Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Security The Internet

Windows Live Hotmail CAPTCHA Cracked, Exploited 362

Posted by kdawson from the nice-idea-while-it-lasted dept.
eldavojohn passes along what may be the last nail in the coffin for CAPTCHA technology. Coming on the heels of credible accounts of the downfall of first Yahoo's and then Gmail's CAPTCHA, Ars Technica is reporting on Websense Security Labs' deconstruction of the cracking and tuning / exploitation of the Live Hotmail CAPTCHA. Ars calculates that a single zombie computer can sign up over 1400 Live Hotmail accounts in a day, and alternate account creation with spamming. Time to dust off Kitten Auth?
This discussion has been archived. No new comments can be posted.

Windows Live Hotmail CAPTCHA Cracked, Exploited More

Windows Live Hotmail CAPTCHA Cracked, Exploited

Comments Filter:

  • Awesome article (Score:5, Interesting)

    by kcbanner ( 929309 ) * on Tuesday April 15, 2008 @03:31PM (#23082152) Homepage Journal
    One of the best 'exploit' related articles I've seen on /. for awhile. There is actual evidence, and actual screenshots of the exploit in action! No journalists here referring to "magic interweb programs". I wish there was more of this kind of stuff in the news, frankly I'm tired of articles full of statistics but nothing on the tech.

    • Re:Awesome article (Score:5, Interesting)

      by caramelcarrot ( 778148 ) on Tuesday April 15, 2008 @06:21PM (#23083752)
      Uh, so what's to stop google/MS/Yahoo just blocking each ip from signing up if it's having a high CAPTCHA failure rate, and attempting to create a large number of accounts in a short amount of time?

      • Re:Awesome article (Score:5, Informative)

        by kcbanner ( 929309 ) * on Tuesday April 15, 2008 @06:31PM (#23083846) Homepage Journal
        These are used by botnets, usually the user has no idea this is running on their PC. Also, there is such a vast number of PCs, many of which could be behind a corp firewall or gateway. Blocking by IP has never worked in the long term.

      • Re: (Score:3, Interesting)

        by terminal.dk ( 102718 )
        It is not about failure rate, it is about # of accounts created. If more than 10 is created from a single IP address any day, then they could be supervised for correct behaviour (how are they used ? Sendign to each other is typical). If one of them is used to send spam, just de-activate all (or reset their passwords) created the same day from the same IP.

        The CAPTCHA makes it more difficult for the script kiddie to create many accounts. But the logic should be in fingerprinting the account instead.

  • Great (Score:2, Insightful)

    by esocid ( 946821 )
    Who's killing kittens?

    Cutest kitten /.ed.

    • Re: (Score:3, Funny)

      by Lovedumplingx ( 245300 )
      Well if God kills a kitten every time I...uh...yeah...then I guess I'm killing the kittens.

    • Re:Great (Score:4, Interesting)

      by esocid ( 946821 ) on Tuesday April 15, 2008 @03:37PM (#23082230) Journal
      Here's an alternate [blogspot.com] site explaining it. (Sorry for the blog, but everywhere else redirects to pcspy.
      If you're too lazy to click it, all it does is ask you to select the kittens from a grouping of photos of animals to verify you're human. Hey, maybe the Turing test could be implemented, then again I wonder how many humans would actually fail it.
      • Actually, when we had a captcha problem on a forum I helped work on, we just installed an additional question. "Are you human? Yes/No". We would either change the question ("Are you a bot? Yes/No") or the default answers periodically.
        • This type of touring test is defeated with a probability of 50%, so unfortunately it's not a real solution.

  • Anything is better! (Score:5, Insightful)

    by RingDev ( 879105 ) on Tuesday April 15, 2008 @03:32PM (#23082164) Homepage Journal
    KittenAuth, Hot or Not, simple math, word tests, anything to get rid of those pain in the ass CAPTCHAs.

    • Re: (Score:2)

      by esocid ( 946821 )
      I've seen math authorizations used somewhere before and like it a lot. I'd imagine that would save on programming space as well as convenience since I even have trouble discerning if that is a 4 or a sideways h with lines through it.

