Spammers crack Gmail Captcha

'Turing test'?

No, no, no. CAPTCHA is the opposite of a Turing test - A Turing test is a human trying to tell a human and a program apart, a CAPTCHA is a program trying to tell a human and a program apart.

Holiday in Cambodia

Where the people dress in Black...

With that tag-line, I've now got several Dead Kennedys tracks going round in my mind, and this will have to be dealt with by playing said tracks at maximum volume which will annoy the wife.

I can't quite see the connection between the tag and the article, but maybe I'm just too semantically blinkered!

"Stealing People's Mail"...

... is the presumably the correct DK track the semantically challenged amongst us should be listening to right now.

StareClips.com

Actually, it's the work of people who write captcha-reading software that makes captcha's harder and harder to read by humans. So, if you have a hard time reading captcha's, you should be AGAINST those who write software to read them.

Bot army now with human servants?

So apparently Russians are paying people to correctly identify captcha strings for their bots?

Impossible!

We all know that Google GMail can't be used for spamming. That's what Google says every time they ignore your complaints about spam coming from their mail servers.

Other techniques

I'd wager their sophisticated OCR tech actually only matches one in a hundred captchas. You know, the poorly generated ones that an amoeba could read. The article mentions only 500,000 accounts generated by the HotLan trojan, if it were more sophisticated at reading I'd imagine this figure would be in the millions.

In which case, Google and MSN should just limit multiple captcha page retries and block access from specific IP addresses for several hours if its deemed to be trying too often.

...Or does it match good enough to work on the first, second or third try of a captcha in most cases? That would work.

Unless the spammers could go into legit business with incredibly sophisticated OCR technology, I doubt they're THAT clever - just that GMail and MSN aren't that reactive to such threats.

But I dont really know...

Re: Bot army now with human servants?

> So apparently Russians are paying people to correctly identify captcha strings for their bots?

That's how I read the Websense article; And the second host appears to be (doing a bad job of) trying to crack the Captcha programatically, so Man is still ahead of Machine.

But why don't the bad guys just pay people to create accounts for them? Surely none of their "workers" think that getting paid just for reading Captchas can be legit? Or does GMail disallow 2 signups from the same "source"?

mal-formed

my favourite types of 'captcha' are the ones which dinnae tell you in advance whether or not the code is case sensitive... or tell you it is and then present you with a letter which looks the same in both upper and lower case... or make no distinction between capital I [eye], lower case l [el] and the number 1 [one] .... or between the letter O and zero...

and dinnae even get me started on sign up forms which ask you to pick a username or password and then *only* after you've submitted the form, throw an error in your face, telling you that 'your username needs to be at least six characters' or 'your password must contain at least one number'..... so you change your username/pass from the ones you wanted to use to ones that conform to the whims of the form designer and then have to write the feckers down, so you willnae forget them - which kinda defeats the whole purpose of having a login/pass in the first place!

even better

How about having to crack the first 3 levels of bricker or pac man before your sign up is accepted. Now we are talking!

moving captchas

Imaging a animated GIF captcha swirling in an infused cloud of incandescent murkeyness. That would stump everyone. Top marks.

Will

@Stu

"In which case, Google and MSN should just limit multiple captcha page retries and block access from specific IP addresses for several hours if its deemed to be trying too often."

Which would have blocked me the other day as it took me multiple failed attempts to work out that the Hotmail CAPTCHAs don't work in Firefox!

You can put the right characters in as many times as you like, it always fails until you try IE (didn't check with Opera)

Shame

thats a shame, but Google Mail is still light years ahead of every other mail service on many fronts so i'm still voting for them

And so it continues

One of the biggest problems is a particularly nasty piece of scumware called XRumer. It cracked the phpBB2 CAPTCHA some time ago and it looks like it'll add "support" for Gmail, Windows Live and Yahoo in due course. If you've ever had to do admin for a forum and delete hundreds of spam registrations with generic details such as random countries for location or bland descriptions for occupation you'll have come across its after effects.

I don't think coming up with increasingly obscure and technical ways is really the best way to deal with spam and malware. This isn't some bored teenage cracker trying to show off his l33t h4x0r skills but a bunch of crooks with plenty of time and (often stolen) money. The problem of botnets is a bit like someone who doesn't realize they own a toxic waste dump that's polluting a river. Sure someone downstream might come up with a way of removing some of the pollutants and stop it affecting them, but the source is still there.

Bots generally have a pretty distinctive "signature" for the type of traffic they produce. You can usually guess a pwned machine from the headers of a spam email or a failed semi-automated attempt at registering on a forum. It's likely that the owner of the machine (as opposed to the bot herder) is unaware that they don't have full control of what happens on it and they would probably be shocked to know a criminal gang is using it for nefarious purposes. One problem is that people don't always understand the importance of keeping a machine patched ("I don't use that feature so why should I care?") and even if they do it isn't physically possible to do so because MS have decreed that it's reached the end of its life. The audience on El Reg will understand this, but someone who just uses an old Win98 computer for a bit of email and word processing probably wouldn't.

I think one way to address this would be a "your machine is infected. Do this to fix it or you will be disconnected" letter sent to the owner of that IP address (make sure it's sent to the right place!) along with a mandatory requirement for MS to continue to update its operating systems until the usage is so small that any impact will be minimal. Changes to the OS kernel mean that a lot of old DOS viruses don't work under Windows, open mail relays are somewhat a thing of the past and rogue diallers were pretty much killed off by broadband. However it's difficult to lock down an old Windows box with gaping holes when MS refuses to patch them.

