.
I assumed that people would read the link I posed before replying. How silly of me.
You're correct. In the (alphabetically sorted) list you linked to, the #1 spammer is an American.
[But, using the same system, Americans only rank 2nd between Africans, Americans, Chinese, and Russians.]
But, with such credible and specific identifiers as "Alex Blood", "Bubba Catts", "Canadian Pharmacy", "emailspidereasy.com", "fairgamemail.us", "HerbalKing", "JingJing Wang", "MailTrain", "pur", "Stilbox Marketing", "Taiwan Media Ltd", "Trey Armstrong, the Flag Spammer", "Uncaged Marketing", "Yambo Financial
Akismet (Score:3, Informative)
Akismet [akismet.com] is great for comments and such. Basically, it's a neural net using user submissions to determine whether or not a submission (sent automatically from your site for checking) is spam or not.
Sorry, but you get the form too... (Score:2)
Your post advocates a
(X) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the mone
Captchas are no longer good enough (Score:5, Insightful)
It seems that the time when Captchas were an effective way to protect valuable resources is over. Where valuable means "anything of more than a tiny value that is available in large numbers". One email account isn't of value, but a million mail accounts is worth a lot to a spammer, and it's just as easy to get a million automatically as it is to get one.
Frankly, modern captchas are often past the point where I can read them; and the image recognition programs are good enough to get a useful correct recognition rate. This tells us that captcha is a dead end, AI in the form of image processing is now about the same "intelligence" as a human, so there is nowhere for captchas to go.
What to do instead? Well, looking at that report, the bot signup surely looks recognisable - the same IP constantly trying to sign up? But maybe big NAT networks mean that "same IP" isn't a safe bet to block?
If you can't recognise the bot, and it can answer simple questions as well as a human, then the only thing left is to provide another form of identification - like a real-life physical ID.
Re: (Score:2)
Real-life physical ID is not accessible. If you have to show up somewhere in person this is infeasible. If you have a hotline to call for access codes you're going to have to provide a TTY alternative -- easy enough to create a TTY bot. It ceases to be Completely Automated at this point anyway.
Foolproof CAPTCHA is an impossibility, you would need true AI at which point it would be self-defeating.
Not to mention the pr0n hole (people solving CAPTCHA for you, for free, by proxy).
Re: (Score:2)
I agree all these things are difficult. So what solution do you suggest?
Re:Captchas are no longer good enough (Score:5, Interesting)
> I agree all these things are difficult. So what solution do you suggest?
I personally applied a multi-pronged approach, and my spam problem has been negligible for YEARS.
1) Everyone I give my email address to is given a different alias, in the form 'myname-alias.validation@mydomain.com'. 'validation' is basically the hash of the salted alias, with different salting recipes for different pattern-matches just to make life difficult for spammers. In theory I could generate the aliases by hand, but I wrote a program that runs on my HTC Touch to generate them for me as necessary. Anything sent to 'myname@mydomain.com' automatically bounces with message to go to my website and obtain an alias to use for contacting me. Ditto, for the first message addressed to a given 'alias' whose 'validation' is invalid (thereafter they're unceremoniously sent to /dev/null).
2) I wrote an app to generate time-limited aliases in the form 'myname-yyyymmdd.validation@mydomain.com', but for now it ended up being gross overkill since nobody has ever tried reverse-engineering it so I just automatically accept all incoming mail sent to 'myname-yyyymmdd@mydomain.net' (where 'yyyymmdd' is today's date, or at least a date within the past week or so). But if spammers ever caught on, the generator app goes back up, and the rules get tightened.
Aside from the fact that some people and businesses get seriously weirded out when they're told to email you at 'myusername-theircompanyname.longhexstring@mydomain.org', it works BRILLIANTLY. How brilliantly? On a typical day, procmail chucks, bounces, or otherwise blackholes about 18,000 to 25,000 spam emails addressed to an outright nonexistent address, roughly 8,000-12,000 spams addressed to an alias that fell into spammer hands, and maybe a half-dozen that are in the right form, but have an invalid hashcode (they get sent to another account on the server that I check occasionally). Every few days, I have to spend a couple of minutes adding another blackhole rule to .procmailrc, but I've never really had enough to make it worth my time to actually write an administration program to manage it for me.
