Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Yahoo CAPTCHA Hacked

Posted by kdawson on Tue Jan 29, 2008 07:44 PM
from the leap-and-frog dept.
Security Spam
Hell Yeah! reminds us of a 2-week-old development that somehow escaped notice here. A team of Russian hackers has found a way to decipher a Yahoo CAPTCHA, thought to be one of the most difficult, with 35% accuracy. The Russian group's notice, posted by one "John Wane," is dated January 16. This site hosts a rapidshare link to what looks to be demonstration software for Windows, and quotes the Russian researchers: "It's not necessary to achieve high degree of accuracy when designing automated recognition software. The accuracy of 15% is enough when attacker is able to run 100,000 tries per day, taking into the consideration the price of not automated recognition — one cent per one CAPTCHA."
+ -
story

Related Stories

[+] Defeating Captcha 430 comments
An anonymous reader pointed us at PWNtcha, a package that breaks various on-line captcha algorithms. The site provides numerous examples of easy (Paypal, and an older version of Slashdot make the list) and hard Captcha. It also links various sources explaining why Captcha is a bad idea.
[+] Have Spammers Overcome the CAPTCHA? 330 comments
thefickler writes "It appears that spammers have found a way to automatically create Hotmail and Yahoo email accounts. They have already generated more than 15,000 bogus Hotmail accounts, according to security company BitDefender. The company says that a new threat, dubbed Trojan.Spammer.HotLan.A, is using automatically generated Yahoo and Hotmail accounts to send out spam email, which suggests that spammers have found a way to overcome Microsoft's and Yahoo's CAPTCHA systems."
Submission: Yahoo CAPTCHA hacked by Anonymous Coward
[+] Technology: Some Anti-Spam Vendors Blocking and Slowing Gmail 163 comments
fiorenza writes "Google's Gmail (and corporate mail) are being throttled and sometimes blocked by some anti-spam services, including MessageLabs and Antigen. Ars Technica reports that the blocking is a result of the Google CAPTCHA crack, which has allowed a deluge of spam from Gmail's clusters. Most users won't get blocked mail, but Ars confirmed with MessageLabs that Gmail delivery delays are to be expected."
[+] Technology: Windows Live Hotmail CAPTCHA Cracked, Exploited 362 comments
eldavojohn passes along what may be the last nail in the coffin for CAPTCHA technology. Coming on the heels of credible accounts of the downfall of first Yahoo's and then Gmail's CAPTCHA, Ars Technica is reporting on Websense Security Labs' deconstruction of the cracking and tuning / exploitation of the Live Hotmail CAPTCHA. Ars calculates that a single zombie computer can sign up over 1400 Live Hotmail accounts in a day, and alternate account creation with spamming. Time to dust off Kitten Auth?
[+] Fallout From the Fall of CAPTCHAs 413 comments
An anonymous reader recommends Computerworld's look at the rise and fall of CAPTCHAs, and at some of the ways bad guys are leveraging broken CAPTCHAs to ply their evil trade. "CAPTCHA used to be an easy and useful way for Web administrators to authenticate users. Now it's an easy and useful way for malware authors and spammers to do their dirty work. By January 2008, Yahoo Mail's CAPTCHA had been cracked. Gmail was ripped open soon thereafter. Hotmail's top got popped in April. And then things got bad. There are now programs available online (no, we will not tell you where) that automate CAPTCHA attacks. You don't need to have any cracking skills. All you need is a desire to spread spam, make anonymous online attacks against your enemies, propagate malware or, in general, be an online jerk. And it's not just free e-mail sites that can be made to suffer..."
[+] Now Even Photo CAPTCHAs Have Been Cracked 340 comments
MoonUnit writes "Technology Review has an interesting article about the way CAPTCHAS are fueling AI research. Following recent news about various textual CAPTCHAs being cracked, the article notes that a researcher at Palo Alto Research Center has now found a way crack photo-based CAPTCHAs too. Most approaches are based on statistical learning, however, so Luis von Ahn (one of the inventors of the CAPTCHA) says it is usually possible to make a CAPTCHA more difficult to break by making a few simple changes."
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Yahoo CAPTCHA Hacked 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • I thought those things were already broken (Score:5, Funny)

    by Anonymous Coward on Tuesday January 29 2008, @07:48PM (#22229426)
    by having a teenage boy do it in exchange for letting him see porn.

    • Re:I thought those things were already broken (Score:5, Insightful)

      by 2.7182 (819680) on Tuesday January 29 2008, @08:31PM (#22229796)
      I think the parent is serious. The idea is that your robot goes and grabs the images that needs to be decoded. Then on another website, it is presented and you can see free porn if you type in the word. I've heard of this but never read about it. Sounds like a good idea. Anyone know what this is called or some references ?

