The background noise added to the audio
version of Google's reCAPTCHA didn't include high frequencies, making it
easy for spectograms like this one to pinpoint the six distinct words
included in each challenge.
Google revamped its reCAPTCHA system, used to block automated
scripts from abusing its online services, just hours before a trio of
hackers unveiled a free system that defeats the widely used
challenge-response tests with more than 99 percent accuracy. Stiltwalker,
as the trio dubbed its proof-of-concept attack, exploits weaknesses in
the audio version of reCAPTCHA, which is used by Google, Facebook,
Craigslist and some 200,000 other websites to confirm that humans and not scam-bots are creating online accounts. While previous hacks have also used computers to crack
the Google-owned CAPTCHA (short for Completely Automated Public Turing
test to tell Computers and Humans Apart) system, none have achieved
Stiltwalker's impressive success rate.
"The primary thing which makes Stiltwalker stand apart is the
accuracy," wrote Adam, one of the three hackers who devised the attack,
in an e-mail. "According to the lead researcher from the Carnegie Mellon
study, the system we attacked was believed to be 'secure against
automatic attack,'" he added, referring to this resume from a Carnegie Mellon University computer scientist credited with designing the audio CAPTCHA.
Stiltwalker's success exploits some oversights made by the designers
of reCAPTCHA's audio version, combined with some clever engineering by
the hackers who set out to capitalize on those mistakes. The audio test,
which is aimed at visually impaired people who have trouble recognizing
obfuscated text, broadcasts six words over a user's computer speaker.
To thwart word-recognition systems, reCAPTCHA masks the words with
recordings of static-laden radio broadcasts, played backwards, so the
background noise would distract computers but not humans.
What the hackers—identified only as C-P, Adam, and Jeffball—learned
from analyzing the sound prints of each test was that the background
noise, in sharp contrast to the six words, didn't include sounds that
registered at higher frequencies. By plotting the frequencies of each
audio test on a spectrogram, the hackers could easily isolate each word
by locating the regions where high pitches were mapped. reCAPTCHA was
also undermined by its use of just 58 unique words. Although the
inflections, pronunciations, and sequences of spoken words varied
significantly from test to test, the small corpus of words greatly
reduced the work it took a computer to recognize each utterance.
Enter the neural network
With the sounds isolated, the hackers then funneled each word into a
battery of mathematical solvers to translate the characteristics of each
isolated word into text that would solve the CAPTCHA puzzle. An early
version of the attack worked by using the open-source pHash software library
to generate a "perceptual hash" of each sound. Unlike cryptographic
hashes, which typically produce vastly different ciphertext when even
tiny changes are made to the plaintext input, pHash outputs vary
minimally when generated by similar-sounding words. By comparing the
perceptual hashes of the collected sounds to a table of hashes, the team
could make educated guesses about which words were being included in
the audio tests. But they ultimately scrapped the technique because its
level of accuracy didn't break 30 percent.
The hackers eventually devised a machine-learning algorithm that
produced significantly better results. Their neural network was seeded
with data from 50,000 reCAPTCHA utterances along with human-generated
input for each corresponding word. They then combined the tool with a
separate attack that exploited another weakness they discovered in the
audio version—namely its habit of repeating the same challenges verbatim
in pseudo-random fashion. By using cryptographic hashes to fingerprint
15 million of the estimated 25 million challenges in reCAPTCHA's
repertoire, their attack was able to crack most of the tests.
"The majority of the time, we can look at the challenge and not do
any computation at all," Adam said. "It takes less than a second to get
an answer with the MD5 solver."
Their attack became all the more effective after discovering that
Google's audio CAPTCHA accepted multiple spellings for many of the
challenges based on the approximate phonetic sounds of each word. As a
result, an audio test that included the word "boat" could be solved by
entering "boat," but it could also be solved by entering "poate."
Similarly, a test that included the word "plate" could be solved by
entering "plate," but it too could also be solved by entering "poate."
Tests for words that included "Friday," "fairy," or "four" were also
solved by entering "Friay." By fashioning the same alternate spelling
for a variety of different sounding words, the hackers could pare back
the number of guesses required to solve a specific puzzle, a technique
crackers call "reducing the keyspace."