Would this work for Joe Sixpack or Sally Soccermom? Of course not. They have a hard enough time keeping one email address at aol.com straight, let alone generating salty-checksum-validated adhoc aliases unique to everyone who emails them (and every website that extorts their email address, etc). But for the world's Slashdot Elite, it's a nice, elegant solution (as long as you've got your own domain name or ten and have either a dedicated server or a hosting account somewhere with shell and script access so you can run Procmail. My email has gone from "worthless due to the avalanche of spam" to "for all intents and purposes, spam-free", and has stayed that way for almost six years now.
Re:Captchas are no longer good enough (Score:5, Interesting)
Oh, I forgot to mention... the fundamental reason why everyone who emails me is given a unique generated alias is to protect myself against trojans/worms/malware that might harvest the contents of a trusted friend's addressbook. If it happens (like to my dad 3 times already. Sigh. He's actually the reason I came up with this scheme... he kept getting my addresses harvested and ruining them forever), all I have to do is nuke that one specific alias, and tell that one person to use a different address to reach me at going forward. It's a lot easier to nuke an incoming address used by ONE person, and notify that ONE person if something changes, than it is to notify everyone (including banks, websites, etc) that they need to use a new address to reach you.
Re:Captchas are no longer good enough (Score:5, Insightful)
1) Everyone I give my email address to is given a different alias, in the form 'myname-alias.validation@mydomain.com'. 'validation' is basically the hash of the salted alias, with different salting recipes for different pattern-matches just to make life difficult for spammers.
Ok. So you effectively made the most complicated whitelist imaginable. Except instead of whitelisting your contacts, you've added a layer of indirection and whitelist a code your contacts must send you instead.
I've seen the same thing implemented many times before by giving each contact a passcode and requiring them to include it in the subject line of all correspondence. I do give you props for embedding it into the address instead of the subject line, as that will let you use it for automated systems, like websites that 'extort' an address, etc.
Aside from the fact that some people and businesses get seriously weirded out when they're told to email you at 'myusername-theircompanyname.longhexstring@mydomain.org', it works BRILLIANTLY.
Yes, if torpedoing usability was your goal. What happens when you send something to someone and they reply? Do they have to use your unique address to reply? What do you do when you need write an email address out or give it over the phone? goofball-yourdomain-a23fbf32a4e544303... good times. Or if someone forwards your message to a 3rd person to reply to you...
My email has gone from "worthless due to the avalanche of spam" to "for all intents and purposes, spam-free", and has stayed that way for almost six years now.
I manage the same with spamassassin, amavisd etc and a couple custom rules. And my mail server processes some 30,000 messages a day as well, for a business with half a dozen employees. We get maybe 8 or so spam through a day, and less than half a dozen false positives a month. (Most of which are due to other people sending from domains that publish SPA records and then don't follow what they've published...ie their own damned fault.)
But for the world's Slashdot Elite, it's a nice, elegant solution (as long as you've got your own domain name or ten and have either a dedicated server or a hosting account somewhere with shell and script access so you can run Procmail.
I wouldn't call it elegant. Clever yes, but not elegant.
Anything sent to 'myname@mydomain.com' automatically bounces with message to go to my website and obtain an alias to use for contacting me. Ditto, for the first message addressed to a given 'alias' whose 'validation' is invalid (thereafter they're unceremoniously sent to /dev/null).
Do you even score it for spam at all or do you just generate a lot of needless backscatter?
At the end of the day, I'm not really seeing the advantage of your solution over a moderately sophisticated white-listing + grey-listing solution.
Re: (Score:3, Informative)
>What happens when you send something to someone and they reply? Do they have to use your unique address to reply?
Yep. There's even a nice extension for Thunderbird ("Virtual Identity") that lets me send outgoing email with arbitrary return addressess (so if I'M the one initiating contact, I just generate the alias I want them to use to reply to me and use it as the return address so they can just hit 'reply'). Even better, Virtual Identity keeps track of what alias goes with what sender/recipient, so th
Re: (Score:2)
To which problem?
