8/8/2019 CAPTCHA is Dead! Final

1/34

MatthewSopiars&SeanWhitley

8/8/2019 CAPTCHA is Dead! Final

2/34

Agenda

QuickhistoryofSPAM

InventionofCAPTCHA

HowspammersdefeatCAPTCHA

AlternativestoCAPTCHA Questions

8/8/2019 CAPTCHA is Dead! Final

3/34

GrowthofEmailSpam

Source: www.knowyourmeme.com

8/8/2019 CAPTCHA is Dead! Final

4/34

HistoryofSPAM

120BillionSPAMmessages/day 1.38MillionSPAMmessages/second

85-90%ofallemailssentgloballyareSPAM

Source: Sophos 2010 Security Threat Report

8/8/2019 CAPTCHA is Dead! Final

5/34

SPAM:SocialNetworks

57%ofsocialnetworkingusersreportreceivingspamviasocialnetworks

70%increasefrom2009

Source: Sophos 2010 Security Threat Report

8/8/2019 CAPTCHA is Dead! Final

6/34

SPAM:Classifieds&Blogs

93%ofallcommentsonblogsitesareSPAM

Source: Askimet

8/8/2019 CAPTCHA is Dead! Final

7/34

CostofSPAM

Potentiallossof: Brandreputation

Users

Money

Productivity

Bandwidth

8/8/2019 CAPTCHA is Dead! Final

8/34

CostofSPAM2009

$130Billion($42BillionintheUS)

Source: Ferris Research

8/8/2019 CAPTCHA is Dead! Final

9/34

InventionofCAPTCHA

8/8/2019 CAPTCHA is Dead! Final

10/34

CAPTCHA

InventionofCAPTCHA

Completely Automated PublicTuring test

to tell

Computers

andHumans Apart

InventedbyfourstudentsfromCarnegieMellonUniversityin2000

StopautomationofSPAM

Easytoscale

Cheaptoimplement

8/8/2019 CAPTCHA is Dead! Final

11/34

ApplicationsforCAPTCHA

WebmailServices Forums

Blogs

PreventingDenialOfServiceattacks Preventbulkaccountcreation/CommentSpam

8/8/2019 CAPTCHA is Dead! Final

12/34

WhyCAPTCHA

Spammersthriveonautomation SavestimeandMoney

CAPTCHAstopsbots

Isiteffective?