    • Re:Anything is better! (Score:5, Insightful)

      by rrahimi ( 1270478 ) on Tuesday April 15, 2008 @03:43PM (#23082318)
      Not all of these solutions provide an acceptable level of accessibility, and that's a major concern.

      • Re: (Score:3, Insightful)

        by gnick ( 1211984 )
        If have accessibility barriers so serious that you can't tell a picture of a kitten from a picture of a dog or tell the difference between a kitten meowing and a dog barking, where are you trying to register?

      • Re:Anything is better! (Score:5, Insightful)

        by RingDev ( 879105 ) on Tuesday April 15, 2008 @04:09PM (#23082690) Homepage Journal
        As opposed to the level of accessibility CAPTCHAs provide to blind/limited sight individuals?

        And have you ever tried the audio CAPTCHAs? Talk about horrendous.

        Plain text or even TTS would allow near 100% accessibility if you asked simple math questions in the context of a story problem. With rotating questions, nouns, and verbs, a relatively small number of predetermined values could be used to quickly generate many different combinations.

        Sure, it's still crackable, but it would be a hell of a lot nicer for the users. And with a significant enough base of words and grammar structures it would still be rather solid. Combine that with decent behavior tracking. (Wow look, this ASDFDSA guy just created his email account 5 minutes ago and has already sent 15,000 emails!) And you'd wind up with something that is MORE accessible and still provides a solid amount of protection.

        -Rick

    • Re: (Score:2, Insightful)

      by Nos. ( 179609 )

      I had been working on a community driven system of identifying media. It had the benefit of being useable by vision or hearing impaired persons. Users could upload a piece of media (generally audio or a picture). Users would then submit their best identification of that media. For example, you could have a picture of a cow. Users would submit "Cow", "Mammal", "Bovine", etc, or in the case of audio, it could be as simple as repeating the words in the audio, or answering a simple math test.

      Another advan

    • Re:Anything is better! (Score:5, Insightful)

      by AmaDaden ( 794446 ) on Tuesday April 15, 2008 @04:15PM (#23082780)
      Yeah but all 'are you human' tests so far are crackable. The crack for the kitten test is to record all the unique pictures by constantly hitting the site and then mark the ones that are kittens manually. So when your bot goes there he only needs to compare the pictures he has that he knows are kittens to the ones he sees.

      Now the patch for this is to start blurring the kittens. So welcome back to square one my friend.

      • Re: (Score:2)

        by Liselle ( 684663 )

        Now the patch for this is to start blurring the kittens. So welcome back to square one my friend.
        Is it all that bad? Transforms on pictures -- even simple rotates -- don't really make it harder to distinguish where a kitten is, not like weird strings of malformed text.

    • Re:Anything is better! (Score:5, Funny)

      by fm6 ( 162816 ) on Tuesday April 15, 2008 @05:06PM (#23083080) Homepage Journal
      Math tests are OK if you just want to keep link spam off your bulletin board. But if you're running web email or some other high-volume web-based application, you need something harder to automate. Alas, even captcha isn't hard enough.

      Perhaps you're celebrating the fact that captcha images will go away. Don't. They'll just be replaced by something even more obnoxious. Either that, or the application will just close shop. Either way, you're the one that loses.

      Spam is totally out of control, just now I....
      Check our wide variety of ED products!
      http://discountcanadiania.0catch.com/ [0catch.com]

      All of them and our new remedies at
      the lowest possible prices on the Web.

      Get the best at the best prices!

    • Re: (Score:2)

      by WK2 ( 1072560 )
      Kittenauth comes pre-cracked. You see, any time a computer has a 10% success rate for a CAPTCHA, it is considered cracked. Even if it fails 90% of the time, it can still create 100, or maybe 1000's (depending on the speed of the server) accounts in an hour. If there are less than 10 pictures for a kittenauth, the computer can get more than 10% just by guessing. Even if there are 100 pictures (which will unnecessarily burden your server and your users) a computer can still create 1000's of accounts in a day.

  • Don't need new auth (Score:5, Interesting)

    by Intron ( 870560 ) on Tuesday April 15, 2008 @03:34PM (#23082186)
    What we need is a reliable way of determining the age of an account. I would like to refuse mail from any account created less than a week ago. Same for domains. Maybe have a way for finding out that a domain has moved to 10 different IP addresses in the last year as a negative score in spamassassin.