To spambots filling out HTML forms? For now, a few solutions:
WPoison (just because it actually wastes their resources if it works), probably disallowed by robots.txt, and probably setup to ban people who hit it too often.
Another interesting possibility is requiring Javascript, thus forcing the user to not only have an HTML engine (or a regex), but also a fully functional Javascript interpreter. Sure, they could target any one Javascript countermeasure, but they couldn't catch 'em all.
And to
Re:Captchas are no longer good enough (Score:5, Interesting)
requiring a physical ID for internet accounts is a bad idea.
i like the reCAPTCHA approach. if spammers want to abuse a reCAPTCHA system, at least they'll be making a positive contribution to society by helping to digitize printed literature. maybe Project Gutenberg or the Google Books Library Project can launch a reCAPTCHA service to put those botnets to good use. if you can't stop them, at least this helps to recover some utility from the problem.
there's also the issue of CAPTCHA porn [boingboing.net] and the related phenomena of outsourcing CAPTCHA solutions. as long as there are people willing to solve CAPTCHAs for porn, or money to feed their families, then no reverse turing test will ever be foolproof. so the best thing to do is to exploit this CAPTCHA-solving machinery.
why not make CAPTCHAs educational? instead of random words or random excerpts from books, make them arithmetic word problems, geometry proofs, SAT analogy questions, stoichiometry equations, spelling quizzes, etc. this way, the CAPTCHA solvers gain an education from their labors instead of just some cheap porn or a couple of bucks a day. and after solving CAPTCHAs for a few years, they'll be educated enough to land a real job and/or afford to pay for better porn.
this way you turn the spam problem into a way of educating horny teenagers and underprivileged poor in 3rd world countries.
Re: (Score:2)
Don't spammer AIs for solving captchas usually have a high error rate? They are only useful for the spammers because they repeat after failure. Wouldn't that sort of make them useless for helping out recaptcha?
In fact, if those AIs were any good at identifying the text without error, then why wouldn't whoever is digitizing the texts just use them for the job?
Re: (Score:2)
they do use OCR for digitizing most books, but it costs processing cycles. there's only so much text that any given data center can process at a time.
but yea, i guess they usually pick the lower-quality or more distorted scans for reCAPTCHA. however, they don't just use a single challenge response to determine the correct text. i'm sure they go on the assumption that there will be lots of incorrect responses (either by poor bots or human error) and simply use statistical analysis to determine the correct te
AI isn't beating captchas -- networks are (Score:2)
>>
AI in the form of image processing is now about the same "intelligence" as a human
>>
Not even close, but it doesn't need to be.
What useful work could you do with an OCR program which was correct only 25% of the time? Nothing -- any book you read would look like one of those Babblefish English-by-way-of-Russian-by-way-of-English monstrosities. But a 25% accurate OCR is a 100% solution to the captcha, because you have a big freaking botnet and can generate additional requests for free.
Aside fro
Re:Captchas are no longer good enough (Score:4, Interesting)
That's a good start, but I'm not convinced that simple automation is dead here. This doesn't seem that difficult to me. I've put up live forms that have invalidated 100% of bot submissions, even without CAPTCHA. Granted, impressions are only in the tens of thousands, but still, *combined* with CAPTCHA, a few simple principles ought to suffice, even against concerted, distributed attacks:
0) Obviously, limit submission attempts per session to a humanly achievable rate. Sticky session IDs can be packed into hidden form fields, query strings, cookies, etc.
1) Anything that's worth guarding with a CAPTCHA should require a modern browser (CSS, cookies, javascript, DHTML). In my experience, over half of attempts can be weeded out by using a segregated approach with cookies: user submits -> set some server-encrypted cookie value -> modify value in client-side js -> repost in client-side js -> inspect during next http post.
