Newsletters
The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home Network Security Viruses & Malware Cybercrime Security Solutions More Topics...
APC Free White Paper
Optimize your network investment &
Enter to win a Samsung Galaxy Note

www.apc.com
Network Security
24/7/365 Network Uptime
Average Rating:
Rate this article:  
Spammers Get Past Security Into Google
Spammers Get Past Security Into Google's Gmail

By Peter Piazza
February 29, 2008 2:28PM

Bookmark and Share
Latest CAPTCHA attack on Google's Gmail appears to be automated rather than the usual sending to low-paid workers who type in the code. Spammers prize e-mail accounts like those at Google's Gmail because they aren't likely to be blocked. Google says it's dealing with the hackers and Web sites may add more authentication steps.
 

Related Topics

Gmail
Google
E-mail
Spam
Hackers


When you sign up for an e-mail account at Google's Gmail, you have to navigate past a CAPTCHA -- squiggly words and letters that need to be typed into a box to prove you're human and not an automated system looking to send spam. But in the war against spammers, CAPTCHAs are not holding up well and the latest attacks let spambots into Gmail.

CAPTCHA stands for "Completely Automated Public Turing test to tell Computers and Humans Apart." Typically image files, the challenge-and-response system has been fairly successful in preventing spammers from opening e-mail accounts on popular Web domains like Gmail, Yahoo and Hotmail. Those accounts are prized by spammers because Web administrators can't simply blacklist the popular domains.

Spammers have found ways to break CAPTCHAs, according to Stephan Chenette, manager of Websense Security Labs. "What we're seeing is the technology on the hacker side has surpassed the simple CAPTCHAs," Chenette told us. "In the public domain there are several tools available right now for everyone to use to break simple CAPTCHAs."

Human and Computer Attacks

Chenette said organized attackers are using automated tools to sign up for Gmail and other Web-mail accounts. When the CAPTCHA image appears, it's automatically sent off to a large and low-paid workforce, typically in another country, where a worker enters the code and sends it back so the account can be created.

This type of attack has been used against other Web-mail sites, Chenette said, but in the attacks on Gmail there's a new wrinkle. "One of the more interesting things about the Gmail CAPTCHA breaking is that we believe that this might be happening through an automated process, which is the next step to breaking CAPTCHAs as opposed to hiring a large workforce to break them," he said.

In fact, Chenette believes these are two-pronged attacks. The first uses the offshore workforce, while the second may rely on bot networks, large sets of compromised computers that work together for attackers. Websense experts can see how often CAPTCHAs are being broken, and for the Gmail traffic there's only a 20 percent success rate for one prong of the attack.

"It would be very odd if a human would fail one out of five times in understanding what that CAPTCHA was," Chenette said. "From that we conclude it's possibly a bot network with automated tools involved."

Most of the IP addresses and networks involved in these attacks are from the United States, Chenette said. But when he visited some of the Web pages, the text was in Russian, leading Websense to conclude that the authors -- who specify a pay rate of $3 per broken CAPTCHA -- are likely Russian as well. That wouldn't be a surprise. "In malicious activity in general, the U.S., Russia, China and Brazil are the top offending countries," he said. (continued...)

1  |  2  |  Next Page >

 

Tell Us What You Think
Comment:

Name:



You have the experience and skills, let an ISACA® certification demonstrate your value. Our certifications announce that you have the expertise and insight to speak with authority. ISACA certification is more than a credential; it's a platform that can elevate your career. Register for an Exam Today.


 Network Security
1.   Banks Hit by Android-Skirting Malware
2.   New Technology Defeats Privacy Efforts
3.   Juniper DDoS for High-IQ Networks
4.   Big DDoS Attacks Hit Record in 2014
5.   Can Google Stop Zero Day Flaws?


advertisement
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
34 European Banks Hit by Android-Skirting Malware
Criminals have been finding gaping holes in Android-based two-factor authentication systems that banks around the world are using. The result: 34 banks in four European countries have been hit.
 
New Web Tracking Technologies Defeat Privacy Protections
Recently developed Web tracking tools are able to circumvent even the best privacy defenses, according to a new study by researchers at Princeton and the University of Leuven in Belgium.
 
Juniper DDoS Solution Aims at High-IQ Networks
In the face of more complex attacks, Juniper Networks is boosting its DDoS Secure solution to help companies mitigate the threats with more effective security intelligence throughout the network fabric.
 

Enterprise Hardware Spotlight
Contrary to Report, Lenovo's Staying in Small Windows Tablets
Device maker Lenovo has clarified a report that indicated it is getting out of the small Windows tablet business -- as in the ThinkPad 8 and the 8-inch Miix 2. But the firm said it is not exiting that market.
 
Seagate Unveils Networked Drives for Small Businesses
Seagate is out with five new networked attached storage products aimed at small businesses. The drives are for companies with up to 50 workers, and range in capacity from two to 20 terabytes.
 
Another Day, Another Internet of Things Consortium Is Born
In the emerging Internet of Things, zillions of devices will be talking to each other. Samsung, Intel and Dell just formed a consortium to ensure each thing can understand what others are saying.
 

Mobile Technology Spotlight
Apple Patent for Smart Watch Comes to Light
Does a new smart watch patent issued to Apple provide a preview of the expected wearable from the tech giant? Some Apple-watchers are parsing the patent for signs of the coming product.
 
Will iPhone 6 Cannibalize Apple's Tablet Sales?
Could Apple’s iPhone 6 -- it’s so-called super-size phone due to hit store shelves this fall -- come back to haunt the smartphone maker? Some observers say yes; others say preposterous.
 
Axed Nokia X Phones Suffered from Lack of Identity
So long, Nokia X, we hardly knew you. The Nokia X phones Microsoft discontinued blend two rival operating systems, but leave out the best of each. As a result, the devices didn't become a runaway hit.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Cybercrime | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.