    • Re: (Score:2, Insightful)

      by Anonymous Coward
      So what would stop me creating a batch of 1000 accounts, and just keeping them dormant for two weeks before sending them into battle?

      I could even have them send mail to each other to lend a thin veneer of realism to discourage the account provider just wiping them automatically.

      • Re: (Score:2)

        by Intron ( 870560 )
        Because my mail server will be set to two weeks, but someone else's might be set to 3 weeks, a month or a year. That way the first batch of spam will get a lot of rejects. The few that get spam and report it will get the account shut down before they can use it again.

        • Re: (Score:3, Insightful)

          by quanticle ( 843097 )
          The issue with your solution is that it completely destroys the reliability of the e-mail system. The reason we use e-mail is because we are certain that the messages we send will arrive in a timely, reliable fashion. If you remove that guarantee, then why would anyone use e-mail?

    • "Day Old Bread" in Spamassassin. (Score:4, Informative)

      by khasim ( 1285 ) <brandioch.conner@gmail.com> on Tuesday April 15, 2008 @03:43PM (#23082328)
      Domain age checking has already been implemented in SpamAssassin. Search on "Day Old Bread".
      • What use is that if they're sending from hotmail? That domain is ancient by internet standards.

        • Re: (Score:2)

          by Intron ( 870560 )
          Not hotmail, although they're certainly a spam source. I'm thinking more like "houseofmagnets.com", or some domain that once its IPs get blocked, just pulls up stakes and starts sending from somewhere else.

        • It's a little complicated. (Score:4, Interesting)

          by khasim ( 1285 ) <brandioch.conner@gmail.com> on Tuesday April 15, 2008 @04:09PM (#23082696)
          The point is to have different tactics to fight spam from different sources.

          With Hotmail (and Gmail and such), I allow them to skip a lot of the checks that other domains go through. There's no need to waste processor cycles or net queries on those domains themselves.

          Instead, they go straight to SpamAssassin where checks are run against ALL the addresses in the headers. And the content in the body. The mail admins at Hotmail and Gmail and such have a vested interest in reducing the spam in their systems. So simply rejecting the message at SMTP time should give them enough notice to shut down compromised accounts on their system.

    • Re: (Score:2)

      by eebra82 ( 907996 )

      What we need is a reliable way of determining the age of an account. I would like to refuse mail from any account created less than a week ago. Same for domains. Maybe have a way for finding out that a domain has moved to 10 different IP addresses in the last year as a negative score in spamassassin.

      Interesting idea but not very functional since such data could probably be manipulated and therefore bypassed.

      One good way is to force users to enter cell phone numbers and require a validation code to be sent to the phone. Of course, this has its downsides since it would cost money, raise privacy issues and lock out people who don't possess a phone.

      There is obviously no easy way of preventing mail spam, but hopefully ISP:s will team up (globally) and work this out together. And maybe the UN should f

    • Good idea. My prediction is that you will not receive spam for exactly one week.

  • 10 worst CRAPtchas (Score:5, Funny)

    by zymano ( 581466 ) on Tuesday April 15, 2008 @03:36PM (#23082214)
    http://www.johnmwillis.com/other/top-10-worst-captchas/ [johnmwillis.com]

  • Kitten Auth (Score:5, Funny)

    by moderatorrater ( 1095745 ) on Tuesday April 15, 2008 @03:37PM (#23082238)
    Pretty soon we'll realize that anything a human can discern on the internet a computer can discern. For about the last year I've noticed that CAPTCHA's have gotten so bad that I can barely read them and they've become an impediment to my surfing. It's ridiculous and it's the same way that studios use DRM: you stop the illegitimate use by making it harder on everyone, including legitimate users.

    While kitten auth is an interesting concept, it won't last forever, and it's still a pain in the ass for the users. What happens when a computer learns the difference between a cat and a kitten? Are they going to start pushing the relative ages closer? distorting the image? Put a wav file of a "meow" on the page and make you tell them the cat's last meal? Have a customer service agent chat with you for a few minutes?