2) You can still provide accessibility accommodations; just make sure *all* form submissions have frequency limitations that increase in severity with every failed attempt in a single session. What you can't do in cookies or js can still be done in hidden form fields and query string params. For a surprising majority of submissions (i.e. modern browsers or bots trying to imitate them), the simple requirement of a compliant js VM to modify form/cookie/querystring variables before submitting rules out bots right away.
3) For the modern browser version of the form, add numerous honeypot fields; use modern browser techniques to hide them by overlaying them. Making the overlaying element distant from the real one in the DOM tree, and/or add the real element (or all of them, or half of them, or a random assortment) using DHTML.
4) Randomize the IDs & DOM location of both real and honeypot inputs (store a distinguishing hash code or the like in a hidden form field, cookie, or on the query string).
5) Include hidden honeypot CAPTCHA images as well. Observe step 4 here. Also, use large images containing multiple CAPTCHA phrases, and use CSS to crop the image.
6) Vary the obfuscation techniques used in CAPTCHAs, e.g., sometimes fuzzy match on "name the object in the picture" (duck, DUCK, Duck, goose, swan, bird ok, everything else fails), or sometimes use animated gifs and display the challenge progressively instead of in a single frame, or sometimes ask the question in the image and put the answer right there with it! (Cheesy, but that one alone takes most current bots out of the running.)
7) Values in hidden honeypot fields are almost certainly from bots. Ditto for correctly decoded honeypot CAPTCHAs. Log this fact, and record it in a required cookie or hidden form field.
Yes, this is security by obscurity, and it's technically far from foolproof. Still, I would venture that a combination of techniques like this would bring the vast majority of bots' success rates well below the usability threshold. It's not hard to add complexity to a system like this, either. Nor is it hard to accumulate increasingly useful clues as to whether a submission is likely to be human or not.
I need to shut up now; this simple rant is more than enough for a software patent nowadays. Speaking of which, if anyone wants to codify this "method and system of Turing challenge obfuscation," I hereby release the above description under the licensee's choice of either the BSD license, or the "do what the fuck you want" license. Cheers.
Re: (Score:3, Informative)
Good work in TFA documenting an attack. A critical piece is that the CAPTCHA image is sent off and an encrypted answer of eight letters returns in an average of six seconds.
Most replies in all of these CAPTCHA /. threads assume the image is being decoded by computer (i.e., OCR), therefore suggest supposedly harder tests for a computer to solve as a solution (although most suggestions are actually easier).
There is a possibility of that going on, but more likely
Dupe (Score:2)
This was from back in April, and was already discussed on Slashdot [slashdot.org] (the "tuning / exploitation" link).
Just out of curiosity, why doesn't the Slashdot software simply check to see if a submitted story contains the same url as an existing story? Wouldn't that stop a lot of dupes?
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Funny)
Yes, but the editors would work out a system to get around this - actually, I read a story on
reCAPTCHA (Score:5, Insightful)
http://recaptcha.net/ [recaptcha.net]
Re: (Score:2, Informative)
But if a computer can't read such a CAPTCHA, how does the system know the correct answer to the puzzle? Here's how: Each new word that cannot be read correctly by OCR is given to a user in conjunction with another word for which the answer is already known. The user is then asked to read both words. If they solve the one for which the answer is known, the system assumes their answer is correct for the new one. The system then gives the new image to a number of other people to determine, with higher confidence, whether the original answer was correct.
http://recaptcha.net/learnmore.html [recaptcha.net]
Re: (Score:2)
ReCAPTCHA has the same issues as a CAPTCHA because it gives you one to which it knows the answer, so if you get that one right, it assumes you got the other one right. So you still only have to get one of the words right, which, in the end, is the same as a normal CAPTCHA.
Re: (Score:2)
All the researchers have to do is prime the pump by solving a few words and everyone else does the rest.
reCAPTCHA has a critical flaw in its strategy (Score:2)
The reCAPTCHA strategy is that one of the following two things will happen:
1) No improvement in OCR happens and the CAPTCHA remains effective
2) Spammers improve OCR substantially and we get books digitized for free
It fails to account for the 3rd option
3) Spammers improve OCR marginally, achieve a 20 ~ 25% success rate on reCAPTCHA. There is no penalty for getting it wrong if you can generate requests for free and only care about maximizing successes! Its a multiple choice test with infinite questions a
Captchas that humans can read, perhaps? (Score:5, Insightful)
Am I the only one getting really really annoyed by captchas that use mixed-case letters and numbers that aren't distinguishable even to an actual human?
