Slashdot Mirror
Understanding How CAPTCHA Is Broken
An anonymous reader writes "Websense Security Labs explains the spammer Anti-CAPTCHA operations and mass-mailing strategies. Apparently spammers are using combination of different tactics — proper email accounts, visual social engineering, and fast-flux — representing a strategy, explains their resident CAPTCHA expert. It is evident that spammers are working towards defeating anti-spam filters with their tactics."
"It is evident that spammers are working towards defeating anti-spam filters with their tactics."
Sounds like news to me!
Whose bright idea was it to use light grey text on a white background?
Normally when I get spam I just delete it, by using trashmail and being somewhat safe about my browsing habits I've found that I only get one or two per week. However recently I've been getting spam through SMS on my phone and that's what I find really infuriating. Granted it is technically just another email, but the fact that I'm paying for this service is what really grinds my gears.
"Never let your sense of morals prevent you from doing what is right" - Salvor Hardin
The article describes how the spammers are using their new found accounts, nothing to do with CAPTCHAs other than they had to (either automatically or manually) break them to get the accounts.
Im surprised they're not using them to break the spam filter of yahoo/hotmail/gmail though, I mean if they all started sending each other spam and marketing it as ham, wouldn't that pretty much break any feedback based system that their using to protect their users.
IranAir Flight 655 never forget!
A little less than one year ago I had put up a forum for my website; PHPBB (insert whatever the current version was). Anyway, all was fine for a few weeks until I noticed obvious spam accounts registering maybe once a day. Nothing ever came of them, no abusive posts or anything of that nature, but they were sitting there in my user list. I tried several common approaches, such as using a different CAPTCHA and also forcing a verification word to be typed in. Nothing worked. Eventually I noticed that the one commonality between all of the spam accounts was that they all chose Albanian as their language. Odd. I initially thought that perhaps the spammers were based in Albania, but quickly came to the conclusion that the bots were simply selecting the first available option in the language dropdown. I wrote up a script (which was painfully sloppy, I'm sure) that would not allow anyone to successfully register with the Albanian language. After filling everything out and hitting submit, it would take you to a page and say something to the extent of "Sorry, you have selected an unauthorized language. Please try again". I watched carefully as for weeks I didn't spot a single new spam account. Eventually I made a fake language to sit at the top of the list and block, just in case any actual Albanians wanted to use the board. It continued to work just fine. After several months I did get hit by one or two spam accounts that had set their language to English. After that, I wrote a similar script for the "personal website" field of the signup process, forcing legitimate users to add it to their profile after successfully registering. I haven't had any problems since.
"He who can destroy a thing, controls a thing." --Paul Atreides, Dune
This is the scam part, not the technology part of their operations, which would actually tell us about the possible weakenesses for the CAPTCHA tests and give hints how to fix them.
I have determined that:
/contains/ more than ten email addresses, I don't want
If the message is not in english or lojban, I don't want to see it.
If the message is in caps, I don't want to see it.
If the message was sent to more than ten people, I don't want to see it.
If more than 10% of the message text is not valid and correctly
spelled english or lojban, I don't want to see it.
If the message has anything to do with a lottery, I don't want to see
it-- I don't gamble, period.
If the message has anything to do with sex, I don't want to see it.
(for various reasons)
If the message has anything to do with drugs, pharmaceutical or
otherwise, I don't want to see it.
If the message was sent from africa, I don't want to see it. I don't
know anyone in africa.
If the message was sent from asia, with the exception of south korea
and the one guy in the UAE, I don't want to see it either.
If the message was sent from central or south america, with the
exception of one guy in argentina, same thing.
If the message
to see it. Death to chain mail.
If anyone knows of an email provider where I can set rules that
detailed and flexible that currently exists, please let me know.
ethana2@gmail.com
I get the idea that the editor failed to RTFA.
Good article nonetheless, but c'mon.
Every time I see an article about CAPTCHAs being broken, I always think, "Why not try animated CAPTCHAs?" Surely something this simple has been thought of before and tried; is there any reason it wouldn't work? Or would it just have the same effectiveness as a static-image CAPTCHA, and so there's just no reason to put forth the effort to make one?
