jdtoronto has asked for the wisdom of the Perl Monks concerning the following question:

Esteemed Monks,

I have a new client who has just been savagely attacked by a credit card fraud ring. His web site sign up forms were filled out by a robot of some type, then when the confirmation email was received it appears they responded automatically (it was a simple "click on this link" confirmation) and then they used another robot to make small puchases on credit cards (average of $3-$10) using what turned out to be thousands of stolen card numbers - all of which they have the CVV2 id for!

Luckily the payment processor turned off the system after about 15 minutes of this activity because of the dramatic change in the clients usage pattern. But in that time nearly 11,000 charges were made totalling just over $42,000 (US).

I have beefed up the security as much as I can this morning. We now require a full billing address which we validate with AVS (why didn't they have this?), an email address (to compare against known fraudulent transaction email addresses by the processor) and a phone number. We will also be using the MaxMind CCV service as soon as we can incorporate the code.

But these are all "after the signup" measures. I would like to add a graphical challenge, like PayPal use. Hopefully this would eliminate the robots.

Can anyone point me to any sample code, or modules for implementing this feature in Perl?

jdtoronto

  • Comment on Validating web-site signups are humans.

Replies are listed 'Best First'.
Re: Validating web-site signups are humans.
by dragonchild (Archbishop) on Mar 19, 2004 at 19:36 UTC
    merlyn had a column about this a few years back. A monk cracked it, but it shouldn't be too hard to extend it a bit. Doing a Super-search on "strawberry" (which was the flavor chosen for the hack) finds A little fun with merlyn, which should lead you in the right direction.

    Another option is to use a set of weird fonts. This is what's used in games like Runescape.

    ------
    We are the carpenters and bricklayers of the Information Age.

    Please remember that I'm crufty and crochety. All opinions are purely mine and all code is untested, unless otherwise specified.

[reply]
Re: Validating web-site signups are humans.
by Vautrin (Hermit) on Mar 19, 2004 at 20:29 UTC

    One of the things to look for when creating a spider or robot is patterns. For instance, if you want to submit a form, and the form uses the same name and values for each field and form name, it is very easy to create a spider to submit a form. If the form names vary, you have to look for sections of the HTML which are similar. If there is variation in the HTML which does not alter the lok of the page, things get very hard very quickly. Another thing that makes spidering very hard is if a lot of Javascript is used, because there are no modules to create a web page based on what the javascript says to do.

    These are some of the things that made my life very hard when a client asked for spiders which helped create a site that was a clone of AddAll.com. I would suggest using them to your advantage. Be devious. Use javascript like document.location = "http://www.newwebpage.com" to change locations in ways that a spider will have trouble keeping up with. Alter form names and the names of the input so that they contain random charachters (you can keep track of their real values in a database. Use a random key you can get from a cookie you send the user to look up what the real field names are)

    Chances are, if you do all these things, people will leave your site alone. Now, granted, many programmers / hackers -- given enough time and energy -- can overcome these problems. But by frustrating your attackers it is likely they will look for an easier target to pick on.

    Hope that helps,

    Vautrin

    Want to support the EFF and FSF by buying cool stuff? Click here.
[reply]
[d/l]
      Time and energy are completely unneccessary.Automating mozilla is trivial.
[reply]
        Interesting... I've never heard of automating mozilla. Can you please give an example or reference? Also does it work with Firefox?
[reply]
        Perhaps this is why some of the web sites that I have used work fine with Mozilla until I try to buy something. On one site I got a secure connection and was able to do everything with Mozilla except validate a credit card. Since I really wanted to buy the product, I called the toll-free number, which has always seemed to me to be a reasonable, albeit imperfect, alternative to otherwise broken ecommerce apps.

        I am interested in easy Mozilla automation, also. The API used for Mozilla regression testing looks complicated to me.

        It should work perfectly the first time! - toma
[reply]
Re: Validating web-site signups are humans.
by flyingmoose (Priest) on Mar 20, 2004 at 00:36 UTC
    GRAPHICAL CHALLENGES (CAPTCHA's) ARE EVIL

    While I understand the need to validate sign-ups are human, these CAPTCHA systems are horribly discriminatory towards blind or visually impaired users. Of course, to be fair, so are flash-only web sites. They can't read them, and they are blocked from using these sites.

    If your web site does not work in lynx/links, it probably doesn't work with a screen reader either -- and it is broken.

    You also need to consider the potential for color-blindness in users as well.

    I think it was once proposed that you could create riddles involving trivially simple problems (but ones that were not trivially parseable).. but that two has problems, particularly with non-native speakers or those that won't get your riddle. They would probably be annoyed. Seemingly good multiple choice question barrages like "which one of these animals lives in the ocean" seem effective, but you can code around those. And again, what if they don't have flounders in Outer Mongolia?

    I realize I am not solving your problem -- I'm only stating that CAPTCHA systems are a very bad idea.

[reply]
      The point you raise is valid.

      I have seen examples of CAPTCHA's now where they can be spoken. So provided the site is otherwise capable of being read using a screen-reader I would assume the visually compromised would be able to follow a link to the spoken challenge.

      I had another meeting with the client this afternoon. He has been told by the payment processor that either he addds CAPTCHA to the site, or they won't handle him any more. Sad, but that's just the way it is.

      jdtoronto

[reply]
Re: Validating web-site signups are humans.
by Jaap (Curate) on Mar 19, 2004 at 19:54 UTC
    Hmmm this is actually a very nice problem. I can think of quite a few approaches but they all require playing with some graphical modules (GD perhaps?)

    If i we're you, i'd roll my own solution. Even if that's easier to crack, the rewards are smaller than that of a system that everybody uses.

    The most basic approach would be to make an image of characters on a "grainy" background. You might even make the characters grainy too, so only the density of dots defines a letter.
[reply]
Re: Validating web-site signups are humans.
by calin (Deacon) on Mar 20, 2004 at 19:43 UTC
[reply]

Back to Seekers of Perl Wisdom