NB:THIS IS INFORMATION IS SOURCED FROM ANOTHER SITE
How Hackers Can Use Their Victims for More Than Just Computing Power
So I had an interesting idea when a friend of mine asked what a hacker could use a botnet for.
I gave the casual responses like using bots for DDOS attacks, Bitcoin mining, and perhaps ad impressions. Basically anything that a computer can do without human interaction a botnet can do on a larger scale.
But then I thought what if a hacker used the human part of the botnet to complete his work? What if the hacker needed humans to complete his diabolical plan? Could you really use humans to power your botnet?
I’d say you could, and what is one thing humans beat computers at?
Of course the answer would be CAPTCHAs, a system designed purely to stop spam bots from abusing services across the internet.
mage from http://xkcd.com/632/
It’s really a genius system when you think about it, but if you’re not aware this is how it works in simplistic terms:
So basically Google has scanned images of book pages that need to be turned into plain text. The best OCR out their cannot do it so they need humans to do it for them. But that’s expensive, and in a very innovative solution they now use sections of these book pages to use as an anti bot system. So in return for blocking automated bots from abusing people’s services, Google gets endless free human OCR.
Sweet deal huh?
So sweet that services have emerged to solve these CAPTCHAs cheaply for people who run spam/bot services that need to bypass these CAPTCHAs.
This is a CAPTCHA solving service that charges low rates to get these
roadblocks solved for anyone with Paypal, Credit/Debit Cards, or many
other payment gateways.
How do they do it? Cheap labor, and lots of it! They even force you to pay more at certain hours when their workers will be normally asleep so that they can attract more people to the night shift.
Not only that but they offer the service pretty cheaply, just take a look at their rates! Have 5,000 CAPTCHAs solved for only $6.95!
But I’m getting a little off topic here, the point is, humans are a much needed commodity in today’s shifty digital market. CAPTCHAs need to be solved and their are many people willing to pay money to have them solved.
So, the idea came to me that it shouldn’t be to hard to build a botnet that forces people to solve CAPTCHAs for you. Some malware convinces people to buy MoneyPak cards in order to get their computer working again so perhaps that sort of strategy could be used? But what would be a believable scenario where somebody would be forced to solve a CAPTCHA image?
I remember back to a crazy incident where Comcast (an ISP) started injecting Javascript into pages over HTTP. This is horrific for so many reasons but it’s completely true.
Not only were they injecting Javascript but they were doing it with poorly made Javascript which would no doubt break many pages that it was injected into. So we know that an ISP or two is willing to do dirty things such as this so why wouldn’t they also force people to verify that they’re human and not abusing Comcast’s precious internet service?
Disclaimers:
I gave the casual responses like using bots for DDOS attacks, Bitcoin mining, and perhaps ad impressions. Basically anything that a computer can do without human interaction a botnet can do on a larger scale.
But then I thought what if a hacker used the human part of the botnet to complete his work? What if the hacker needed humans to complete his diabolical plan? Could you really use humans to power your botnet?
Of course the answer would be CAPTCHAs, a system designed purely to stop spam bots from abusing services across the internet.
Obligatory XKCD Comic
It’s really a genius system when you think about it, but if you’re not aware this is how it works in simplistic terms:
reCAPTCHA is a free CAPTCHA service that helps to digitize books, newspapers and old time radio shows.Source: http://www.google.com/recaptcha/learnmore
So basically Google has scanned images of book pages that need to be turned into plain text. The best OCR out their cannot do it so they need humans to do it for them. But that’s expensive, and in a very innovative solution they now use sections of these book pages to use as an anti bot system. So in return for blocking automated bots from abusing people’s services, Google gets endless free human OCR.
Sweet deal huh?
So sweet that services have emerged to solve these CAPTCHAs cheaply for people who run spam/bot services that need to bypass these CAPTCHAs.
How do they do it? Cheap labor, and lots of it! They even force you to pay more at certain hours when their workers will be normally asleep so that they can attract more people to the night shift.
We rely on a workforce that is mostly located in South Asia and South-East Asia. The Nighshift Worker Compensation is intended to increase the amount of workers online during their nighttime, thus, increasing the overall capacity of the service. Please read here for more information.Source: http://deathbycaptcha.com/user/faq
Not only that but they offer the service pretty cheaply, just take a look at their rates! Have 5,000 CAPTCHAs solved for only $6.95!
But I’m getting a little off topic here, the point is, humans are a much needed commodity in today’s shifty digital market. CAPTCHAs need to be solved and their are many people willing to pay money to have them solved.
So, the idea came to me that it shouldn’t be to hard to build a botnet that forces people to solve CAPTCHAs for you. Some malware convinces people to buy MoneyPak cards in order to get their computer working again so perhaps that sort of strategy could be used? But what would be a believable scenario where somebody would be forced to solve a CAPTCHA image?
I remember back to a crazy incident where Comcast (an ISP) started injecting Javascript into pages over HTTP. This is horrific for so many reasons but it’s completely true.
Not only were they injecting Javascript but they were doing it with poorly made Javascript which would no doubt break many pages that it was injected into. So we know that an ISP or two is willing to do dirty things such as this so why wouldn’t they also force people to verify that they’re human and not abusing Comcast’s precious internet service?
Meet the Comcast Anti Abuse Service:
Hard to believe I’m not a graphic designer huh?
After some (very bad) coding in Visual Basic I made a slick proof of
concept on what a CAPTCHA botnet would look like (or what I imagined it
to be). This malware is not very advanced and you could easily kill it
if you wanted to, the real thing I’d imagine could detect your ISP and
serve up logos/messages accordingly. It’d be even better if it could
detect if you were using a web browser and only popup then – or better
yet disable your browser until you enter in a CAPTCHA image.Click Here to Download the Full Source
Disclaimers:
- This was not made to be ACTUAL
malware, DO NOT message me and tell me it’s poorly made. I am aware, it
was NOT designed to be actually used – the control panel is actually
vulnerable to tons of exploitation. I am OK with this because if someone
actually decides to use this software I hope that they do get hacked
(no offense, but I hate removing this type of malware off of my
relatives computers!)
- The use of the Comcast Logo is protected under the Fair Use clause stating “the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes;”. The ideas represented fictionally here are not those of the Comcast company as a whole. If their are any issues feel free to contact me at mandatory (at) gmail dot com. Thank you.
No comments:
Post a Comment