reCAPTCHA is Toast

Over the past six weeks or so, one o my email accounts has been flooded with spam advertising phony Internet “pharmacy” sites and penis pill sites.

It still blows my mind to this very day that people actually give money to these folks and actually believe they are getting real drugs, rather than corn starch and food coloring, in return, but that’s a whole separate issue.

The spam I have been getting differs from the ordinary, garden-variety junk “pharmacy” spam I get in that all of it advertises URLs belonging to social networking sites. Each URL is a phony profile of a bogus user, whose user information is nothing but a redirector to a spam site.

I’ve seen this happen before. Usually, it happens when some naive person decides to set up a niche social networking site of some sort, like a social networking site for professional engineers who work in Third World countries or a site for some obscure band or something, but doesn’t know anything about security.

The Russians love people like that. Nearly all Internet pharmacy sites, even (especially) the ones that claim to be Canadian, are run by Russian organized crime. The various crime gangs use bots–computer programs that automatically scan through hundreds of thousands of Web sites per day, searching for small social networking sites. When they find one, they attempt to create phony users. If they succeed, the bot software will start setting up thousands, or even tens of thousands, of bogus users, all automatically, and stuff those bogus user profiles full of ads for the phony pharmacy sites.

So you’ll end up with some Web site that’s dedicated to fans of some Brazilian soccer team or something, and it will have 27,498 users with names like “BuyCheapTramadolHere.” Whenever you visit the user profile page for the site, you get redirected to the fake pharmacy. The spammers then advertise the URL of the Brazilian soccer team site in their spam emails.

This is why it is absolutely essential that anyone who sets up a Web site that allows users to sign up and create profiles must, absolutely must, use some kind of system to prevent bot software from creating phony profiles.


Enter the CAPTCHA–those weird squiggly lines of text that you have to type in in order to fill out many Web forms. The idea behind a CAPTCHA is that a computer program can’t read the words, so computer programs can’t be used to fill out the form.

Organized crime has spent a huge amount of money and time in trying to figure out ways to break CAPTCHAs. Some of the most cutting-edge work in computer optical character recognition is coming from Eastern European organized crime. (Some Web services, such as Gmail, are worth so much to organized crime–mail sent from a Google mail server is almost never blocked by spam filtering software–that organized crime gangs have been known to pay unemployed Third Worlders a penny or so apiece to sit in front of a computer typing in CAPTCHA codes all day.) Another strategy that criminals have used to defeat high-value CAPTCHAs is to do things like set up phony Web sites offering free porn to people if they type in CAPTCHA codes first.

In the past, whenever I have received spam advertising a URL or a redirector hosted on a social networking site, the social networking site isn’t using a CAPTCHA. That makes it trivial for the spammers to create phony accounts to act as redirectors to their spam sites.

CAPTCHAs are such a mandatory part of good Web practice that there are businesses whose sole business is providing CAPTCHA generation software or services to Web owners. One such business is a company called reCAPTCHA, which provides free CAPTCHAs for Web site owners. Hundreds of thousands of Web sites, including many high-profile sites like Craigslist, use CAPTCHAs generated by reCAPTCHA.

And that’s where things get interesting.


Back to my inbox.

Like I said, it’s been flooded lately. I’ve seen literally thousands of bits of spam all advertising bogus profiles on various social networking sites.

Unsurprisingly, many of them are hosted by Ning, the failed and woefully insecure social networking platform cofounded by ex-Netscape cofounder Marc Andreessen, and which today seems to serve primarily as a platform for spammers (as I’ve detailed here). The URLs in the spam look like this:

http://scaryguy.ning.com/profiles/blogs/detrol-detrol-la-homeopathic
http://myjumpspace.ning.com/forum/topics/zocor-zocor-similar-products
http://igotittoo.ning.com/profiles/blogs/cialis-professional-cheapest
http://morecoffee.ning.com/forum/topics/acai-fit-com-now-foods-acai
http://onelion.ning.com/forum/topics/desyrel-buy-cheap-desyrel
http://tvsbrasil.ning.com/profiles/blogs/namenda-tapering-namenda-buy
http://cincinnatiown.com/profiles/blogs/omeprazole-marijuana-and

So in other words, about par for the course for Ning; it’s a sewer of spam, and since it recently fired most of its staff, it’s unlikely ever to improve.

But a lot of the other URLs I’ve been seeing aren’t hosted on Ning:

http://celexa108s.mysoulspot.com/
http://www.design21sdn.com/people/52077
http://community.sgdotnet.org/forums/t/28066.aspx

Those three sites (mysoulspot.com, design21sdn.com, and sgdotnet.org) have been hit particularly hard which each of them currently hosting literally thousands or even tens of thousands of spam profiles.