    • Re:I thought those things were already broken (Score:5, Interesting)

      by kesuki (321456) on Tuesday January 29 2008, @09:29PM (#22230268) Journal
      that's why it costs 1 cent per 1 captcha, the overall cost of webhosting the porn for exchange boils down to 1 cent per solved captcha. obviously, if you're hosting on root-kited windows boxes in the us (the highest rate of infection is in the us) the cost is still about 1 cent per one captcha because the cost of paying hackers to keep a bot net sizable enough comes to about the same cost.

      especially with sp3 coming out now, the cost of bot nets is higher, since sp3 offers a 'easy' bot net removal path, since staying off-line long enough to get all sp2's flaws patched is crucial in preventing reinfection. believe me, having a root-kit installed is easy even for a veteran computer guy to miss.

      i have dvd's i burned almost 3 years ago that reinfect any windows machine with a root-kit, and are un-readable in linux, apparently the root-kit was using some hooks in nero burning rom to 'randomly' pick a burn project and put the root-kit installer on there so when windows tried to auto run it would install the root-kit, then show the 'window' that normally shows up on auto-run would show up. the rootkit took an 'extra' session, that was transparent, eg: it would only show using burning software to read the track data, for the burned cd or dvd. no additional files showed up in windows, but the extra session made it unreadable to linux.

      also, the root-kit only runs in a 'blank' screen saver, which it protects and makes sure loads when the system is idle, so it never sends data when the user might be there to notice. and i think it sends the data as like, internet explorer, to bypass firewall rules. since none of the firewalls i tried could block it. i actually only found the original root kit when a second root-kit moved the first root-kit's files to the recycle bin. other than that none of the root kit scanners that were recommended to me could even detect this thing. only the 'symptoms' and the fact i could 'remove them' by staying off-line and not using my old discs were proof that i had a root kit.

      symptoms included, auto-run becoming disabled, screen saver always resetting to 15 minutes (only when both root-kits were on there), and the 'desktop' showing up 2-3 times a day when in full-screen games (also only with both root kits), and finding root-kit files in recycle bin(only found on networked systems with the root kit, and didn't return on reinstall of both root-kit, likely was a 1 time 'bug' that was fixed later on)

      so yeah, I didn't notice it for 3 years. Not that i usually have to deal with virus, but in the past I had only ever had to deal with 3 virus and in my 15 years online. and the third one was really a root-kit. I've also been using open-source software for 11 years, so that probably helped, of course, one of the virus was one that affected my open source software, the other 2 were windows based.

      it's still easy to miss windows root-kit's nowadays, especially when hackers have root-kits that aren't published, and they use scripts to make the exe's have unique signatures (using compiler tricks) for known root-kits.

  • Hey (Score:5, Funny)

    by Misanthrope (49269) on Tuesday January 29 2008, @07:49PM (#22229440)
    They're used to seeing Cyrillic, the captcha has got to be easier to read!

    • Re:Hey (Score:5, Interesting)

      by Janek Kozicki (722688) on Tuesday January 29 2008, @10:15PM (#22230548) Journal
      The 3D captcha [spamfizzle.com] seems to be a good solution here (that's a link from wikipedia article [wikipedia.org])

      You pick several 3d models, like people, chairs or flowers. Name all their parts, like "chair leg", "human head" etc. The CAPTCHA is generated by placing a several 3D models randomly rotated on a scene and rendering them with easily readable letters "A", "B" placed on the named parts. The captcha questions are: "what is the letter on human head", "what is the letter on chair leg", etc..

      People can answer pretty easily. The 3D models are always randomly placed and rotated on a scene, so bots have a problem.

  • Not really news (Score:5, Insightful)

    by Anonymous Coward on Tuesday January 29 2008, @07:49PM (#22229446)
    A few months ago Yahoo introduced a CAPTCHA to prevent bots entering their chatrooms. Within a few days every room on yahoo was filled with bots once more, and still are to this day.

    Given the current situation of the chat rooms on yahoo, it comes as no suprise at all that the other parts of the Yahoo system are inadequately protected from bots either.

    • Re: (Score:3, Interesting)

      by ookabooka (731013)
      Heh, yeah. . . .I used to hook up my computer using Rybka to yahoo chess. I played against other bots, other players(always a glorious win), and tolerated the unending spam from other bots that would just want you to go to some porn website. Eventually, they instituted a CAPTCHA. . .Oh noes, my bot was broken. Turns out I could just manually enter the CAPTCHA and grab the session ID info before the applet loaded and forward that manually to the bot. Once I'm "logged in" with the bot, it's no big deal. Point
  • What other tough AI problems can we foist onto spammers? People who buy V1agra through email ads could be the single largest source of computer science research "grants."

    • Re:Gentlemen, start your spambots (Score:4, Insightful)

      by xaxa (988988) <slashdotNO@SPAMsymbiote.eu> on Tuesday January 29 2008, @07:58PM (#22229522) Homepage
      Natural language processing etc:

      To register, answer these questions and click the button on the right
      What colour are buses in London?
      What is three times three?
      [Red] [Green] [Blue]

      • Re:Gentlemen, start your spambots (Score:5, Funny)

        by SoupGuru (723634) on Tuesday January 29 2008, @08:02PM (#22229574)
        That reminds me of the age check for Leisure Suit Larry back in the day... Who knew that the desire of a horny teen to see pixellated boobs would lead to history research?

