2 ms·

Not really security-related, but one related "honeytoken" trick I have done in the past (for wikis, blogs, forum software, etc) is making account activation ema

by thorax 17y ago

Not really security-related, but one related "honeytoken" trick I have done in the past (for wikis, blogs, forum software, etc) is making account activation emails send a fake URL first in the body of the email that is clearly marked not to be clicked by humans as a bot trap. Then the real activation link is down below that, clearly marked as well. The majority of spambots and exploit worms, etc, just have a simple regex for parsing out the first "right-looking" link in the activation email to get their account activated. On one forum I dealt with, this caught 100% of the hundreds of spambots hitting the forum each month. Kind of interesting that bots can have some of the best captcha-guessing algorithms, but change up a little of the expected flow from the most common and you can quickly notice which visitors are bots or otherwise.

jrockway 17y ago
This works for five minutes until the bot-operator realizes the auto-activation isn't working, and writes 2 lines of code to fix the problem. Now you annoy legitimate users, but don't stop bots. That's good for your competition, but probably not so good for you.
- rantfoil 17y ago
  Only if you're digg, or Google Groups. Honeytokens work incredibly well for everyone else -- spamming is a game of finding easy marks. And there are enough easy marks out there that spammers would rather pack up and move on to the next target than deal with a determined engineer.
- thorax 17y ago
  Well, it's not what I recommend for major sites or businesses at all, but I can only tell you that this has worked fabulously on forums that get 1 million+ views a month and has been working for more than two years. I didn't expect it to be so effective, either. As rantfoil said, if you're Yahoo or GMail or some other major site, they'll fix their bot right away. Yet if you're at all below their radar, this is the sort of easy trick that can buy you some time for spam control replanning. This works great for web software that is constantly attacked by generic script kiddie bots. It's a good bit easier than switching entirely to a different system for blogs, forums, wiki, or CMS when your captcha is broken.

by thorax 17y ago

jrockway 17y ago

This works for five minutes until the bot-operator realizes the auto-activation isn't working, and writes 2 lines of code to fix the problem. Now you annoy legitimate users, but don't stop bots. That's good for your competition, but probably not so good for you.

rantfoil 17y ago
Only if you're digg, or Google Groups. Honeytokens work incredibly well for everyone else -- spamming is a game of finding easy marks. And there are enough easy marks out there that spammers would rather pack up and move on to the next target than deal with a determined engineer.
thorax 17y ago
Well, it's not what I recommend for major sites or businesses at all, but I can only tell you that this has worked fabulously on forums that get 1 million+ views a month and has been working for more than two years. I didn't expect it to be so effective, either. As rantfoil said, if you're Yahoo or GMail or some other major site, they'll fix their bot right away. Yet if you're at all below their radar, this is the sort of easy trick that can buy you some time for spam control replanning. This works great for web software that is constantly attacked by generic script kiddie bots. It's a good bit easier than switching entirely to a different system for blogs, forums, wiki, or CMS when your captcha is broken.