Windows Live Hotmail CAPTCHA Cracked, Exploited 362
eldavojohn passes along what may be the last nail in the coffin for CAPTCHA technology. Coming on the heels of credible accounts of the downfall of first Yahoo's and then Gmail's CAPTCHA, Ars Technica is reporting on Websense Security Labs' deconstruction of the cracking and tuning / exploitation of the Live Hotmail CAPTCHA. Ars calculates that a single zombie computer can sign up over 1400 Live Hotmail accounts in a day, and alternate account creation with spamming. Time to dust off Kitten Auth?
Great (Score:2, Insightful)
Cutest kitten
Anything is better! (Score:5, Insightful)
Re:Don't need new auth (Score:2, Insightful)
I could even have them send mail to each other to lend a thin veneer of realism to discourage the account provider just wiping them automatically.
Re:Anything is better! (Score:5, Insightful)
Why allowing same computer multiples? (Score:3, Insightful)
Why are they allowing the same account creation attempt to fail over three times?
Still... I guess as computers get smarter, this is unstoppable.
All my accounts are white-listed. If I don't know you, I don't see your email.
Re:Anything is better! (Score:2, Insightful)
I had been working on a community driven system of identifying media. It had the benefit of being useable by vision or hearing impaired persons. Users could upload a piece of media (generally audio or a picture). Users would then submit their best identification of that media. For example, you could have a picture of a cow. Users would submit "Cow", "Mammal", "Bovine", etc, or in the case of audio, it could be as simple as repeating the words in the audio, or answering a simple math test.
Another advantage, at least of the pictures, woudl be that it could handle multiple languages. The audio could simply be tagged as "en" or "fr".
The idea was then that a site owner could insert a bit of code to request the media, any language preference, and a list of the top n answers. They display the media in place of a captcha. The user submits the form, as well as their answer. Their answer is compared to the list of top n answers.
The system I was building would host all the media, so web masters would not incur extra bandwidth. Filenames would be randomly chosen, and changed on a regular basis.
Maybe I should resurrect it.
Re:Kitten Auth (Score:5, Insightful)
hotmail ? (Score:4, Insightful)
For as long as I can think, hotmail has been a spam source. "not blacklisted"? My ass.
Re:Anything is better! (Score:3, Insightful)
Real world... (Score:5, Insightful)
Problem is that none of them really will work in the Real World (RW).
In the RW people like webmail. In the RW people like to change e-mail addresses, or create new ones for specific needs. In the RW some people like "real" e-mail, downloaded to a local PC, and others like Google or Yahoo or Hotmail and keeping everything on the host server.
In the RW a lot of people and businesses send a lot of bulk e-mail, very legitimate opted-in e-mail. In the RW a lot of people get important messages from entirely new people, people who haven't been whitelisted, and who are unlikely to bother going through the whole "If you want to e-mail me you need to click the link below and prove that you exist" process. After all, clicking links in e-mail is something that we teach people to NOT do.
And in the RW the spammers always stay one step ahead of the ISPs and mail providers anyhow.
No, what's needed is a real ground-up redesign of how e-mail works. we need something that encompasses the ease of current POP/IMAP/Webmail services, but which somehow includes ways to authenticate and/or block mail without user intervention, and which does so with near perfect reliability. And which maintains some backwards compatibility for at least a few years.
Adding more hoops or captchas or whitlelists to the existing mail sysytems just isn't going to solve the problem.
Re:Not the last nail in the coffin by far... (Score:4, Insightful)
'This aged portion of society were distinguished from'
The OCR read 'portion' as 'pntkm.' This doesn't mean it's hard for computers to decipher, it just means that the OCR programme sucks. Hello! 'pntkm' is not a word. It's not caps, so it's probably not an acronym. It has no vowels, so it's not pronounceable. It also doesn't appear in any dictionary. Heck, even if it was scanned as some similarly-spelt word like 'abortion,' it makes no sense in the context of the sentence, and presumably if the software was sophisticated enough, it could recognise that.
Re:Kitten Auth (Score:4, Insightful)
Botnets. If someone really wanted to make 10,000 accounts, just have each computer on a botnet make 1 account each, with a botnet of 10,000 computers. Different IPs, etc to make them difficult to differentiate from legitimate creations.
As computers get more powerful and AI gets better, CAPTCHAs have to get harder or they are broken.