Kittenauth FTW

I'd like to see software reliably tell bunnies & kittens apart.

AND

I'd like to see bunnies & kittens!

passwords and logins

@madra

kevin mitnick, the famed ex-hacker now security adviser, recommends that people select very complex passwords and that they write them down, and keep them somewhere safe - like in their wallet with the other valuable paper.

too many people choose lame passwords and if we try to force people to adopt more secure passwords, there is a huge resistance. personally i try to use passphrases of a sort. the downside is i am a slow typist - but that is the price i pay for being security conscious.

No, heads off the spammers

Diabolical ingenuity should *NOT* be rewarded.

Spam email is an economic problem, and no technical or legal or medical or non-economic solution is going to fix it.

One solution would be to fine anyone who helps spammers. That would eliminate the free email accounts and free website hosts, but at this point I think it would be worth it. In Japan, I'd hope the ISP Dion would go bankrupt on their spam-support fines.

The irony of it all ...

Are these the same spammers who invented image spam? When spam filters started using OCR, they started to distort the image to bypass this.

So, if I understand correctly, captcha is a technique used to disguise spam, and make it harder for humans to register. it is machine readable by spambots but not spam filters.

If I understand correctly.

buh

Now they will have to come up with something even more annoying to authenticate humans.

@ Morely Dotes

Good thinking. Instead of identifying numbers and/or letters, the random question might ask what colour the letter i is or which character is uppercase, which character is Chinese, etc. And, as mentioned above, blocking the IP from creating an account after creating an original account would help too.

Taken by force

Considering the name of the author, perhaps that would be more appropriate.

So, they have finally found the...

G spot?

No, I'm not wearing anything thanks!

@And so it continues

I'm a phpBB2 forum admin, and when the bogus accounts started to appear (they would register but couldn't activate - I use confirmation emails, obviously not an option when signing up for an email account:) So I just added a nonstandard mandatory field in the registration form. Problem solved, haven't seen hair or hide of bots since then.

CAPTCHA

CAPTCHA does not stand for "Completely Automated Public Turing test to tell Computers and Humans Apart"; As a previous poster said, it's the reverse of a turing test.

There's something wrong with the elreg glossary, because this comes up EVERY time there's a story about CAPTCHA's.

The correct wording is:

Completely Automated Program to Tell Computers and Humans Apart.

That's not that difficult, is it?

They're also known as REVERSE Turing tests, for the above reasons.

Grrrrrr

@Ryan

"'d like to see software reliably tell bunnies & kittens apart.

AND

I'd like to see bunnies & kittens!"

What for, if you can't tell them apart w/o help?

Bunnies and Kittens

Bunnies and kittens, eh?

That could be more fun than you think! Look up the alternative meanings for "la chatte" (French) and "el conejo" (Spanish) sometime .....

PayPal Micropayment

How about a new service from PayPal? Want to send an email that I'll read? Make a small payment into my PayPal account and attach a message.

@ Barry Rueger

All the problems with email arise due to its acient design.

Trying to have a system backward compatable would just render the new system useless

The sooner we ditch the current system the better!

Humans

can read the Captchas for the bots... Set up bots to open accounts and route the captchas to a human who can learn and improve his speed. Pretty soon you will have humans able to type captchas at 60 per minute. A network of such humans could open hundreds of thousands of accounts daily. So, Google will have to go to plan B, which is... I have no clue.

LOL!

>The humanizer mod (which asks "are you a human?" worked for a while) but that's now been cracked.

Answer - "Negative, I am a meat popsicle."

...name the movie.

.

@Doc Dish - Funny that, every Google Captcha I've tried I've only failed it once or twice at most. I've done quite a few in my time too. True though that Captchas on some sites r so bad its taken me maybe 3 or 4 attempts, no more.

.

@Will -

>Imaging a animated GIF captcha swirling in an infused cloud of incandescent murkeyness.

Actually thats not a bad idea, people are better at seeing patterns in motion, kind of like picking out soldiers in forests, can be seen better if they move around. Might make some people sick tho!!!

@stu

"Anybody else want to negotiate?"

@Stu

I was getting the CAPTCHA characters correct, it's just that the Hotmail (owned by Microsoft) CAPTCHA can only be passed via Internet Explorer (made by Microsoft)

Go figure

spamservices.google.com

Now in beta!

Stop free email accounts!

A great way to check if an account is genuine is to require payment with a credit card!

Turing Porn Farms

I was reading on wikipedia the other day about "Turing Porn Farms" (er, I searched on the term "turing", honest), which are apparently a clever way around these CAPTCHAs. You just set up a free porn site, and require folk to fill in a CAPTCHA to access it; because you can rely on a fairly constant stream of people signing up to your porn site, you can just scrape the CAPTCHAs from gmail or livemail or whatever in real time, and use the results to sign up for dummy accounts. Nifty, eh?

What is the purpose of a Turing test?

What is the primary purpose of a Turing Test?

Is it to test if a human can tell a computer and a human apart?

Or is it to test if a computer is able to convince a human that it itself is human?

If it is the latter, it really is secondary whether the ‘judge’ is human or – as is the case with Captcha, the judge is another computer.

So, nothing ‘reverse’ here, eh?

Paris, because I'm sure Captchas are keeping HER from passing.

Respect, cos I can't read them there blots

I can't read these ink blots on some forum boards; so respect to them thar 'youfs'

Actually Google is easy but Yahoo is a bum pain - which is why I never use it.

Its not that I'm that old -but I did learn MS-DOS 3.1, so I suppose I am an ancient