Spammers break BlogSpot CAPTCHA, load up on garbage sites

By Angela Gunn | Published November 7, 2008, 4:23 PM

The weary war against net scum continues, as Google's much-abused BlogSpot service finds its CAPTCHA tech hamstrung and malicious Web sites spread like stinkweed.

The October report from MessageLabs (PDF available here) confirms what blog aficionados had suspected for several weeks: Spammers have figured out a way to get around certain implementations of CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) and thus abuse BlogSpot as well as CAPTCHA-guarded e-mail services such as MobileMe.

Google's track record with CAPTCHA is not so impressive in recent months. A similar breach involving Google Sites' implementation turned up in MessageLabs' monthly survey back in July, and Gmail's CAPTCHA was popped back in February -- in part, as security researchers at WebSense discovered, because spammers utilized humans to supply the data that led to automated cracking abilities.

Before that, though, Google's use of the squiggly-word images for differentiating between spambots and humans was fairly effective -- in fact, as Google chose to implement it, more effective than that used by either Windows Live Mail or Yahoo.

With MobileMe cracked, spammers can diversify their approaches. MessageLabs spotted MobileMe addresses used to send recipients BlogSpot links, which in turn open onto sites for whatever foolishness is being spam-peddled, but they also saw MobileMe addresses used to trick social-network users into thinking they've gotten buddy requests. The "buddies" are of course fake -- but the pages they build on such sites at Bebo.com sometimes turn up in Google searches, thus propagating the problem.

Sites harboring malware, spyware and adware proliferated in October, with MessageLabs reporting an average of 5,424 new trouble sites every day. That's an increase of over 48% since September and may also reflect the CAPTCHA breakdown.

Comments

View comments by with a score of at least

so this is the reason why users are having a hard time posting comments in blogspot blogs.

btw. you are wrong @ Aires. visit my blog http://coolbusteratyourservice.blogspot.com and see for yourself that blogspot is not all porn.

Score: 0

|

Blogspot = amateur porn blog. It's basically the new Angelfire.

Score: 0

|

Google and everyone else should be using Mac OS X servers to prevent these types of attacks.

Score: 0

|

Troll

Score: 0

|

Troll

Score: 0

|

Yes, troll indeed.

To tell you the truth, as wonderful and beautiful as those Mac servers are, they are not going to bring peace to the internet tomorrow...
I'm sure the MobileMe servers are running Mac anyway...

Score: 0

|

don't feed the troll!!!

Score: 0

|

I guess if you use humans to read the CAPTCHA and route the requests though a bot network there is not much that can be done as the Turing bit does not detect malice...

Score: 0

|

Sure there is: charge a fee for the service. refund it in a year or x time. Problem solved?

Score: 0

|

PayPal is using this approach and I think this is a good solution - however, the "tax" for protecting the service goes to the custome rthis way.

my comments at http://www.commentino.com/orim

Score: 0

|

Microsoft's Ray Ozzie: 'Nobody's going to be 100% open'

The mobile apps ecosystems of the world may converge over time, led by apps being ported over across platforms, according to the Chief Software Architect.

Will Firefox beat IE9 to Direct2D rendering?

Just days after Microsoft executives gave conference attendees a peek at a new rendering technology, a Mozilla contributor revealed he's working on the same thing.

Where there's smoke: Apple warranty stance raises troubling questions

Carmi Levy | Wide Angle Zoom: Smoking can be dangerous not only for your lungs, it appears, but for your Apple hardware warranty.

The fallacy of Facebook privacy

Carmi Levy | Wide Angle Zoom: If an insurance company learns something interesting about its client through the Internet, is that snooping?

Microsoft 'worked with Apple' for Silverlight on iPhone, says Goldfarb

By not making such a big deal out of trying to stream video to the iPhone, Microsoft got a big deal out of it, revealed the Silverlight product manager.

Clicker.com cuts through the Web video chaos

In a world where homemade video and Hollywood movies travel the same pipeline, it's good to have a real search engine to cut through the clutter.

A case study in improving software: What Office 2010 can learn from Notion 3

A music composition product gambles with a complete overhaul, in an effort to make headway against two well-known competitors in a tough market.

Kindle 2 update adds battery life, native PDF reader

Amazon has pushed out an update to the Kindle 2 e-reader that lengthens battery life and adds a native PDF viewer.

Safari on iPhone gets competition from a $1 browser app

Apple likes to say it gives iPhone users a full browsing experience, but a new competitor tries to incorporate more desktop browser features.

Action Replay maker sues Microsoft for Xbox 360 'predatory technological barriers'

Third-party video game accessory maker Datel has filed an antitrust lawsuit against Microsoft over the Xbox 360's recent Dashboard update.