I visited these and other social networking sites that kept popping up in my spam, expecting to see that they were not using CAPTCHAs to protect themselves from bot software signups.

But that isn’t what I found at all. Instead, what I discovered is that every one of the sites I’m seeing that’s being attacked, including the Ning sites and the social networking sites not related to Ning, are using reCAPTCHA as their CAPTCH provider.

All of them.

Which suggests very strongly to me that reCAPTCHA has been busted. Organized crime has written, I suspect, software that is effective enough at breaking reCAPTCHA protection that it is effectively useless.

Engrish Spam of the Week

From my email inbox this morning, a bit of spam directed at my Symtoys address from a sex toy manufacturer:

Dear Owners

We are the Leading manufacturers-cum-exporter of complete Adult Body Jewelry like Nipple Rings, Nipple Weight Stretchers, Cock Rings.

We TRIUNE SKINMOD SUPPLIES exporting this Adult Body Jewelry successfully throughout the world. Your good-self kindly requested to please visit our web-site indicate items of your choice enable us.

The company in question is in Pakistan…and no, it isn’t the same company that has offered to sell me sex toys from Pakistan in the past.

Engrish: It’s what’s for breakfast

Over the past year or so, a goodly amount of the avalanche of spam that ends up in my inbox every day has been from companies in China that sell cheap, knock-off sex toys at wholesale prices.

Not too hard to figure out why. I’d be willing to bet that anyone who owns a Web site that talks about sex toys, or sells sex toys, gets ’em. They’re invariably from companies in China that want to sell me ripoffs of the Jack Rabbit vibrator and stuff like that, in bulk, at pennies on the dollar for the real thing. Their Web sites typically stay up for a few months and then disappear. (Got one of these spam emails in my mailbox today for a company whose Web site really inspires confidence: they have a hit counter on the front page, and as of right now the hit counter is at 4.)

That’s not the funny part, though.

The funny part is the Web sites themselves. They’re invariably written in Engrish, the particular variety of badly-translated English common amongst Far Eastern businesses who want to save money by not hiring professional translators.

The question I have, though, is does this approach work? How safe am I supposed to feel placing a $3,000 order for sex toys, when their Web site says things like “We are a professional and experience manufacture of condom products, lingerie, and sex toys for male uses and the female use. We have certificate for the condom. We have established the friendly relation with customers in USA. If you are interested in it, please don’t issue to contact us.”

How to Tell We’re In a Recession

All the old cockroaches are crawling out of the woodwork to feed.

Incredibly, unbelievably, I’m actually starting to see spam from two of the Web’s former most notorious spammers, streamate.com and webpower.com again. Old-school spam fighters will doubtless recognize these names–porn sites notorious for their spamvertising back in the day, who’ve kept a (relatively) low profile for years. I can remember being flooded under an avalanche of spam from these guys like five or six years ago.

Well, they’re back. Just a trickle now–an email advertising live sexy Webcams here, a set of cloaked redirectors that hop from server to server to server before ending up on Webpower there–and it makes me wonder if times are getting tough in the porn spam business. Maybe there’s some belt-tightening happening, folks aren’t buying as many subscriptions to pay-for-play Webcam sites these days, the owners of the sites are wondering how they’re going to make the payments on their Ferraris…who knows.

Webpower is a particularly interesting case, in that kind of yucky “I study cockroaches for a living because I’m fascinated by insects that eat their own young” kind of way. They started out making a gadget to allow remote control of sex toys over the Internet–a program you’d run and a little box you’d plug your vibrator into. The box had a suction cup that would attach to your computer monitor, and the program would flash a colored square on the monitor to send commands to the vibrator.

They got out of that business pretty quick–I don’t think anyone’s really made a profit on Internet controlled sex toys yet–and started doing porn Webcams instead. Their Web front page doesn’t suggest anything about them–just says “WebPower is an internet services and infrastructure company with offices located on both the West Coast (San Francisco bay area) and East Coast (South Florida)” with links to a “web services division” and a “web conferencing division”–but their bread and butter is live cam sex, and they’ve been in the spam business for almost as long as spam has been around.

It’s amazing to see this particular blast from the past. I haven’t been spammed by these guys since about the time I started dating Shelly.

Anyone familiar with an outfit called Suavemente?

So lately, my inbox has been flooded with an unusually large amount of spam This spam is advertising Web sites with URLs such as klhrvbhqw dot com, hyaiocgsk dot com, dcghffxba dot com, and ipwbquigi dot com — you know, nonsensical domains made up of random letters, usually a sure bet that it’s a throwaway spam domain the spammer plans to use once for a single spam run and discard.

