WebApp Sec mailing list archives

Re: Defeating CAPTCHA


From: Devdas Bhagat <devdas () dvb homelinux org>
Date: Mon, 5 Sep 2005 12:41:13 +0530

On 29/08/05 08:03 -0400, Derick Anderson wrote:
I'm sure there is a significant number of valid credit card numbers
floating around in the open, but it is not without bound. An open, free
system (which I am not against, by the way) allows spammers to create as
many accounts as they wish. Once they have to pay for it, even with
stolen credit cards, the availability of accounts drops into a much
smaller finite number. Besides, if I have your credit card number, why
bother using it to create a spamming account? I've already got free
money. =)

Think 419 scammer. I buy a domain, host it and spam using that domain.
It appears legitimate, and will not be immediately kicked off a host. 
Freemail accounts are terminated fast (not fast enough, but fast).

Think of a scammer using confirm-paypal.com instead of
http://some.free.host.example.com/user/confirm-paypal.html

The problem for us is that a smaller, finite number is still bigger than
we can easily and economically handle.

Devdas Bhagat


Current thread: