Slashdot Mirror
Porn Rewards Users To Get Past Anti-Spam Captchas
Stalke writes "Spammers are now usings a new technique to circumvent the 'captchas,' the distorted text in graphics, that users must input to receive the free email account. The spammers have cracked the system by displaying the 'captchas' on free porn sites in real time. Since there are always a large number of people signing up for free porn, they do the work of decripting the 'captchas' which is then replayed back into the spammers program to create a new email account. Who thought that porn could be a hacking technique!" Sure sounds plausible, though the link here says only "someone told me."
That method is already in use by several sites that get paid by the number of ad-clicks. To make *dead sure* that the patrons click the banners you have to fill in a missing word in a sentence collected from the banner-site or the 3rd word etc to get into the site.
It's pretty lame, and I guess most ad-agencies frown upon it as the clickers aren't really producing any business..
Wouldn't matter.
Automated spam script goes to sign up new email address, gets presented captcha. Downloads captcha -- as the server would expect any normal web browser to do.
Captcha is copied to some location. Filename probably contains information that can identify the specific script that's running, since there'll undoubtedly be many going simultaneously.
From that point, there's about 20 minutes, give or take, for the porn site to display the copy of the captcha and ask for the user's input. On a site seeing any amount of traffic at all, that should be more than enough.
Once a user has given input, the spam script is notified, and sends the input back to the captcha server. The captcha server never sees the IP address of the human -- it only deals with the spam script -- so it'll never know anything's up.
Dr Superlove 300ml. I use my powers for awesome
Porn site gets a visitor.
The cgi or other executable on the web server's site then starts to sign up for an email account, and caches the graphic that must be decoded.
The exact same graphic is presented to the porn site visitor.
The porn visitor decodes the graphic and clicks "Submit"
The program at the porn site then finishes signing up for an email account by entering the text that the porn visitor entered.
If the email address is successfully created, the program then permits the user into the restricted area, otherwise entrance is denied and the whole process repeated.
Yes, these images are generated on a per session basis, but the whole point is that each visitor to a porn site gives the porn sites a new potential email address with which to spam.
It's actually quite ingenious if you ask me.
File under 'M' for 'Manic ranting'
No. It's quite simple. You get the HTML (open a session), and instead of retrieving the image for the Captcha right away, you wait until someone's signing up for free porn (a few nanoseconds), then show *them* the inline image, which only needs to be loaded once in this case, they enter the code, which your script sends back as the form reply.
I wish I'd thought of it first, I could've patented it. Or maybe someone should, so the spammers can't use it.
Jake
Dating: while( 1 ){ call_girl(); get_rejected(); drink_40(); } return 0;
This is ancient news, it has been mentioned by me on the ASRG list in November and on my blog. The original new article was published by the Post Gazette, and found by Matt McCay in his blog. Liudvikas Bukys mentioned it in his blog also. You might also want to take a look at the W3C draft on why these visual tests do not work for disabled people. And to end this off, the basic premise of C/R is that the return address is valid. Even if spammers break these visual tests, in order to do that, they must have a valid return address - ergo, making them traceable.