All of these domains are hosted at the same ISP, an outfit I’ve never heard of before called Suavemente.

Now, two things about Suavemente scream “bulletproof spam host” to me. The first is they didn’t bother to register the .com; their only URL is suavemente.net. The second is that they’re headquartered in the US, but their front page proudly screams High-speed offshore. In the world of ISPs, “offshore” normally means “we allow our users to violate American law, safe in the knowledge that their servers can not be subpoenaed or subject to American jurisdiction.”

So at first blush, Suavemente stinks of “owned by spammers, run by spammers for spammers.” However, I can’t find them on the usual compilations of known rogue ISPs; they are listed in the ISP hall of shame, but that’s about it.

And they respond to abuse complaints. They don’t respond by shutting down their spammers, but they do respond nonetheless. Text and headers of an email I just received from Suavemente’s abuse department

Spam poetry

“Harry potter loves hottie lover, who loves mighty shocker poker.”

Spam for yet another penis pill site (are there really people in the world who honestly believe that taking a pill can make one’s penis bigger? For real?), but the poetry is quite nice.

Come, let me introduce you to my mighty shocker poker!

Bizarre spam, now in Russian!

So I get an enormous amount of spam every day. About half the spam I get is in Russian, with another quarter (half the remaining) in English. The rest is more or less evenly divided among Spanish, Polish, French, Hebrew, and Arabic, in more or less that order.

Every now and then, something truly bizarre lands in my email. Case in point: this Russian language image spam, which as near as I can tell is an advert for a company that makes the gigantic rectal probes used by space aliens when they abduct human females and anally examine them. Cut for not-work-safeness

Eat your spam…and LIKE IT!!!

So over the past two weeks or so, this journal has been under constant attack by LiveJournal comment spammers; I’ve been averaging about 2-5 pieces of spam a day, mostly for penis enlargers, “herbal Viagra,” and tooth whiteners, in comments to various posts.

Interestingly, all the spamvertised Web sites are hosted by the same ISP: Sago Networks, an American Web hosting ISP located in Atlanta.

I’ve emailed the abuse team at Sago Networks repeatedly. They refuse to take action against their pet spammers unless LiveJournal actually provides them with the LJ server logs showing the placement of the spam.

Now, here’s the interesting thing. Sago Networks is headquartered right across the street from my office. I mean that literally; right across the street. You can see their building from my front door; they’re a ten-second walk away.

I woke up this morning to still more comment spam, all of it hosted by Sago. If this continues, I think I’ll walk over there and ask them in person why they like hosting spammers so much. (Not like I don’t already know the answer: money. It’s profitable to host spammers, at least in the short run.)

I’m thinking of putting a Spam Supporter Hall of Shame on my Web site, listing pro-spam outfits like Sago and Pipex (who do not consider Usenet spam to be “spam,” and permit their customers to spam Usenet newsgroups with impunity) and the email exchanges I’ve had with them, so people who don’t like spam supporters can make informed decisions about who to host with.

[EDIT] The Sago facility across the street from me is their data center. Their corporate headquarters are (ready for this?) in Tampa, about five minutes from my old Tampa office. They’re stalking me!

Spam subject line o’ the Day

“Stupidly polygamy.”


I get a lot of spam. I mean a lot of spam. I know everyone gets a lot of spam, but I get a quantity of spam every day that’s just quite unreal.

About two-thirds of the spam I get is in Russian. Of the remaining spam, a good bit of it is in French, a lot of it is in Spanish, some of it is in German, some of it is in Chinese, a little bit is in Italian, a little bit is in Polish, every so often I get the odd occasional bit of spam in Hebrew (usually advertising a Web site I can’t make hide nor hair of but featuring expensive American electronics and watches with large bold prices and bulleted lists), and today I got my first spam in Arabic.

I was puzzling about that a while ago. Yesterday, I started working on a new page for my polyamory site, which lists all the mirrors of the page tat have been translated into other languages, and it clicked.

I did a Google search for my name in non-English languages, and found translations of my poly pages in Russian, French, Spanish, German, Italian, Polish, and Hebrew, each with an email link to my primary AOL address. This suggests that spammers are actually scraping email addresses from Web sites and taking note of the language tags in those Web sites, and selling the email addresses scraped from the non-English sites (probably at a premium) to people who spam in languages other than English.

Today’s Arabic spam puzzles me, though. I can’t find any mention of my name or email on any Arabic-language Web sites, at least not via Google.