Subject: [Asrg] A CAPTCHA that automatically detects and neutralizes attacks.

From: "Michael Kaplan" <[email-masked]>
Date: Tue, 31 May 2005 10:05:30 -0500

I have developed a CAPTCHA that can instantly detect and neutralize an automated attack.  This is an offshoot of the 3-D CAPTCHA concept that I have previously described.  The 3-D CAPTCHA involved generating unique images by placing a random assortment of computer generated 3-D objects together to form a unique image.  A person would then demonstrate their humanity by identifying a number of specified attributes found within this uniquely generated image.
I have previously described this at my website with the anti-spam method that it was designed for:
http://home.nyc.rr.com/spamsolution/An%20Effective%20Solution%20for%20Spam.htm

The updated innovation involves this CAPTCHA’s unique ability to detect automated attacks and instantly alter itself.
The first line of defense is to have as large a library of unique objects as possible.  We will imagine an active library of at least several hundred different objects.  As a new feature a secret reserve library of objects will also exist; I will explain its function below.

THE SPAMMER ATTACKS
Now let us imagine a spammer who has created a bot that can recognize an object (such as a chicken) from the active library.  
A 3-D CAPTCHA demands that a user identify 4 different attributes within a given challenge.  The spammer’s program is able to frequently recognize a
‘chicken’ when it appears in a CAPTCHA.  The spammer’s program cycles through a tremendous number of CAPTCHAs, correctly identifying the chicken each time it appears.  The spammer has reduced a 4 guess challenge to a 3 guess challenge.  It is now feasible for a spammer to launch a brute force attack.

THE EMAIL SERVICE PROVIDER’S COMPUTER AUTOMATICALLY IDENTIFIES AND NEUTRALIZES THE ATTACK
On an average day there are only about five instances when a ‘chicken’ is correctly identified while the other three attributes are incorrectly identified.  The email service provider’s computer starts to see the following:

-Suddenly over one hour there are 1,000 instances when a chicken is correctly identified while the remaining three attributes are incorrectly identified.

-It is instantly obvious that a brute force attack is occurring and that the ‘chicken’ has become compromised.  The ‘chicken’ is automatically removed from the library and replaced by a ‘guitar’ from the secret reserve library.  The brute force attack is completely neutralized without any human intervention.

- The effort that the spammer has put into characterizing the ‘chicken’ has yielded only a couple of successfully solved CAPTCHA.

-The spammer puts in a lot of effort to characterize 50 different objects used in the CAPTCHA but the above process repeats and those 50 objects disappear almost instantly only to be replaced by 50 objects from the secret reserve library.

-The spammer gives up completely.

I think we can now embrace the concept that we can create CAPTCHA that are beyond any practical attack that a spammer can generate.

Michael G. Kaplan

-- 
_______________________________________________
NEW! Lycos Dating Search. The only place to search multiple dating sites at once.
http://datingsearch.lycos.com

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Robert Raisch <[email-masked]>
Date: Tue, 31 May 2005 11:23:57 -0400

If only humanity were that easily demonstrated.

/rr

---

From: John Levine <[email-masked]>
Date: 31 May 2005 16:42:53 -0000

>I think we can now embrace the concept that we can create CAPTCHA
>that are = beyond any practical attack that a spammer can generate.

Hmmn.  I gather you're not familiar with the free porn proxy attack:
spammer puts up a web site offering free porn with access granted by
solving the CAPTCHAs that it proxies through from its spam runs.  I'm
not sure if I've seen this used yet, but it would not be hard to do.

CAPTCHA's of any form have two other killer flaws.  One is that in the
absence of widespread strong user authentication, which doesn't seem
any closer now than it's been for the past decade, spammers can avoid
your challenge by spoofing mail from someone on your whitelist.  The
other is that significant numbers of people, through bafflement or
exasperation, decline to respond to challenges so unless you never get
mail from people you don't know (in which case a whitelist is all you
need) CAPTCHAs will always lose real mail.

Also, some of us do not keep a log of everyone to whom we have ever
sent mail, so when challenges arrive, we can't tell whether it's in
response to mail we sent or not.  My policy is to answer all of them
since then I'll be on that particular correspondent's whitelist and
whether it was real mail or spoofed spam that triggered it, he won't
bother me again.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
http://www.taugh.com