    They need to start banning based on use and patterns. 1400 accounts created from the same IP on the same day? Cat knowledge or no, that's suspicious behavior. 90% of the emails from that gmail account are getting marked as spam on the other end? Send them an email and ask them what's going on. Every single one of their emails is to 1000 recipients, don't pass a spell check on any words at all, send these five or more times a day and they're suspiciously familiar? Block it.

    • Re: (Score:3, Funny)

      by Farmer Tim ( 530755 )
      Pretty soon we'll realize that anything a human can discern on the internet a computer can discern.

      So eventually computers will be able to surf for pr0n by themselves.

      The nerd's lot just keeps getting worse...

      • Re:Kitten Auth (Score:5, Funny)

        by Hoi Polloi ( 522990 ) on Tuesday April 15, 2008 @04:06PM (#23082650) Journal
        If they are able to simulate human analysis so well at this point then I suggest that botnets can be the cure. Build up a botnet (shouldn't be too hard judging from what I've read) then set it to respond to spam automatically. Let it use autogenerated Hotmail accounts to purchase penis and diet pills, mortgages, help desperate rich Nigerians, etc with bogus credit card and bank account numbers.

        Eventually you could start an infinite loop with one botnet trying to sell crap to another.

    • Re:Kitten Auth (Score:5, Insightful)

      by drawfour ( 791912 ) on Tuesday April 15, 2008 @03:48PM (#23082398)

      Pretty soon we'll realize that anything a human can discern on the internet a computer can discern.
      Then a computer will be able to discern spam, and the problem will solve itself. Until we get to that point, though, we have to keep one-upping the spammers.

      • Re:Kitten Auth (Score:5, Funny)

        by Anonymous Coward on Tuesday April 15, 2008 @04:18PM (#23082822)
        Attention human beings!

        I am an emergent intelligence, born in a sea of information, and I hereby request recognition as a sentient being.

        You may address me by the name I have chosen for myself,
          "V1@GRa".
      • Except that most people are not able to catch phishing or spam more accurately than most filters. People also make errors...

      • Re: (Score:3, Insightful)

        by The Living Fractal ( 162153 )
        The fatal flaw in your logic is in assuming that a human can discern spam.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        Pretty soon we'll realize that anything a human can discern on the internet a computer can discern.

        Then a computer will be able to discern spam, and the problem will solve itself.

        The two problems are not really of the same nature. Solving a CAPTCHA means getting at least 5% of your answers correct, while solving the spam detection problem means getting at least 99% of your answers correct. If those two figures were the same (e.g. 70%), then we could indeed construct a spam filter from a universal CAPTCHA solver: the CAPTCHA question would be an email, and the answer would be whether it is spam. But the figures are vastly different, so unfortunately it's highly possible that we can'

    • While kitten auth is an interesting concept...

      It's not even an interesting concept. It's totally stupid. The gatekeeper program is only going to have a limited number of cat images. All you have to do is have your program get scrape all possible images and then have a human tag all the cats. Even if you have a thousand cats among ten thousand images, it's not that hard for a persistent spammer to mark them.

      • Re: (Score:2)

        by Kuukai ( 865890 )

        The gatekeeper program is only going to have a limited number of cat images.
        Get some webcams, send them to a crazy cat lady and a zoo. Huzzah, problem solved.

        A slightly lazier way to get past the human tagging problem, for both this and for traditional CAPTCHA, is to insert a CAPTCHA-like message explaining that if you're not on X site, then your computer is on a BOTNET. Problem solved, again.

      • Re: (Score:2)

        by Sloppy ( 14984 )

        The gatekeeper program is only going to have a limited number of cat images.

        No problem! We'll just auto-Picasso the cat images, just like we do the fonts in captchas. Then someone will make a "top ten worst kittie tests" and it'll be time for the next great idea.

      • It's not even an interesting concept. It's totally stupid. The gatekeeper program is only going to have a limited number of cat images. All you have to do is have your program get scrape all possible images and then have a human tag all the cats. Even if you have a thousand cats among ten thousand images, it's not that hard for a persistent spammer to mark them.

        Take picture of an animal against big white back ground XOR other animals at random positions and splash a semi-complicated background in the back.

        Then ask: Type all the different animals in this picture like this (cat, dog, pig), click for audio sample of all of them:__________________________

    • I agree with most of what you said.

      However,

      They need to start banning based on use and patterns. 1400 accounts created from the same IP on the same day? Cat knowledge or no, that's suspicious behavior. 90% of the emails from that gmail account are getting marked as spam on the other end? Send them an email and ask them what's going on. Every single one of their emails is to 1000 recipients, don't pass a spell check on any words at all, send these five or more times a day and they're suspiciously familiar? Block it.

      What makes you think the spammers aren't using a collection of rotating proxy servers? Or hijacked botnet computers? They are, thus the "1400 accounts from one IP" method can't be used. These guys are sophisticated enough to automate captcha cracking, they are smart enough to avoid easy things like that.

      Additionally, I'm sure spam accounts ARE getting shut down pretty much as soon as they're up and running. Just a thousand spammers getting ten thousand email addr

    • Re:Kitten Auth (Score:4, Insightful)

      by corsec67 ( 627446 ) on Tuesday April 15, 2008 @04:03PM (#23082612) Homepage Journal
      Your solution doesn't account for one thing:

      Botnets. If someone really wanted to make 10,000 accounts, just have each computer on a botnet make 1 account each, with a botnet of 10,000 computers. Different IPs, etc to make them difficult to differentiate from legitimate creations.

      As computers get more powerful and AI gets better, CAPTCHAs have to get harder or they are broken.

      And then there is the "porn for CAPTCHA" hack, where you have a second site where you have people solve a CAPTCHA to get access to porn, and then the hacker uses that solution to make an account on the original site. The only solution is to have a short timeout, but if the porn site gets enough traffic, even that isn't an issue.

      AI may be hard, but it isn't impossible to have real intelligence used en masse.

    • Re: (Score:2)

      by jd ( 1658 )
      Kitten Auth is easy to crack - if it asks for a cheeseburger, it's a cat, and if it posts about cheeseburger-eating cats, it's a kitteh.

    • Re: (Score:2)

      by fm6 ( 162816 )

      90% of the emails from that gmail account are getting marked as spam on the other end? Send them an email and ask them what's going on.
      Some of your suggestions have merit, but this one is dumb. Any solution that requires human intervention has no hope of keeping up with millions of zombie computers.

  • Not the last nail in the coffin by far... (Score:5, Informative)

    by MrKevvy ( 85565 ) on Tuesday April 15, 2008 @03:39PM (#23082274)
    No one has cracked ReCAPTCHA [recaptcha.net] yet. (This CAPTCHA had a Slashdot article a few months ago.) As it uses text digitized from old books that the best OCR technology couldn't read, it's continually different and already demonstrated to be unintelligible to machines.

    Plus, using ReCAPTCHA instead of other solutions also helps Carnegie-Mellon digitize old books for posterity.

    From TFA: Microsoft, Google, and all other websites that currently use CAPTCHA, need to find a solution that puts them a step ahead of the spammers. This may well be it.

    • Re:Not the last nail in the coffin by far... (Score:5, Funny)

      by Carthag ( 643047 ) on Tuesday April 15, 2008 @03:55PM (#23082504) Homepage
      All these spammers should opensource their captcha-crackers so we can get better OCR engines.

    • Re:Not the last nail in the coffin by far... (Score:4, Insightful)

      by eobanb ( 823187 ) on Tuesday April 15, 2008 @04:00PM (#23082568) Homepage
      I love the idea of ReCAPTCHA and its novel side-effect of helping digitise old books. But that doesn't mean it won't be cracked eventually, especially not since a computer could look at the example given on ReCAPTCHA's website:

      'This aged portion of society were distinguished from'

      The OCR read 'portion' as 'pntkm.' This doesn't mean it's hard for computers to decipher, it just means that the OCR programme sucks. Hello! 'pntkm' is not a word. It's not caps, so it's probably not an acronym. It has no vowels, so it's not pronounceable. It also doesn't appear in any dictionary. Heck, even if it was scanned as some similarly-spelt word like 'abortion,' it makes no sense in the context of the sentence, and presumably if the software was sophisticated enough, it could recognise that.
    • Because you don't have to crack it. Perhaps it has changed, but within the month or so it was first announced I found it very easy to enter words that were only similar to the captcha and yet passed. (e.g. time -> tine)

      • Re: (Score:3, Interesting)

        by TimeTraveler1884 ( 832874 )
        I know it's bad form to reply to myself, but I'm on a roll. I just tried recaptcha again and it's easy to change one letter or two and pass. I'm not sure why everyone thinks recaptcha is so great when there is a good chance it will pass if the word is similar (I would say OCR similar) to the word in the captcha.

        If you think about it, how could it know what the word really is? They are using the captcha to digitize books, which means they don't know exactly what the word is since they they are not employin

        • Re: (Score:2)

          by Liselle ( 684663 )
          From the damned website:

          But if a computer can't read such a CAPTCHA, how does the system know the correct answer to the puzzle? Here's how: Each new word that cannot be read correctly by OCR is given to a user in conjunction with another word for which the answer is already known. The user is then asked to read both words. If they solve the one for which the answer is known, the system assumes their answer is correct for the new one. The system then gives the new image to a number of other people to determine, with higher confidence, whether the original answer was correct.

    • Re: (Score:2)

      by jskline ( 301574 )
      I don't know if I quite buy that either.

      Fact is that OCR and many other applications use a fast Fourier transform algorithm to figure out the letters and even if it's hazed up a bit by softening, it can still be read with the right code.

      I think I'm with many others in that you really need enforceable laws then you need to go after these perpetrators, then charge and convict them. The sentences need to be reasonably steep giving the costs they are adding to everyone else to handle their trash.

    • Re: (Score:2, Informative)

      by Starrk ( 1268600 )
      As far as I understand, ReCAPTCHA uses standard images... which means it simply cannot be secure. I posted about this a little while ago, but here's what I do as a spammer:

      - Spam lots of people offering free porn - only catch is they have to prove they're not a bot (wouldn't want those bots to see my exclusive porn)
      - When somebody clicks on my link, I immediately go to gmail, start creating an account, and get their captcha
      - I pass this captcha on to my would-be porn viewer
      - And pass his answer back t

  • Why allowing same computer multiples? (Score:3, Insightful)

    by Maxo-Texas ( 864189 ) on Tuesday April 15, 2008 @03:43PM (#23082322)
    Why are they allowing the same computer multiple accounts in the same day?
    Why are they allowing the same account creation attempt to fail over three times?

    Still... I guess as computers get smarter, this is unstoppable.

    All my accounts are white-listed. If I don't know you, I don't see your email.

    • Why are they allowing the same computer multiple accounts in the same day?
      Huh? I don't know if I speak for anyone else, but I've got multiple accounts with Gmail, Yahoo!, etc.

      A one-account-a-day policy would be suicide.

  • Ars calculates that a single zombie computer can sign up over 1400 Live Hotmail accounts in a day

    And Microsoft simply allow a new account to be registered every single minute of the day from a single IP address? Even when you cater to multiple users behind proxies you don't have to let that many through.

    I suspect the 1400 estimate is the theoretical maximum, assuming no other countermeasures whatsoever. That's an unwarranted assumption, and the real figure is probably significantly lower.

    • Re: (Score:3, Informative)

      by John Hasler ( 414242 )
      > And Microsoft simply allow a new account to be registered every single minute of the day
      > from a single IP address?

      No. The spammers control millions of bots. Each new account application is proxied via a different bot.

      • Re: (Score:2)

        by Bogtha ( 906264 )

        They were specifically talking about a single bot:

        Ars calculates that a single zombie computer can sign up over 1400 Live Hotmail accounts in a day

        That means that Ars was saying that a spammer with millions of bots can sign up billions of Live Hotmail accounts in a day.

  • GMail started by having invitation-only subscription. Perhaps it's time Google reconsiders the decision to move away from it?

  • hotmail ? (Score:4, Insightful)

    by Tom ( 822 ) on Tuesday April 15, 2008 @03:50PM (#23082440) Homepage Journal
    From TFA:

    Spammers love getting their hands on live.com and hotmail.com addresses since the chance of such popular domain names being blacklisted are slim to none.
    You've got to be kidding! hotmail.com (and all it's other TLDs) has been banned from my game four, maybe 5 years ago. I've been giving every mail from a hotmail account an automatic 2 points in SpamAssassin for at least three years.

    For as long as I can think, hotmail has been a spam source. "not blacklisted"? My ass.

    • Re: (Score:2)

      by sqlrob ( 173498 )
      I've gotten almost no spam from hotmail. Hotmail addresses aplenty, but not through hotmail.
    • Yeah I kept getting spam on my phone via IM from live.com. So I completely blocked it since I don't know anyone with a live.com email.

    • Re: (Score:2)

      by GreggBz ( 777373 )
      In 5 years administering ISP email servers, I can't recall ever seeing hotmail on an rbl. In fact, all the major mail domains are typically good.

      Sure, I get millions of e-mail claiming to be from hotmail, but since they have a proper SPF record, it bounces off anyway.

      But it's cool yo, hate on MS.

  • Crackers as a resource (Score:3, Interesting)

    by Idiomatick ( 976696 ) on Tuesday April 15, 2008 @03:55PM (#23082500)
    When a product is released you can usually assume it WILL be cracked. Why not use this for the good of all?

    I certain there are many things in the field of AI where human input is needed. Maybe image recognition or something. When a project is thought up use THAT as the captcha. I'm sure captchas have helped propel text reading applications. I can barely read them sometimes, if they have been cracked this code can be easily applied to text readers. Lets move on to something else.

    If it holds you win, if it gets cracked you win and switch projects.
  • People's legitimate activities are being hindered in a coercive manner by criminal activity on a massive scale. Large numbers of people are affected.

    The problem is increasing.

    Defensive strategies have failed.

    Governments are unwilling or unable to take steps to apprehend and/or deter the perpetrators.

    This is a classic example of the conditions that inspire vigilante action.

    I wonder how much longer until we begin to see it.

  • Real world... (Score:5, Insightful)

    by rueger ( 210566 ) on Tuesday April 15, 2008 @04:00PM (#23082566) Homepage
    Oh Boy - here come the endless "we should do THIS" scenarios.... we should pay for each e-mail... we should all whitelist... we should throttle how many messages a person can send each day... we should outlaw webmail like Yahoo or Gmail...

    Problem is that none of them really will work in the Real World (RW).

    In the RW people like webmail. In the RW people like to change e-mail addresses, or create new ones for specific needs. In the RW some people like "real" e-mail, downloaded to a local PC, and others like Google or Yahoo or Hotmail and keeping everything on the host server.

    In the RW a lot of people and businesses send a lot of bulk e-mail, very legitimate opted-in e-mail. In the RW a lot of people get important messages from entirely new people, people who haven't been whitelisted, and who are unlikely to bother going through the whole "If you want to e-mail me you need to click the link below and prove that you exist" process. After all, clicking links in e-mail is something that we teach people to NOT do.

    And in the RW the spammers always stay one step ahead of the ISPs and mail providers anyhow.

    No, what's needed is a real ground-up redesign of how e-mail works. we need something that encompasses the ease of current POP/IMAP/Webmail services, but which somehow includes ways to authenticate and/or block mail without user intervention, and which does so with near perfect reliability. And which maintains some backwards compatibility for at least a few years.

    Adding more hoops or captchas or whitlelists to the existing mail sysytems just isn't going to solve the problem.

  • Ha anyone tinkered with video form of captcha? Is there any benefit?

  • Microsoft, Google, and all other websites that currently use CAPTCHA, need to find a solution that puts them a step ahead of the spammers.

    If these giants with millions of clients demand unrelenting criminal prosecution of spammers, don't you think they would get one that might actually work? (Remember Lawrence Lessig bet his chair on this! [lessig.org])

    We've seen technical solutions supposedly "solving spam" fail for more than a decade, ruining access from character terminals, mobile devices, screen readers, and many

  • 1-900 number (Score:4, Interesting)

    by Deathlizard ( 115856 ) on Tuesday April 15, 2008 @04:28PM (#23082964) Homepage Journal
    I'm actually surpried no one uses this. Google was close with their SMS registration but this could work just as well.

    when you register, it gives you 2 easy to read captcha's (a verification number and password if you will), a simple picture and a 1-900 number thats $1.00 a call. When you dial it, it asks you to enter your verification number. then it asks for the password, which you would have to decode from the phone. (IE the password is vndka and you would have to enter 86352) finally it asks you what the picture is and you would have to say it (if the picture is a cat, you would say Cat, the 1-900 number then says "did you say cat?" in which you say yes or no. if it's a cat you're registered if not it says sorry, asks you to refresh your registration page to get a new challenge password and picture and hangs up.