In the end, the hackers said their computer-generated attack solved
17,338 out of 17,495 challenges they attempted, a success rate of 99.1
percent. At one point, the attack was able to deduce answers to 847
tests in a row before being tripped up. More details of the hack are here.
The Googleplex strikes back
About two hours before the hackers were scheduled to present the attack on Saturday at the Layer One
security conference, Google engineers revamped reCAPTCHA. Suddenly,
Stiltwalker, which the hackers had carefully kept under wraps, no longer
worked. Adam told me that he has no proof anyone tipped off Google
employees—but he doubts the timing was coincidence.
The updated reCAPTCHA system uses a human voice uttering
unintelligible sounds as background noise, making it impossible for
Stiltwalker to isolate the distinct words included in each audio
challenge. The puzzles have also been expanded from six words to ten
words and each challenge lasts 30 seconds, compared with only eight
seconds under the previous reCAPTCHA.
A Google spokesman declined to offer specifics of the reCAPTCHA upgrade beyond issuing a statement.
"We took swift action to fix a vulnerability that affected
reCAPTCHA," it said, "and we aren’t aware of any abuse that used the
techniques discovered. We're continuing to study the vulnerability to
prevent similar issues in the future. We've found reCAPTCHA to be far
more resilient than other options while also striking a good balance
with human usability. Even so, it's good to bear in mind that while
CAPTCHAs remain a powerful and effective tool for fighting abuse, they
are best used in combination with other security technologies."
While the changes stymied the Stiltwalker attack, Adam said his own
experience using the new audio tests leaves him unconvinced that they
are a true improvement over the old system.
"I could only get about one of three right," he said. "Their Turing test isn't all that effective if it thinks I'm a robot."
Most members of Anonymous would prefer to stay, well, anonymous.
But as the group has engaged in increasingly high-profile attacks on
government and corporate websites, doing so effectively and staying out
of harm's way have become an ever-growing challenge. To protect itself,
the group has altered its tactics over the past year to both increase
the firepower of its attacks and shield members from the prying eyes of
law enforcement.
In late 2011, members of Anonymous began to step away from their most
well-known weapon for distributed denial of service attacks. While some
in the group continued to try to get enthusiastic followers (or unwary webpage visitors) to use a Web browser version of the Low Orbit Ion Cannon attack tool, use of LOIC had led to the arrests of members of Anonymous and LulzSec last summer.
More cautious and technically skilled Anons started to use a collection
of other tools and security practices to both step up attacks and hide
themselves from being tracked. A message spread through Anonymous’ IRC
channels spells it out: “Do NOT use LOIC.”
How Denial of Service attacks work
Denial-of-service (DoS) attacks are aimed at blocking access by
outside users to a website or other Internet service. They usually do
this by either overwhelming one or more of the resources of the server
that hosts the website or application with traffic, or by disrupting a
network service that the server depends on.
The most common of these are "flood" brute-force attacks that aim to
overwhelm a server's network connections with a huge volume of requests,
consuming the network bandwidth of the server's connection, or filling
up the memory associated with the server application's network
connections, rendering them unreachable. Other types of attacks are
crafted to go after the applications themselves, and use specially
formed network requests to a server to exploit a function of its
software to crash it or make it stop responding.
A distributed denial of service (DDoS) attack
spreads the malicious requests to the server across many source
computers—often by using a "botnet" controlling hundreds of infected
computers, or in the case of Anonymous, by coordinating the efforts of
tens or hundreds of volunteer "activists" to launch attacks.
The attacks on the websites of the Justice Department and others in
the wake of the takedown of Megaupload.com were the first demonstration
of the power of LOIC’s successor—a DDoS tool called the High Orbit Ion
Cannon.
HOIC isn't exactly rocket science. At its core, it is essentially a
simple script for launching HTTP POST and GET requests at a targeted
server, wrapped in a "lulz" friendly graphical interface. According to
the documentation, it can be used to open up 256 attack sessions
simultaneously—either targeting a single server, or going after multiple
targets. The user can control the number of threads used per attack.