They keep trying to make it harder to read which isn't accessible but some places (like rapidshare) have made it nearly impossible for even normal people to guess.
This article links to what is basically an infomercial. What it links to is filled with pictures and seeming explanations, but it's written in scare-mongering language and not written with an eye towards the reader understanding it. It as an advertisement telling you that Websense is a fantastic company because they understand all this terribly scary stuff and already have the technology to defeat it for you.
Need a Python, C++, Unix, Linux develop
I was going to post an insightful comment about the article, but I've wasted so much time trying to figure out Slashdot's captcha to post this message, that I no longer have the time.
Either the spam-fighters will keep spam down to an acceptable level or they won't.
Mail services that don't provide good spam protection will fail.
If it becomes too hard to fight spam, mail as we know it will end and be replaced by something else, much like USENET was for most purposes replaced by other, less-spam-prone media.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Next time I'm just going to demand that anyone who wants to register for my site will have to send me a formal written request, signed and dated, with at least two good references and a registration history.
That should keep the bots out, right?
Hmmm. Nothing in TFA about it really.
It ought to be obvious to everyone that spam is a property violation crime. Putting unrequested email in my account is the same as dumping used tires on my front lawn. Sure I have an address, but that doesn't mean I want just anyone to deliver anything to it without my permission. Why aren't we making this explicitly illegal, just like dumping and vandalism already are? Why are we putting up with these people?
We're seeing the need for some limits on web page redirection. Most of these attacks involve putting something on a trusted place which redirects to an untrusted place. Google, with incredible sloppyness, allows Blogspot accounts to do this, and as a result, they are heavily exploited by spammers. (Try, for example, "nikaluti21040.blogspot.com", which will redirect, via some iframes and other tricks, to "selissia.com", which is hosted on "secureserver.net").
Exploitation of legitimate sites to get through spam filters is a problem, but it can be dealt with if you're willing to take a hard line. Our first step in that direction was our list of major domains being exploited by active phishing scams. Our position is that one phishing attack from within a domain blacklists the whole domain. But within three hours after the problem is fixed, they're off the list. Major sites make the list now and then; Google, Dell, MSN, and Yahoo have all been on the list at one time or another. But they now know to take steps to get themselves off within hours. The Anti-Phishing Working Group and PhishTank have been helpful with this effort. We're down to 47 such domains today. It was about 175 when we started last fall. Most of the remaining entries are free web hosting services or DSL providers.
We and others have observed that there's an inverse relationship between the number of redirects and the legitimacy of a web page. We've been looking at this at SiteTruth. For things like AdWords ads, where some sites use redirection as part of a tracking systems, it's typically the bottom-feeders who are using redirection. An advertiser promoting their own product or service doesn't need it; it's brokers, intermediaries, and made-for-Adwords sites that use redirection. Anything with more than one redirect is almost bad. We expect to use redirection as part of our legitimacy metric in the future.
It's thus time for browsers to limit their acceptance of redirection. One HTTP-level redirect, OK. Beyond that, put up a popup warning of suspicious redirection behavior. Redirects via META tags and Javascript should produce a popup. Sure, some site operators will look bad, but they will adapt.
I'd prefer 2, or better yet, 3 grades of service:
* verified user, someone using a credit card or providing some other ID that, if faked, can be prosecuted criminally
* established regular user, a person with a reasonably long and regular history, say, at least 10 logins a month, at least 10 outbound messages a month, and at least 10 inbound messages a month, for 3 of the past 6 months, and a minimal history of complaints.
* other - anyone else
On outbound messages, include a tag that the recipient's mail provider can use as part of its trust-assessment.
The "minimal history of complaints" is a potential problem due to false allegations and joe-jobbing.
Lack of ID could be a problem for users from countries whose IDs are not deemed trustworthy. If I give Yahoo my Nigerian passport number....
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Find somewhere with 1000s of pageviews (eg. pr0n site)
Present Captcha image to 2 users (agreement = correct)
So the monkeys pull the right lever and get the reward
of viewing the next adult video, and the spammer gets
a near-realtime solution to even the best of captchas.
