Subject: [Asrg] 2. C/R - Exploits

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 02 Feb 2004 09:10:51 -0500

[Was "Re: [Asrg] Its all over for Challenge Response", subject changed 
as per posting guidelines. Mod.]

Jon Kyme wrote:
>>Jon Kyme responds:
>>
>>>This is all getting silly.
>>>Numbers?
>>>Actual exploit?
>>
>>I say:
>>Does anyone still seriously doubt that spamming miscreants are using
>>third
>>party computers as their web, mail and DNS hosts? Jon? This is not a new 
>>phenomenon anymore.
>>
> 
> [many links snipped]
> 
> The point was about paying for puzzle solving with porn views.
> I'm still unaware of the existence of an exploit or a good discussion of
> the economics.
> 
> I'm not saying it's impossible, just currently in the realm of theory.
> 

The original news article is here, you can probably contact the 
journalist and ask:

http://www.post-gazette.com/pg/03278/228349.stm

Matt McCay of W3C who wrote the draft on Turing tests, might help as well:

http://www.bestkungfu.com/archive/?id=257

Yakov

-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"Be liberal in what you accept, and conservative in what you send" (Jon 
Postel)
-------

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Mon, 02 Feb 2004 15:18:34 +0000

> http://www.post-gazette.com/pg/03278/228349.stm

Thanks Yakov, I shall certainly do that. I'll let you know what I find out.

--

---

From: "Eric Dean" <[email-masked]>
Date: Tue, 3 Feb 2004 11:07:27 -0500

I'd be mildly interested to better understand the CRI exploits:
http://www.ietf.org/internet-drafts/draft-irtf-asrg-cri-00.txt

This document expires next month...there has been little to no
discussion nor interest of this draft (nor any others which I have
seen).  We are a research group that is to produce research for the IETF
rather than merely exchange ideas.

---

From: "Jon Kyme" <[email-masked]>
Date: Tue, 03 Feb 2004 17:01:15 +0000

> rather than merely exchange ideas.

Not specifically C/R - but following on from a previous thread, I'm trying
to track down the "porn-pay" CAPTCHA exploit.
I had a prompt and helpful response from Byron Spice,
I'm hoping to hear back from Luis von Ahn at CMU.  

Greg Mori of UC Berkeley Computer Vision Group has some pages oulining a
method used to break Gimpy, the CAPTCHA used at Yahoo!
http://www.cs.berkeley.edu/~mori/

I would guess the CRI draft needs some revision,
<strike>consent</strike> at least :-)

--

---

From: "Jon Kyme" <[email-masked]>
Date: Fri, 06 Feb 2004 10:21:48 +0000

> http://www.post-gazette.com/pg/03278/228349.stm

I've had helpful responses now from both Byron Spice (the author of the
article) and Luis von Ahn at CMU, and I'm happy to be able to introduce
some facts into the argument.

Luis was able to tell me this:
"The first mention that such an attack was possible comes from myself.
I thought of it at around early 2001 and told a few people about it. Some
time in 2002 I heard that one porn company was doing it for some time
against the Yahoo! CAPTCHA but that they had stopped. Ever since, all I
have heard is rumors that this happens, but I have not been able to see it
in real life."

Machine attacks are documented, for instance,
Greg Mori of UC Berkeley Computer Vision Group has some pages outlining a
method used to break Gimpy, the CAPTCHA used at Yahoo!
http://www.cs.berkeley.edu/~mori/gimpy/gimpy.html

There's a news article here:
http://www.siam.org/siamnews/11-02/gimpy.htm

I think the bottom line is that "easy" CAPTCHAs are likely to be vulnerable
to machine-based attacks. It's clearly possible that "hard" puzzles may be
susceptible to what Luis has called "Stealing Cycles from Humans" (or in
the case of the pay-with-porn approach, "buying cycles"), however, the
economics of this kind of attack have not been fully explored. We don't
have any firm evidence for an actual exploit "in the wild".

This is an issue for C/R schemes which assume that success solving an easy
puzzle assures us that there is a human "on the end". Getting a solution
for a hard puzzle might make us feel fairly secure, but the fact remains
that this input to our system is from an untrusted source, and can't be
relied on to establish trust beyond a certain level of confidence.

Regards,
Jon Kyme

--