And then there is the "porn for CAPTCHA" hack, where you have a second site where you have people solve a CAPTCHA to get access to porn, and then the hacker uses that solution to make an account on the original site. The only solution is to have a short timeout, but if the porn site gets enough traffic, even that isn't an issue.
AI may be hard, but it isn't impossible to have real intelligence used en masse.
Re:Anything is better! (Score:5, Insightful)
And have you ever tried the audio CAPTCHAs? Talk about horrendous.
Plain text or even TTS would allow near 100% accessibility if you asked simple math questions in the context of a story problem. With rotating questions, nouns, and verbs, a relatively small number of predetermined values could be used to quickly generate many different combinations.
Sure, it's still crackable, but it would be a hell of a lot nicer for the users. And with a significant enough base of words and grammar structures it would still be rather solid. Combine that with decent behavior tracking. (Wow look, this ASDFDSA guy just created his email account 5 minutes ago and has already sent 15,000 emails!) And you'd wind up with something that is MORE accessible and still provides a solid amount of protection.
-Rick
Re:Anything is better! (Score:5, Insightful)
Now the patch for this is to start blurring the kittens. So welcome back to square one my friend.
Re:Kitten Auth (Score:3, Insightful)
Re:Great (Score:3, Insightful)
Re:Kitten Auth (Score:2, Insightful)
Then a computer will be able to discern spam, and the problem will solve itself.
Re:Why allowing same computer multiples? (Score:1, Insightful)
Re:Anything is better! (Score:2, Insightful)
Yeah but all 'are you human' tests so far are crackable.
"The giant green dragon breathed fire at the horrified princess as the chivalrous knight drew his bowstring. What word in the previous sentence describes the emotional state of the female?"
It is actually not that hard to write a program which is capable of GENERATING such challenges. It is much, much harder to write a program which is capable of comprehending them and answering the question. It does not depend on the ability to see or even hear, just the ability to somehow input the sentence into your brain and comprehend it.
Re:Anything is better! (Score:2, Insightful)
Hey -- wait a second (Score:5, Insightful)
I think I see a wonderful circle here. The basic problem is spam. It's a problem, because we can't seem to make a computer program which can reliably determine whether an email is spam.
Wait a second. We can't make a computer program which can reliably tell if an email is spam. So that's your CAPTCHA right there -- present the user with a selection of emails, approximately half of which are spam, and ask them to identify which is which. Since computers are not good at this task (thus the entire problem!) it seems this would be the ideal challenge.
What is absolutely wondrous about this, is that if the spammers try to solve this problem, what they will create is basically a program which can reliably distinguish spam from non-spam. No spammer would ever do that, because if that piece of miracle technology ever got out in the wild, it would render the spam problem obsolete.
Re:1-900 number (Score:2, Insightful)
Re:Anything is better! (Score:1, Insightful)
Re:Anything is better! (Score:2, Insightful)
Now that would be clever appart from the fact that these guys have botnets and therefore thousands of ips to use when creating accounts.
Call me insane but I think the only long term solution we will ever find is manual moderation of account creation.
The alternative would be creating a more restricted relation between ip and computer. That way the ip user could be held responsible OR made aware of his/her malware problem.
Re:Hey -- wait a second (Score:2, Insightful)
Something tells me this wouldn't quite work.
Re:Anything is better! (Score:1, Insightful)
Sorry, I'm just being honest, and am not coddling you like other politically correct people. While I'm somewhat sympathetic to your problems, I just don't think you are so important that you should drag down the rest of us. We should try to accommodate you on a best-effort basis, and that's it.
Re:Don't need new auth (Score:3, Insightful)
Re:Awesome article (Score:2, Insightful)
Re:Hey -- wait a second (Score:3, Insightful)
Re:Great (Score:3, Insightful)
Re:Anything is better! (Score:2, Insightful)
If a law were passed requiring business owners to install wheel-chair accessible ramps, does that count as the economy being dragged down? What about accessible bathrooms? Making websites accessible should be a lot easier than making mortar and brick spaces, so I don't really see what the big deal is.
And what exactly do you mean by purged? Asphyxiation trucks.. or left to die on their own?
Having "no respect whatsoever for those who just whine and try and get everyone to change to fit them" is a lot like saying that our society is perfect as it is and the criticism of those you perceive as weaker is invalid. Did you consider for a minute that the disabled you'd like to purge might have so much else to offer that even with the expense of accessibility factored in they bring a net benefit?