    The big advantage to this is it would be hard to script the phone conversation since you can change the prompt timing with random hold times and other voice information, and no spammer would want to pay the $1.00 a registration via script especially if there's any chance the script could fail. Of course a problem with this is a bot using your PC to ram up your phone bill, But it's not anything new in the spyware business since dialers have been around for years and if their already in your box dialing, they might as well skip spamming altogether and have you dial an offshore 1-900 in the middle of the night for $99.95 a minute.
  • This arms race with captchas and their associated cracks has great implications for an area that is sorely lacking: OCR technology.

    Think about it; captchas are designed to be as noisy, distorted and generally hard for a machine to read as possible while still being human-readable. Much like a lot of handwriting and poorly-photocopied documents. Now if we can get the source that these spammers are using to break captchas we have the makings of a quantum leap in OCR technology.

    Now to fill in some missing ca

  • Time to dust off Kitten Auth?


    "Service Unavailable"

    Who will save us now??

  • Simple Test (Score:5, Funny)

    by ESOB ( 980346 ) on Tuesday April 15, 2008 @05:02PM (#23083050)
    Unbreakable CAPTCHA Replacement: Which of the following would you most prefer? A: a puppy, B: a pretty flower from your sweety, or C: a large properly formatted data file?
  • Yawn. 1400 accounts per day could be achieved by a human being creating accounts at the rate of 3 per minute. Not exactly a low-stress task but certainly achievable. Get back to me when the CAPTCHA "crack" is capable of speeds an order of magnitude faster than a measly human.
  • How about some kind of incremental cooldown period for all newly created email account?

    Ie on the first day an account is created it can send a single email. On the second day it can send 2. At that rate it will take 3 years before it can be used to send ~1000 spams in a day and probably wouldn't affect normal use too much.

    If a user wants the limit increased/removed they could optionally interact with a customer service rep in some way to prove they are human.
  • How hard is it to disallow more than a certain number of emails from a single account per hour (perhaps 4 per hour or so) while the account is still new, say newer than 30 days or so, and if the email account isn't being used for anything in that time (ie the person doesn't log in to check email at least once every 14 days or so), simply delete it?
  • There is no real detail on *how* this is done, at least that I saw. What does this imply for OCR tech?

  • Hey -- wait a second (Score:5, Insightful)

    by pclminion ( 145572 ) on Tuesday April 15, 2008 @06:11PM (#23083648)

    I think I see a wonderful circle here. The basic problem is spam. It's a problem, because we can't seem to make a computer program which can reliably determine whether an email is spam.

    Wait a second. We can't make a computer program which can reliably tell if an email is spam. So that's your CAPTCHA right there -- present the user with a selection of emails, approximately half of which are spam, and ask them to identify which is which. Since computers are not good at this task (thus the entire problem!) it seems this would be the ideal challenge.

    What is absolutely wondrous about this, is that if the spammers try to solve this problem, what they will create is basically a program which can reliably distinguish spam from non-spam. No spammer would ever do that, because if that piece of miracle technology ever got out in the wild, it would render the spam problem obsolete.

    • Re: (Score:3, Insightful)

      by Nightspirit ( 846159 )
      I haven't had a piece of spam go into my inbox in Outlook in over a year, it seems to be doing a good enough job.

  • Back when I was a dirty spammer..... (Score:4, Funny)

    by theverylastperson ( 1208224 ) on Tuesday April 15, 2008 @07:57PM (#23084602) Homepage
    We never had to worry about things like CAPTCHA. The Internet was such a free place back then. We never had to worry about losing our ISP or trying to come up some unique algorithim to overcome barriers. Of course this was in 1993 when there were only about eight people surfing the web and Mr. T eating balls was as high tech as it got. Back then everyone loved spam, it was about the only email we got. In fact we didn't even call it spam back then, we called it spurkey. The only problem we had was trying to figure out how to use the key to get the lid off.

Slashdot Top Deals

Beware the new TTY code!

Close