Saturday, November 10, 2007

Captcha

Spammers are some of the smartest people around. They often say of evil people, 'if they only put their knowledge towards good...' I was listening to Leo Laporte (secret crush since he was Dev Null) on the radio. He mentioned a new technique used by spammers to get past the CAPTCHA system used for verification.
http://en.wikipedia.org/wiki/CAPTCHA
Seems, they've set up a virtual stripper who'll take off an article of clothing, if you type in the captcha image code. Then, their system uses your inputted info to gain access to a site they couldn't, otherwise!
http://techguylabs.com/radio/ShowNotes/Show402
I'm always impressed with the way spammers get around what seems like the most brilliant idea in security. A few years ago, there was a virus that would email a copy of something in your My Documents folder to someone else. This was a fun virus. I never had it on my system, but I did get a few files from it. One was a resume. One was a presentation. It was neat. A bit like when you find a note somewhere and read it - seeing a little slice of a strangers life. From those stray notes, over the years, I've learned that everyone writes 'toilet paper' on their grocery list as 'TP'. Either that, or on all the grocery lists I've found, every one was meeting someone with those initials at the store.
The most interesting way I've seen for verifying a human is behind a post was a simple equation - 2 + 3 = ____ and you had to fill in the blank to post. This might have been on Laporte's site. I'm sure this could be easily scripted to by-pass, but if it isn't used on many sites, the spammers wouldn't bother. Anything that becomes the universal way to verify will be broached. Best advice? Keep it creative. Keep it unique. That way, no one will bother.
How about questions like: Newscaster for the Peacock station, last name only ________.
With revolving questions like that, it would take a lot of work to break the code.


No comments: