mailing list archives
Re: Cantv/Movilnet's Web SMS vulnerability.
From: raven <locrideweb () libero it>
Date: Sat, 01 Apr 2006 02:48:18 +0200
Dear nosecualestunombre :P
rrecabarren () snsecurity com wrote:
The english not is my language too, so, i think that captcha not is a
good solution to leave spam or sms bombs from the internet.
What i write in my first mail (the first in bugtraq :P) is a first
solution that come to my mind to bypass the captcha problem.
I'm with you that is a unusefull to use many tricks like rotation,
different font size or whatever come to the programmers mind when you
use a little pool of numbers.
What you are talking about is "separability". You are pointing out that you can in fact separate what is good and what is garbage
from the picture . We do mention such a problem, but it is not the worst of it at all. The real problem with this implementation is that
the "challenge space" is too small. Let me explain this to you with a question:
What good is it to have a captcha with rotation, different fonts, deformation, and a background that does not allow
separation, if you can only generate a total of
3 pictures to challenge your users with??
It amounts to nothing. You could simply calculate the MD5 hashes (or choose a not so broken digest algorithm, "tiger"
if you want, i just cant get used to the sound of
"tiger hashes", but english is not my native language so what do I know?... ;-)) of those 3 images, and when later
challenged with one of them you will know
exactly what the right answer was. Now, if that number is not 3, but a 1000, same thing. If it is 10^6, same thing.
This is way too small.
He is a brute force solution. I've read many days ago what think w3c
about captchas and i agree with this document.
Not is better to do a solution with username and password to send sms ?
For example, CanTV dont pay for mensajes, so, why the interested user
not receive a sms with a alphanumerics digits for example, 10 that is a
little usefulness the brute force because [a-z] + [A-Z]+[0-9] is a
62!/(52!) that is a big number, for maxima, is 390.164.706.723.052.800
for example a oneday password to do it simple to remember.
I think that the CanTV policy about security not is so good not for
messages and nor for the servers. But this is another history :)
This technique, by the way, gives you 100% success rate whereas most OCR based solutions are bound to have some failure
rate greater than 0 due to their heuristic methodology.
You can think of this as the captcha's brute force technique. When it is better to brute force a captcha than to use
other techniques, you know there is a very
serious problem with that implementation and should change it as soon as you can... or at least implement additional
systems to protect your users.
Me too, but a good implementation of the captcha is better than nothing
for now, waiting that the security division and system administrators do
her work better.
Later i've used gocr with djpeg in pipe (see gocr -h to understand better) and i've obtained the famous number.
I've already writed a perl software to send sms to cantv mobiles and not is soo hard to implement this last operations,
but not is public this latest version because i do for myself.
This vulnerability was discovered by Ruben Recabarren and Leandro Leoncini
at SNSecurity's Research Lab.
Good work, to the advisors. But i think that everyone that have a not so insane mind can understand the CanTv stupidity
of this captcha implementation.
I am not sure about stupidity, but this is precisely why everybody is recommending third party security reviews as
mandatory policy for systems that are potentially dangerous to end users. This is the case with this vulnerability. I
have personal reports that users have had their mobiles totally fried because of these SMS bombs
Sorry for my bad english. The next time write in spanish (in private
mail ofcourse) :P
Thank you for your time.
I hope to talk with you more
- Re: Cantv/Movilnet's Web SMS vulnerability. raven (Apr 03)