Comment removed based on user account deletion
I made a CAPTCHA using flash and PHP. It seems as if the spammers might have a hard time reading flash content, no?
Comment removed based on user account deletion
This is the most incoherent TFA I've ever seen linked by slashdot. We just went through CAPTCHA breaking a few days ago and here we go again with the dancing images and worse suggestions.
Sheesh, there's this underlying assumption that the CAPTCHA image is automatically being broken by spambots using OCR, but all it takes is CAPTCHA images where the letters are not cleanly separated to keep all but some as yet univented world class OCR from identifying the characters. Anyway, no one has presented a case for automatic OCR breaking anyway.
It'd be nice to see some more basic examinations of the technologies involved in attack and defend of websites. We deal with this in adminning our websites day in and day out so this is an important subject.
rd
I think its time to use phone-based sign-up verification. An automated dialing system would call a user within about 5 minutes of signing up for an account to confirm via phone push-button that they indeed did sign up. Yes, it is fairly expensive, but who said good security is cheap.
It is possible to trick such a system, but very difficult on a scale of hundreds of thousands, which is what spammers need. Phone calls are better tracked than HTTP messages because of the costing infrastructure that underlies phones.
Table-ized A.I.
The spammer problem wouldn't exist if email wasn't so hopelessly broken. It wasn't designed from the ground up to prevent assholes from abusing it.
Ditch email, design something else. This is slashdot for crying out loud, surely we can come up with a solution!
Ok, so I've got to say, I just don't GET (understand) spam. Who the hell is still clicking on the links?
Does anyone fall for a Nigerian scam anymore? Or buy pills? Or want a bigger schlong?
Don't people get it already?! How do these spammers make money?
If you can read this... 01110101 01110010 00100000 01100001 00100000 01100111 01100101 01100101 01101011
(1) Create TinySMS.com ...For If When Do loop While...
(2) People type in their message and are given a helpful TinySMS string like &Ee*3#9-! to text to their SO, cleverly avoiding the cost of receiving an SMS by just recording the preview string
(3) People smash their phones trying to text strings like "&Ee*3#9-!" until they realize it isn't possible
(4) TinySMS ends up selling the unread text messages to the highest bidder
(5) E! buys an unread TinySMS and learns of Britney's latest accident 12 minutes sooner
(6)
(7) Profit!
I come here for the love
Captcha is discrimination against scixelsyd!
I once received a spam for a p0rn site. Accessing that site required to enter a Captcha code "in order to avoid bandwidth steal".
A Captcha for a p0rn site?! How much do you bet that the Captcha was actually proxied from another site, like a webmail?
{{.sig}}
Like I just got scammed by web sense! RSS Spam Its a new type of advertising scam, writing slightly interesting articles and posting them on news for nerd sites with a little wrap about your self at the end.
If people could successfully get legislatures to support privacy rights then any spammer would be considered a criminal. But businesses consider the ability to send cold call email a vital necessity to many of their business models and as such, promote spamming as a right of the free market, thereby eroding personal privacy
Digg shares several amusing doctored screen shots of RapidShare's CAPTCHAs that might be shown in the future.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Comment removed based on user account deletion
How come Evolution still doesn't have a white/blacklist against the addressbook? How come it doesn't have a spam filter that traps even whitelisted spam that's bayesian-similar to marked spam?
How come big email servers like at ISPs don't flag as spam messages that have identical bodies but different senders and recipients?
How come ISPs don't pretend to be spammers in the market for spamming SW, then reverse engineer what the spam engineers sell them into filters, like virus honeypots have proven works?
--
make install -not war
Interesting, and clever marketing by Websense. This is the third /. post linking to an article on their website in the past three weeks, iirc.
It's amazing how we try solve solve problems like these. Instead of looking at protocols designed pre-spam and before massive automated attacks as being the problem, we see the attacks as the problem. If we continue to latch on to poorly authenticated, plain-text protocols, we'll continue to face these attacks. The solution is to rewrite email, ftp and other insecure and inadequate protocols to meet the modern age. If we continue to 'duct tape' our solutions, spammers and hackers will continue to outpace our development.