This rocket needs boosters
The code itself isn't that sophisticated. HOIC is written in Basic—or, to be more accurate, Real Software's Real Basic,
the cross-platform version of the language originally developed for the
Mac. The main power of HOIC is that it can be customized for each
attack target relatively easily without having to know how to code,
using "boosters," modules with additional bits of Basic code that are
interpreted at runtime.
HOIC’s boosters are used to tailor the HTTP requests sent by HOIC to
the target for a specific type of attack. ”HOIC is pretty useless,” the
documentation file that comes with the code says, “unless it is used in
combination with ‘Boosters.’” And that's putting it mildly—the attack
code is generated based completely on what's in the booster file. When
an attack is launched, HOIC compiles the booster to create the HTTP
headers to be sent, and sets the mode of the attack.
One approach commonly used in boosters is to create randomized
requests in an attempt to defeat any content delivery network (CDN) or
caching used to shield the server from traffic spikes. Some boosters use
lists of URLs within a target site, appending them to a table in memory
to be used by the attack thread:
The script also can include a randomized list of user agents,
referring sites and random headers that are fed into HTTP requests to
make the requests look more legitimate:
useragents.Append " Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6"
useragents.Append " Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)"
referers.Append " http://www.google.com/?q=" +URL
The booster script can also include parameters to set the volume of
the attack, and to switch between GET and POST requests. For example,
here’s the booster set up to attack a dynamic part of Visa’s webpage,
using POST, complete with a form submission to the target page:
While the scripts themselves can get fairly sophisticated in how
they’re configured, a generic booster file distributed with HOIC makes
it fairly simple for would-be DDoSers to build a custom booster for
their target of ire of the moment and distribute it via a shared
document site like PasteBin, Google Documents, or an Etherpad site. For
example, when a hungry Anon got upset about a late pizza delivery on
Valentine’s Day, he quickly shared a clip of Web addresses to start an impromptu DDoS on Pizza Hut.
The actual code that runs the attacks is executed as threads by a set of timers. ObjTarget.SendAttack is pretty straightforward:
'Creating the socket request
Dim httpObj as HTTPSocket
Dim i as integer
Dim reqSize as integer = 0
httpObj = New HTTPSocket
' Adding the headers generated by the booster
for i = 0 to Headers.Ubound
reqSize = reqSize + Headers(i).Len
httpObj.SetRequestHeader(Headers(i).Left(Headers(i).InStr(":")-1), Headers(i).Mid(Headers(i).InStr(":")+1, Headers(i).Len - Headers(i).InStr(":")))
Next
'For attacks wher POST has been chosen as the type of HTTP request
if(UsePost) then
reqSize = reqSize + PostBuffer.Len + 4 ' POST
httpObj.SetPostContent(PostBuffer, "application/x-www-form-urlencoded")
httpobj.Post URL
'For GET based attacks
else
reqSize = reqSize + 3 ' GET
httpobj.Get URL
end if
'Tracking how much data has been sent to the target
TotalBytesSent = TotalBytesSent + reqSize
But HOIC isn’t the only tool that Anons are promoting.
The old(er) bag of tricks
Despite its improved attacks, HOIC still points an arrow straight
back at the source of the DDoS. And some of the targets Anonymous’
various #Ops are going after aren’t suitable for straight-up HTTP
attacks. So there are two other tools that have been tossed into Anon’s
#Setup recommendations that aren’t exactly new to the security world: Hping and Slowloris, a pair of network security testing tools that also have the potential to be used for evil.
Hping is a TCP/IP "packet assembler and analyzer" initially developed and now maintained by Salvatore Sanfillipo, a Sicilian programmer. It uses a command-line interface similar to that of the ping
network utility, but it can do a lot more than make ICMP echo requests.
It can be used to throw high volumes of TCP requests at a target, while
masking the source of the attack through spoofing, as Anonymous’ tutorial shows:
### Normal hping DoS attack:
hping3 -S -i u100 riaa.org
### Spoofed random source address attack:
hping3 -S -i u100 riaa.org --rand-source
### Reflected attack(it looks like mpaa.org is DoS'ing riaa.org)
hping3 -S -i u100 riaa.org -a mpaa.org
Slowloris is a different sort of attack entirely—a
slow HTTP attack that uses partial HTTP requests to a server, making it
wait for more chunks of the request and slowly spooning them out to
keep the IP socket on the server open. This type of attack works best
against low-traffic sites on Apache and a variety of other Web servers
by eating up available network ports on the server. It’s ideal for
attacks on servers in places where there’s a concern about there being
enough bandwidth for a brute-force DDoS to succeed, or where there’s
concern about the collateral damage to other users on the same network.