In the cruddy sans-serif fonts most captchas use, 0lRnBC looks like O1Rnl3C looks like 0lRnBC.
It's powers of 2, people! For each O or 0 in your captcha, the odds of a real person being able to correctly identify it are halved, and that's not even counting the other possible charspace collisions.
Re:Captchas that humans can read, perhaps? (Score:5, Insightful)
That's right! Your light green letters with the swath of dark red across them are completely unbreakable... to me. I've literally abandoned websites after failing the capcha repeatedly.
Re: (Score:2)
No, especially when I'm never sure if the reply is case sensitive or not. Sometimes I have to try three and four times, even when I'm sure I've gotten it right. However, the thought occurs to me that the site might simply require you to get three successive captchas right to make it harder on bots.
Re: (Score:2)
However, the thought occurs to me that the site might simply require you to get three successive captchas right to make it harder on bots.
I would swear that MySpace did this when they first started using captchas for their video comment posts. It would never let me enter a correct captcha on the first try for about a week. I wasn't sure if it was a bug in the system or they were trying a new approach. It doesn't do that anymore, unless of course I do get it wrong.
Give them all the accounts they want, but ... (Score:2)
...charge them a penny per e-mail sent.
Re: (Score:2)
Interesting. As a socialist, I despise market-based approaches. In particular for bigger-picture type problem, such as social planning, provision of services, protecting the environment, etc, I think the market is the LAST mechanism that I'd want to use.
But for spam the situation is a little different. Spam is all about 'the market', and in particular, spam exists because free email creates a potentially unlimited market, with zero marketing costs ( for all intents and purposes - there are some nominal cost
Saw on ubuntu forums and other sites (Score:2)
Why not have the captcha ask a question?
"2 + 2 = ?"
or
"What color is a firetruck?"
etc.
Re: (Score:3, Insightful)
The main problem with those is that there are only so many questions you can ask. The spammer just needs a database with all of them, or just a significant portion. As for the simple math, that can easily be parsed and calculated.
Re: (Score:3, Funny)
Good call. You can type in the first thousand questions, and anyone that agrees with you can add another thousand.
Re: (Score:2)
Math doesnt work, cause even a basic script can interpret that.
Same with basic questions like that, it would deny some, but not enough, some database of objects = color/shape/etc would be pretty easy.
Mixing them may work though...
"If you have 2 trucks, and three ambulances, and 6 motorbikes, how many four wheeled vehicles do you have?"
or maybe
"If you have 3 firetrucks, eight ambulances, and 1 + 1 red Ferrari's, how many license plates do you have?"
etc...
Re: (Score:2)
Re: (Score:3, Interesting)
Better yet, how about a combination of image recognition and random questions?
E.g. you're shown a randomly-generated picture with a duck, a chicken, a skunk, and a dog, and background noise. You're asked to click the duck. If you correctly click in the general area of the duck, you're verified.
Probably not the best example, since you'd have a reasonable success rate just for guessing, but it seems like a solid concept.
Re:Saw on ubuntu forums and other sites (Score:5, Insightful)
Because of the pr0n hole (people solving CAPTCHA for you, for free, by proxy).
*via proxies or bot net to avoid IP blacklisting.
Re: (Score:2)
What if we sent the captcha to them by e-mail as a two megabyte image attachment?
Anyone trying to do things with bots would need an e-mail server that can handle tens of thousands of 2 MB e-mails, and ALL e-mail service providers would be able to insta-ban them based on bandwidth usage. Heck we can even make it easy for e-mail service providers to recognize our 2MB capcha e-mail images, by naming them capcha.jpg. Any account that gets more than 10 captcha e-mails in a single day is banned by gmail/yahoo/e
Re: (Score:2)
A cleaner version of the link of thing you suggest is hashcash [hashcash.org]. The idea is that you force anyone using your service to invest certain resources, with the idea being the investment would be acceptable for a single user, but unacceptable for a massive attack.
