We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Spam bots target Google's Blogger service

CAPTCHA defences defeated again

Spammers are using an automated method to create bogus pages on Google's Blogger service, again highlighting the diminishing effectiveness of a security system intended to stop mass account registrations, according to security vendor Websense.

The spammers are sending coded instructions to PCs in their botnets, or networks of computers that have been infected with malicious software, wrote Sumeet Prasad, a threat analyst, on Websense's blog.

Those sophisticated instructions tell PCs how to register a free account on Blogger. The spammers also figured out a way to solve the CAPTCHA (Completely Automated Public Turing test to Tell Computers and Humans Apart), the warped text that has to be deciphered in order to complete an account registration.

The compromised PC sends a request to an external host that tries to solve the CAPTCHA and then sends the answer back to the PC. Websense estimates the process has an 8 to 13 percent success rate.

It's unknown how exactly the CAPTCHA gets solved. It's been theorised the process has been outsourced to real humans who get paid for every one deciphered. But researchers have successfully developed methods that enable computers to increase their success rate at solving the puzzles, indicating that hackers have also figured out how to do it.

Security vendors and researchers have seen a rapid rise in accounts used for spam on free email services from Microsoft, Yahoo and Google, indicating current CAPTCHA technology has reached the end its usefulness.

See also:

Google's Gmail losing battle against spam

In this case, the Blogger pages created by the spammers are then used to promote the usual line of spammer goods. But many of those sites are rigged with JavaScript that redirects the browser to another spam website.

"Spammers include these redirecting accounts in different spam campaigns rather than including their actual spam domains," Prasad wrote. "Spammers use this tactic to defeat a range of antispam services."

In effect, they're using Google's Blogger domain as a shield, as it's unlikely to be blocked by other security software products for being a suspicious domain.

The latest methods means a potential increase in the number of garbage pages on Blogger. But the sheer number of Blogger sites on the whole helps the spammy ones stay under the radar a bit longer, Prasad wrote.

Google has been fighting spam for a long time on Blogger. It uses automated spam classifying algorithms to keep blogs full of spam links out of its featured content. Users can also use a reporting tool to alert Google to spam blogs, but the fight continues.


IDG UK Sites

Very best Black Friday 2014 tech deals UK: Latest bargains on phones, tablets, laptops and more...

IDG UK Sites

Black Friday feeding frenzy infects the UK

IDG UK Sites

VAT MOSS: Will I be affected by the EU VAT changes? Here are the facts for designers and artists

IDG UK Sites

Black Friday 2014 UK: Apple deals, Amazon deals & Black Friday tech offers