That’s why Slowloris was used against Iranian servers during the
protests around the Iranian elections in 2009.
But Slowloris is not a tool for the masses. It requires Perl, and runs best on Linux. The author of Slowloris, known as RSnake,
said that Windows users “will not be able to successfully execute a
Slowloris denial of service from Windows…because Slowloris requires more
than a few hundred sockets to work (sometimes a thousand or more), and
Windows limits sockets to around 130, from what I've seen.”
However, a Python-based version of the exploit, PyLoris, gets around those limitations. It has a graphical interface, and can be used effectively from Windows; Christopher Gilbert, the developer of PyLoris, claims he’s tested PyLoris on Windows with "over 6000 connections, and [doesn’t] see why it couldn’t use more than that."
PyLoris also includes a feature called TOR Switcher, which allows
attacks to be carried out over the anonymized Tor Network and switch
between Tor "identities," changing the apparent location the attack is
coming from at user-defined intervals.
Used individually, these tools can be somewhat effective in slowing down many of the sites that Anonymous targets. But as Curt Wilson,
a researcher with Arbor Networks’ Security Engineering and Response
Team, said to Ars in an interview, "If you use volumetric floods on top
of specific application attacks [like Slowloris], it’s a pretty powerful
combination."
And just by the sheer number of attacking systems that Anonymous can
bring aboard to launch these attacks when its members and friends are
highly motivated—as in the wake of the Megaupload shutdown—even the most
basic of tools can cause problems for large websites.
Covering the trail
There is still the matter of being able to pull off these large
attacks with volunteered computers and keeping those volunteers
anonymous. While Hping can provide some obscuring of the source of an
attack, the other tools point straight back at their source. So Anons
have been eager to find ways to keep their IP addresses concealed.
The problem is that freely available anonymizing networks generally
aren’t up to the task of handling the bandwidth of DOS attacks.
Attempting to launch HOIC or other DDoS tools over Tor would amount to
an attack on that network itself—and on the Anonymous members who use it
to protect themselves. So with the exception of Slowloris and PyLoris
attacks, which demand relatively little bandwidth, the Anonymous edict
is “DO NOT DOS THROUGH TOR.”
Some Anons have turned to a variety of proxy tools—including a fairly
suspicious commercial software package called AutoHideIP, which claims
to anonymize users by connecting them through proxies for a one-time
fee, even selecting the country from which their IP address appears to
be located. Efforts by Ars to contact the creators of AutoHideIP,
Coolware Max, were unsuccessful.
But there’s reason to be suspicious of the security of proxy
services, and of other anonymizing services such as VPNs, because they
could be compelled by law enforcement to turn over traffic logs. That
was the case in the arrest of one alleged LulzSec member, who was
apprehended after VPN provider HideMyAss.com turned over log data that helped trace him to Arizona.
For that reason, Anonymous’ best-practice advice for members is to stick to Anonine and VPNTunnel, two paid VPN-based anonymizing services based in Sweden—where privacy laws don’t require providers to keep access logs (and in some cases prohibit it).
Both of the services are based on OpenVPN,
a GPL-based open source virtual private network technology available on
Windows, MacOS and Linux. However, as Anonine has expanded service
beyond Sweden, with servers available worldwide, some of its servers
have started to keep logs in accordance with local laws—so Anonymous’
members are warned to specifically configure their clients for Swedish
servers.
It's doubtful that everyone in Anonymous plays by these rules. And
that's probably a good thing for Anonymous, because it would pose a
strategic problem—all that authorities would need to do to deflect
Anonymous' attacks is to refuse connections from the blocks of IP
addresses assigned to these two Swedish providers. And with the European
Union considering new EU-wide regulations that would standardize
privacy rules across the continent, it's not certain how much longer
Sweden will be a safe haven.
