1 Jun 2007 01:16
Re: What is causing this error?
julien tayon <deneg <at> ti0n.net>
2007-05-31 23:16:03 GMT
2007-05-31 23:16:03 GMT
Bruce <at> VLM Technologies a écrit : > I should also say that out of 30 domains this is the only one having this > issue, all the other domains work fine. > As a sysadmin that never used this plugin, I would check that the vlogin plugin version is compatible with the installed squirrelmail. I would check carefully that I have either an integrated version (debian/bsd) or a svn version. It makes a difference. If other squirrellmail with the same plugin were installed without any problem, I'd check installed version of both squirrelmail and vlogin on the working domains, vs the non working one. Then I'do a phpinfo in a test page and diff the result. (php.ini would be involved or php_admin_flag in apache) Then I'd first do a diff of the working/non working dirs with the vlogin plugins (always checking the easier one first), than the squirrelmail src dir I would expect no difference except in the config for the domains. If all was still equal I would check my httpd conf in case there are some fancy stuff automagically added, and then I would check for .htaccess files. Does it help ?(Continue reading)
>
> I was seeing how one can break captcha with a captcha sort of site. My
> mind was running to fast. Let me explain 1) the principle 2) the
> algorithm, 3) why it can work.
>
> For instance, given a xxx website with sufficient hit/seconds, this site
> could use a captcha picture from a distant website and grant access to his
> website when and only when the copied captcha result has been validated by
> a bot on the distant website.
> You then can use human to feed bots and break captcha with a captcha
> mimetic mechanism. (see below)
>
> This will have all the more probability to happen that captcha is widely
> used. Since the ratio gain/cost will increases, given that the only cost
> is writing the code once.
>
> Algortihm to break captcha using an external website :
>
> human X connect to my xxx site (predator)
> xxx web site trigger a bot on an external yyy web (victim) page protected
> by captcha
> while [ bot hasn't broken captcha ]; do
> get image
> present a CAPTCHA webpage with the external picture to decipher
> show it to human X
> ask X for result
> bot submit result to site yyy
> check that that bot can enter yyy
> done
> Grant X access to my site xxx
>
> It is not very sophisticated but this way you can break captcha.
This is a known approach supposedly used by some pornographic sites.
However, whether or not a certain CAPTCHA implementation is subject to
this hack depends on how it is implemented. I have finished a
SquirrelMail CAPTCHA plugin (Kerem, you can integrate your CAPTCHA as
one of its backends when you're ready), and luckily, the way
SquirrelMail uses the CAPTCHA, it is perfectly acceptable to throw
away the CAPTCHA code (correct answer) *every* time the user tries to
log in (whether or not the attempted CAPTCHA response was correctly
entered).
That means that in your scenario, the code that the bot was trying to
crack would have to be different for *every* crack attempt, *in
addition* to the fact that the bot would still have to do something to
try and guess the username and password.... and I think that's too
many variables to make that a viable approach. Additionally, the
lockout plugin could be used to simply deny access for anyone who
fails too many times in a row.
The better approach for the hacker IMO would be to get ahold of some
of the packages out there that can successfully pull apart some types
of CAPTCHA images.
- Paul
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
RSS Feed