8/8/2019 CAPTCHA is Dead! Final

13/34

CAPTCHAsolvingsoftware

DeCAPTCHer PWNTCHA

CAPTCHAKing

8/8/2019 CAPTCHA is Dead! Final

14/34

CAPTCHARedirection

8/8/2019 CAPTCHA is Dead! Final

15/34

CAPTCHAoutsourcing

HumanCAPTCHASolving

LessthanapennyperCAPTCHAsolved

8/8/2019 CAPTCHA is Dead! Final

16/34

CAPTCHASolverJobOpenings

8/8/2019 CAPTCHA is Dead! Final

17/34

CAPTCHAOutsourcing

8/8/2019 CAPTCHA is Dead! Final

18/34

SPAMStudy

Used75,869accounts 26daysand350millionemails

Receivedaresponseonceevery12.5millionemails

28salesresulted

Revenue:$100/day

Source: UC Berkeley

8/8/2019 CAPTCHA is Dead! Final

19/34

SPAMROI

Scalelikeaspammer: 5,310,830accounts

Averagecost=$1per1000CAPTCHAssolved

$5,310.83cost

$7000/dayrevenue

Profit=$1689.17

Source: UC Berkeley

8/8/2019 CAPTCHA is Dead! Final

20/34

SPAMROI:WorstCase

Source: UC Berkeley

Allaccountsgetshutdowneachday

$1700DayProfit

$50,000ProfitsPerMonth

$610,000ProfitsPerYear

$5310.83DayCost

8/8/2019 CAPTCHA is Dead! Final

21/34

SPAMROI:BestCase

Source: UC Berkeley

$1700FirstDayProfit

$7000ProfitsPerDay

$210,000ProfitsPerMonth

$2,520,000ProfitsPerYear

$5310.83OneTimeCost

Noaccountsgetshutdown

8/8/2019 CAPTCHA is Dead! Final

22/34

CAPTCHAAdjustments

Mergingcharacterstogether Distortionandclutter

AudioCAPTCHA

HumanKnowledge-BasedQuestions VisualCAPTCHA

8/8/2019 CAPTCHA is Dead! Final

23/34

DifficultCAPTCHAs

8/8/2019 CAPTCHA is Dead! Final

24/34

DifficultCAPTCHAs

8/8/2019 CAPTCHA is Dead! Final

25/34

DifficultCAPTCHAs

8/8/2019 CAPTCHA is Dead! Final

26/34

CAPTCHAAlternatives

AudioCAPTCHA: Userisplayedacodeandmusttypeitin

Greatalternativeforvision-impaired

WorkswellforwhenaCAPTCHAistoughtosolve

Canbetrickywithdifferenthardware/softwarecombinations

8/8/2019 CAPTCHA is Dead! Final

27/34

ImageCAPTCHA

Namingimages DistinguishingImages

ClickableCAPTCHA

Machineshaveahard

timerecognizingimages

ImageMislabeling

8/8/2019 CAPTCHA is Dead! Final

28/34

KnowledgeQuestions

CanbebasicmathorBasichumanknowledge.

PronetoHumanError

A i S Pl I

8/8/2019 CAPTCHA is Dead! Final

29/34

Anti-SpamPlug-Ins

Freeplug-inforblogs,social-networks,etc Reviewscomments/wallposts

Returnsaqualityscoreorblacklistscorebasedonthequalityofthecomment

Userhasnomaintenanceordatabaseupgrading

Vid CAPTCHA

8/8/2019 CAPTCHA is Dead! Final

30/34

VideoCAPTCHA

PlaysavideooftheCAPTCHAthatneedstobecompleted.

Userthentypestheletterspromptedonthevideotocompletetheresponse.

Hardware/softwareissues

Ph V ifi i

8/8/2019 CAPTCHA is Dead! Final

31/34

PhoneVerification

Ourbreadandbutter Greatforwebmailproviders,socialnetworks,classifieds,etc.

Inreal-time,sendanautomatedcall/sms

Usereitherhearsorreadsaonetimecode

Theythenhavetotypethecodeintoyourwebsitetocompletethe

challenge. Quickerthanemailverification

Alsocanstopbulkregistrations

U F i dl

8/8/2019 CAPTCHA is Dead! Final

32/34

User-Friendly

QuickandSimple Guaranteedcallinlessthan10seconds

Userneverhastoleavethepage

Nosoftware/hardware

Usersareusedtophoneverificationbecauseofitsusebysomeofthelargestwebsitesintheworld

Ph V ifi d A t

8/8/2019 CAPTCHA is Dead! Final

33/34

PhoneVerifiedAccounts

Muchmoreexpensivetoacquireforthespammer

CutsdowntheROIforspammers

Extremelydifficulttoautomate

SpammerscanacquiremultipleVOIPnumbersatnocosti.e.Googlevoice/Skype

tomanuallycreateaccounts. PhoneID-blocksVOIP/PrepaidMobileNumbers

W U d Q ti

8/8/2019 CAPTCHA is Dead! Final

34/34

Wrap-UpandQuestions

SeanWhitleyBusinessDevelopmentManager800-850-3485ext807seanw@telesign.com

MatthewSopiarsVicePresidentofSales800-850-3485ext805matt@telesign.com

www.telesign.com

mailto:seanw@telesign.commailto:matt@telesign.comhttp://www.telesign.com/http://www.telesign.com/mailto:matt@telesign.commailto:seanw@telesign.com