The problem with hashcash, though, is that computing power is dirt cheap, especially in this day of botnets. The Storm botnet, taken as a whole, peaked last year as one of the world' most powerful computers.
I think we'll be able to come up with a captcha
Re: (Score:2)
Set up your captcha so that people can tell which site it's from. Put the correct site name in the captcha, like this:
People might still answer the captcha, but at least they'll know they're helping spammers. And other people can tell by looking at the captcha that it's on the wrong site, therefore the site is probably bad in some way.
Re: (Score:2)
The answer to this one is: "Where?"
Remember, web apps are used internationally and not everyone knows what color the firetrucks in your country are.
Re: (Score:2)
"What color is a firetruck?"
Not [advantageproductsinc.com] sure [fws.gov], you [bradfordwoodspa.org] tell [rutgers.edu] me [cityofweatherford.com]!
Re: (Score:2)
obligatory xkcd:
http://xkcd.com/233/ [xkcd.com]
2+2=5, for sufficiently large values of 2.
firetrucks are yellow, for better visibility.
The CAPTCHA isn't dead yet. (Score:5, Informative)
When going through the step-by-step in the article, (which is pretty awesome, btw), it appears that there is no character recognition being employed, but rather the security is being defeated by a fairly hacky work-around.
Hacky work-arounds can be defeated simply by programming smarter, (less sloppily?). There's no graphic-reading AI involved, which means the basic fundamentals of the CAPTCHA system remain sound.
While I find CAPTCHAs a little annoying when signing up for stuff, I recognize their necessity and actually kind of grin while doing them, thinking, "Hh ha! Look at this monkey, all smarter than a dumb computer. This must be frustrating for spammers. Ho ho!"
-FL
Re: (Score:2)
There are companies out there (usually in 3rd world countries) that provide CAPTCHA-breaking services, simply by paying some worker a penny or two per CAPTCHA bypassed.
Anything any human can be expected to do, they can get through as well.
Show picture of cat. "What is this animal?" (Score:2)
Oh. I didn't realize that.
Then I guess my suggestion of asking simple questions or showing pictures and asking people to name what they see don't matter.
My suggestion would still be easier than deciphering the nonsense the put out now. Show a picture of the sun, "What is this?" sun. Show a picture of a cat, "What is this animal?" cat.
Just Require Iris Scans (Score:2)
Re: (Score:2)
Re: (Score:2)
It does stop NON-HUMANS.
Then my computer, car, home and business can open for me without keys or captchas.
Yeah, there has to be smarts to eliminate photos. Not hard with a living person.
Re: (Score:2)
If the client's eyeballs aren't physically present at the receiving server, how can you trust that the scan you're receiving over the wire is actually of the person on the other end?
A revised CAPTCHA? (Score:5, Interesting)
In a closer to final version I had envisioned instructions in multiple fonts and colors involving shapes, letters, etc., and much more flexibility.
In the example I've shown above, pure random clicking will produce a correct response to the challenge 1 time in 30 approximately. So - make them solve three in a row and there you are - 1 chance in 27,000.
Re: (Score:3, Interesting)
How about a randonmly generated grid of say 5 x 5 icons of different every day objects (also randomly selected to display in the grid from a database of 1000s of icons) and a question that says click the following sequence.... cat/kettle/cloud
To get it right, you'd need some good image recognition that can recognise a wide variety of objects, and to prevent random clicking attacks, make the list longer...
The article is almost 6 months old. (Score:3, Informative)
this is the article mentioned in the original "Hotmail CAPTCHA sucks" [slashdot.org] slashdot post.
OpenID (Score:2)
Does OpenID help solve this (spamming) problem?
Capitalize on which computers are poor performers (Score:2)
With extremely varied composition (profile shots, portraits, etc.) you could mix things up to the poi
Interactive? (Score:3, Interesting)
How about something interactive?
