My Board

Spammers' bot cracks Microsoft's CAPTCHA

By Gregg Keizer

February 7, 2008 ([url=\"http://www.computerworld.com/\"]Computerworld[/url]) Spammers are using a bot to sidestep barriers that Microsoft Corp. has erected to keep scammers from creating massive numbers of accounts on its Live Mail service, a security researcher said today.

Dan Hubbard, vice president of security research at Websense, Inc., said the bot was designed to break CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart) defenses, the distorted, scrambled character codes that many Web services use to block automated registration of hundreds or thousands of accounts at a time.

The bot, said Hubbard, grabs the CAPTCHA -- which is not plain text but actually an image -- and sends it back to the spammer's server, where the image is somehow "read" and a clear text match is generated. The text is then sent back to Live Mail, where it's plugged into the box where users normally type the CAPTCHA characters.

On average, the bot returns the correct response 30% to 35% of the time and successfully creates an account, Hubbard claimed.

...[i][url=\"http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9061558&source=NLT_VVR&nlid=37\"]read the rest of the article[/url][/i]...

Suppose it was only a matter of time before it was done; in away I'm surprised it's taken this long.

It's a pretty low percentage rate for getting the code correct though, but I'm sure if you send a couple thousand bots at a time that percentage rate seems a lot higher lol.

i knew there would be a way to do it, and i thought it would have came a lot sooner... its kind of neat at the same time but the percentage is very low also.

There was an article yesterday...somewhere... warning about a rise in gmail-based spam emails due to the number of bots which have cracked the code. The code-cracking isn't just a problem with spam, however. I read another article yesterday in a local paper about ticket scalpers who have cracked the code on TicketMaster's site, making it very difficult for normal people to purchase the good tickets. The scalper computers are even time-synced to the TicketMaster network and as soon as they're online, they start through the ticket purchase process. They're getting around the purchase limits by having several different credit cards with different "ship-to" addresses in each instance of the purchasing script.

So I'm sure that we need to come up with a new technology that will fight against things like this. I've noticed that concerts for ticketmaster for bands that aren't very known are slowly getting harder to get tickets for them because I suppose this is from those stupid bots...

bah... stupid people using this stuff against innocent people like me <img src=\'http://www.killanet.net/forum3/public/s ... #>/cry.gif\' class=\'bbc_emoticon\' alt=\':(\' />