4 ms·

When trying to detect ad fraud, one problematic scenario is that of replay attacks. It's basically when a scammer records human behavior on a site, and then rep

When trying to detect ad fraud, one problematic scenario is that of replay attacks. It's basically when a scammer records human behavior on a site, and then replays a mix of actual their sessions to fraudulently click an ad. The Quora answer is interesting but it's not clear to me whether the "I'm not a robot" box cannot be defeated in a similar manner.

deleted 8y ago
[deleted]
manifestsilence 8y ago
It seems like they make that hard by mixing semi-random elements that are different each time, like user interaction data, with the user's browser fingerprint and location. This seems to be why they go to such lengths to obfuscate the algorithm they use to combine these elements. If the pseudorandom and the fixed elements were easy to separate it would make replay attacks much more feasible.
amirhirsch 8y ago
I work on bot detection at hCaptcha.com. (Hiring: reach out if you want to apply machine learning to stop bots and help websites monetize their traffic without ads) In order to successfully execute a replay attack you would also need to pass the Turing Test, i.e. click the correct images. If you design a bot that starts a combinatoric attacking by trying random guesses we can easily confuse it, so most attackers try to use a solver service. We can also identify how you interact with semantic content in the images when you click on the image and characterize your mouse interaction as human or non-human. Since confidence increases as more results come in we can also run them after the initial pass and then shadow-ban bots. (And notify the targeted website that we have determined e.g. a particular signup is a bot.) Ultimately, many techniques beyond simple correct/not-correct are required to defend against the main attack vector: humans hired to solve captchas en-masse and make thousands of fake accounts. Modern ML is pretty effective for these kinds of problems. Browser obfuscation does not add real security, and today's reCAPTCHA (all versions) is easily defeated in practice.
- jammygit 8y ago
  This solution has more or less locked me out of certain accounts, except for when I want to spend a whole evening solving captchas in order to log in. I just don't use those services anymore, which means I've lost paid-for content that I'm practically locked out of.

deleted 8y ago

[deleted]

manifestsilence 8y ago

It seems like they make that hard by mixing semi-random elements that are different each time, like user interaction data, with the user's browser fingerprint and location. This seems to be why they go to such lengths to obfuscate the algorithm they use to combine these elements. If the pseudorandom and the fixed elements were easy to separate it would make replay attacks much more feasible.

amirhirsch 8y ago

I work on bot detection at hCaptcha.com. (Hiring: reach out if you want to apply machine learning to stop bots and help websites monetize their traffic without ads) In order to successfully execute a replay attack you would also need to pass the Turing Test, i.e. click the correct images. If you design a bot that starts a combinatoric attacking by trying random guesses we can easily confuse it, so most attackers try to use a solver service. We can also identify how you interact with semantic content in the images when you click on the image and characterize your mouse interaction as human or non-human. Since confidence increases as more results come in we can also run them after the initial pass and then shadow-ban bots. (And notify the targeted website that we have determined e.g. a particular signup is a bot.) Ultimately, many techniques beyond simple correct/not-correct are required to defend against the main attack vector: humans hired to solve captchas en-masse and make thousands of fake accounts. Modern ML is pretty effective for these kinds of problems. Browser obfuscation does not add real security, and today's reCAPTCHA (all versions) is easily defeated in practice.

jammygit 8y ago
This solution has more or less locked me out of certain accounts, except for when I want to spend a whole evening solving captchas in order to log in. I just don't use those services anymore, which means I've lost paid-for content that I'm practically locked out of.