Use some javascript/css/etc to make a box where depending on the position of you mouse in the box, little images/icons/whatever move around in the box till they overlap and create a bigger picture, then send the mouse position (x,y) to an AJAX server and have it validated.
I wonder about a time delay for E-mail out (Score:2, Interesting)
This won't be a be all and end all to spam, but maybe for new accounts that are freshly created, have an escalating delay for each message sent out? This would go away after some certain rules are matched (date of account creation.)
One can add and subtract modifiers. For example, multiple E-mails sent out to many recipients will have a longer delay than messages sent to the same person, a longer delay if the outgoing content is flagged spam through a heuristic filter, etc.
This in no means would stop spam,
Lycos has the solution (Score:4, Funny)
pay-per-email // smtp service charge (Score:2)
Yes there's a better solution. All smtp servers should all have mandatory per-email charges for RECEIVING, all the way to the email account-holder ( ie I charge my ISP for each email I receive ). Then each account holder would be responsible for refunding this charge when they have read the email, if they are satisfied that it's not spam. If it is spam, then I would of course not refund this amount. My ISP would in turn not refund their amount to the upstream smtp server, and so on, right up to the original
Re: (Score:2)
You want to charge to messages sent to your SMTP server? Okay, you go first. Unless you run aol.com, gmail.com, or yahoo.com, I don't think you're going to get much traction. Perhaps not even then.
You'd have to either arrange payment details for every communicating pair of SMTP servers or provide a clearing-house. Who's going to run this clearing house? And wouldn't it be in the clearing-house's interest to either see spam (and their their fees) increase, or to simply charge people per legitimate email? If
Re: (Score:2)
Obviously this would require ISPs to get onboard and implement it. But considering that they're the ones choking under spam, I think they'd see the point. I know for a fact that some of the largest ISPs in Australia are experiencing serious interruptions to their smtp services because of spam.
We already have a list of smtp servers the email has
Re: (Score:2)
Charge for receiving? I don't know how you'd set up the transfer of payments infrastructure between ISPs.
Charging per message sent makes a bit more sense for the following reasons. It would be a charge imposed by an ISP on its own users. No funds need to be transferred between remote parties (probably a target for its own kind of fraud). It would be imposed by that ISP for the purpose of protecting its reputation. Spammers value this reputation highly, which is what motivates them to expend resources to cr
Microsoft has a better captcha already (Score:2)
Check out ASIRRA: http://research.microsoft.com/asirra/ [microsoft.com]
It's a better user experience as well - I'd much rather tell the server where all the cats are instead of trying to parse out barely recognizable characters.
Social engineering vs captchas (Score:2)
Captchas alone don't solve the problem, but maybe combined with some kind of behaviour blocking, or add more human/machine detection (i.e. sometimes require an answer to be able to send the Nth email) after the account was created could make things a bit less profitable for spammers.. Or other kind
Hashcash? (Score:2)
It strikes me that, with the rise of javascript and xmlhttprequest, and so on, the hashcash concept could be trivially adjusted to serve as a CAPTCHA like mechanism. All one would have to do is include a
Solutions (Score:2)
One possibility is call-back phone calls. It's harder to master both web hacking and phone hacking. Plus, there are more regulations for phones, making it easier to prosecute. Pay phones are known and would not be allowed.
Another approach is an "ID center" where you physically visit a small office and your driver's license (ID) and signature are checked and photocopied for a small fee. The verification could be used by multiple web services.
Captcha: Thirteen = 4 + ? Ask questions?? (Score:2)
Why not make Captchas math problems. Or ask questions that have obvious answers.
What color is the sky?
What color is the sun?
What is seven plus three?
What common pet barks?
What animal meows?
What animal does milk come from?
Three college interns and 3 months and you've got like 2300230023 million of them.
Re: (Score:3, Insightful)
Re: (Score:2)
Does that not discriminate against people with physical impairment?
Really, really, really, really obvious (Score:2)
What makes you think a spammer won't just send fake keystroke times? Never trust the client.