An idea for a twist on m7cn sec. - neverending captcha?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Master Baiter Joined: 14 Feb 2009 Posts: 209

Glorafilia wrote:

Actually, if someone wanted to go a step further, you could make up a website with passphrases that the baiter sets up. In order to get the MTCN, the scammer would have to answer a number of questions, such as

I like this spin on it. Or, you could make the questions rather simple and related to the bait (like the passphrase you give him), but make it so that when he answers the questions, the questions give a "CORRECT!" response, but the captcha fails.

So, he thinks its legit, and that he's answering the questions properly, its just those damnned letters are so hard to read!

Im trying to think of how to balance the scammer saying "Wait, this aint right, its completely random" and "I'm almost there!!!!!!"

Baiting Guru Joined: 04 Jan 2006 Posts: 3193

I love this idea.

Make it one captcha for each digit of the MTCN, with the first few being easy and then becoming gradually more difficult. Of course the last one is impossible; by that point it will be so ambiguous he wont know we're cheating. He can see the MTCN building on the screen, if he could only get those last four captchas right.

Of course, every time he makes a mistake, he's locked out and he has to start from the beginning.

Maybe this time he'll get all ten? Oops! Only five this time.

You want to keep him busy, so have the timeout counting down on the screen. First time 15 seconds and double it each time. If he logs in again, it just remembers that he has a lockout, and starts the period again. Oops maybe that's a bug, Western Union are looking at it. The only way to reset the time is to resend the money.... So you could take the boat over to the mainland and spend all day at the WU office, or he could just wait 2 hours like a good boy and get it right this time.

... Except, of course, the website logs him out automatically after an hour and a half.

Posted: Fri Feb 20, 2009 1:50 pm

I like this idea, you could also pad the pictures up a bit so they take a while to load. Clicky for more info Smile

Posted: Fri Feb 20, 2009 2:39 pm

Oh Joy:
http://www.captcha.cc/index.html?submit

I'm busy working on the garden tomorrow and already have plans for another baiting job on Sunday.

If no one else picks this one up I'll get on it when my time allows. I've already got it worked out how to do it in my head, it's just sitting down and making it.

Posted: Fri Feb 20, 2009 2:43 pm

www.captcha.cc wrote:

Hash algorithm used to secure your captcha.

I laugh now every time I see the word "Hash".

Not quite a Newb Joined: 12 Jan 2009 Posts: 55

leccy wrote:

That's a great idea Very Happy

It could be made so it fails all the time and tells you the error.. like the 2 was a Z or vice versa Laughing

Also symbols from the greek alphabet could be a nice addition.

I love this idea!! Every once so often (but not too often, perhaps every 3rd captcha code they try) have one character in the captcha that can usually only be accessed through character map or unicode, like æ, Ö, ж , ﻕ, Ω, ŏ... etc. Basically any character that is not immediately accessible on a nigerian keyboard. It should cause a lot of frustration.

Twisted Evil

Master Baiter Joined: 14 Feb 2009 Posts: 209

Now if we get this to work, the thing we'd have to convince the lad is that "I don't have the M7CN".

If they think we have it, but are making them jump through these hoops for "security", they'll just say "No, trust me, its okay, just send the M7CN through email, its fine, I promise, I don't lie, yada yada yada...."

So we'd have to make it believeable that the western union office did this. Maybe print out a transfer form, edit it, and where the M7CN line is, make it say "For security, please visit www.fakesite.com/m7cnretrieve.html"

We could also steal some scripts/dialogue from bank websites, paypal, etc, that say "You should NEVER send personal details by email, email is not secure, ....." you get the idea.

The scammers I'm sure are aware of all the "dont send crap by email" lingo, they'd totally believe it.

Master Baiter Joined: 12 Nov 2008 Posts: 104

I hate captchas thinking about them useing one that never works makes me feel all warm and sunny inside!???

Hello I'm New here! Joined: 14 Feb 2009 Posts: 6

I would suggest that you stick with the English alphabet and add in the German umlauts (ä and ö and ü), always ensuring that one of the three appears in every captcha. Smile

Captchas are 'easier' to read in lower case (i.e. 'i' or 'j') when you have the little dot at the top of the letter to guide you.

Hopefully two dots won't make it too confusing for the Lads.

Baiting Guru Joined: 04 Jan 2006 Posts: 3193

Creating the captchas is hard.

That link will get you captchas, Windy, but only of fixed difficulty.

Caveat: I don't do php or any other server-side scripting, but I can do Google.

Here's a perl plugable module for most of the hard work:

http://search.cpan.org/~jvanasco/Authen-PluggableCaptcha-0.05/lib/Authen/PluggableCaptcha.pm

but its render section is said to be proof-of-concept only. At least that cuts the work down somewhat.

Here's a renderer. I don't know if the two are compatible:

http://annocpan.org/?mode=search&field=Module&name=GD%3A%3ASecurityImage

If you prefer to work in PHP, here is a php module that seems to be very popular, is very short, and may be customisable to do what we want:

http://www.white-hat-web-design.co.uk/articles/php-captcha.php

Or this one is highly customisable:

http://www.phpcaptcha.org/captcha-gallery/

419Eater is my life Joined: 27 Jan 2009 Posts: 479

hoorah wrote:

make a site that has horribly impossible to read captcha code

done: http://recaptcha.net/

then abuse API: true=false, false=false
http://recaptcha.net/apidocs/captcha/
http://recaptcha.net/resources.html

.. ("nothing is ever true")

An idea for a twist on m7cn sec. - neverending captcha?	View next topic View previous topic