      • Re:Gentlemen, start your spambots (Score:5, Insightful)

        by paeanblack (191171) on Tuesday January 29 2008, @08:08PM (#22229630)
        To register, answer these questions and click the button on the right
        What colour are buses in London?
        What is three times three?
        [Red] [Green] [Blue]

        Yes, those are undoubtedly hard questions for a computer. How, exactly, do you plan to generate billions of these questions? For a CAPTCHA to work, it must still be hard even if the generation algorithm is public knowledge.

        • Re:Gentlemen, start your spambots (Score:4, Insightful)

          by driftingwalrus (203255) on Tuesday January 29 2008, @08:20PM (#22229714) Homepage
          What about introducing spelling and grammatical errors? This would be difficult for a computer to interpret, but doable for a human.

          • Re: (Score:3, Insightful)

            by LordLucless (582312)
            Not really. After a couple of (thousand) runs through, the attacker would have a reasonably accurate database of the questions. They can then analyze the text to find the nearest match to one of the questions in its database.

            • Re:Gentlemen, start your spambots (Score:5, Insightful)

              by omeomi (675045) on Tuesday January 29 2008, @09:23PM (#22230220) Homepage
              Not really. After a couple of (thousand) runs through, the attacker would have a reasonably accurate database of the questions. They can then analyze the text to find the nearest match to one of the questions in its database.

              That's true. I've found, however, that introducing custom spam blocking methods, such as this, no matter how easy to break, often does a better job at stopping spam bots than more robust publicly available methods. For a target as big as Yahoo, this probably won't work, but I've found on PHPbb for instance, instead of using any of the publicly available captchas, which are easily defeated by bots, creating a simple question of this sort does wonders for bot-blocking. Even if it's just one question. If your site isn't big enough to be specifically targeted by bot farmers, sometimes a simple solution is better than a more complex one that everybody else is using.

              • Re: (Score:3, Interesting)

                by nazanne (926750)
                That has been my experience, too. I admin a small bb and was having horrible problems with spam sign ups. CAPTCHAs didn't slow the spammers down at all. I went to a simple question that will be easily known by all of my target audience but probably won't be known by someone half way around the world entering CAPTCHAs for a penny a piece and allowed any spelling that is even close. I haven't had any spammers sign up for a couple years now. That obviously won't work for a major target like YAHOO though.

              • Re: (Score:3, Informative)

                by goatpunch (668594)
                I have a little site, only really intended to share stuff with family and friends, served with custom scripts. I couldn't believe it when it was targetted by spammers. I could even see the test posts they made, checking to see if html was allowed etc., before unleashing the the bot to post dozens of links a day.
            • (if anyone uses this and makes a million, at least cut me in 10% for the idea)

              I gather the last frontier for computers is image recognition. I'm not sure of the state of image processing, but if you could randomly color simple pictures (one flower, one pen, one cup (NO PUN INTENDED)) into about twenty different shades, and get about a hundred different photos, and just start rotating two or three a week in. So the user sees a small photo with radio boxes below:

              The cup is ()red ()blue ()green ()purple ()oran

          • What about introducing spelling and grammatical errors? This would be difficult for a computer to interpret, but doable for a human.
            LoL! I find ur 1d3as fascntng, & wood lik 2 sbscrbe 2 YR noozl3ter.
            kthxby

          • Re:Gentlemen, start your spambots (Score:5, Funny)

            by aliquis (678370) <dospam@gmail.com> on Tuesday January 29 2008, @10:19PM (#22230582) Homepage
            Just put some hard to read perl code in there and ask the user to say what it does. If the answer is correct it's a bot, if the answer is wrong it's probably a human ;)
  • I did my own captcha, but I'm not sure how much its worth - figured any non-standard one is better than none (or a std one).

    Please take a look [primadd.net] - are the effects actually helping the recognition process?

    --
    social bookmarking widget for your site [primadd.net]

    • Re: (Score:2, Informative)

      by Kaitnieks (823909)
      The letters are too far away from each other - makes it easy to separate them for proccessing. In fact, the only challenging aspect for OCRs in your captcha is the letter rotation/skewing. However, I don't think anyone will bother to write a captcha OCR for your site, unless it's Yahoo sized.

    • Re:captcha security (Score:4, Informative)

      by Carnildo (712617) on Tuesday January 29 2008, @08:10PM (#22229640) Homepage Journal
      The character outlines are nicely distinct, which means that even basic OCR software should be able to break the CAPTCHA. Since it's so easy to break, you want to hide it from any bots that come by: remove all references to "captcha" from the page source, and you might want to move the HTML for the image away from the HTML for the entry box.

    • Re:captcha security (Score:5, Informative)

      by yani (50270) on Tuesday January 29 2008, @08:34PM (#22229834)
      Although it seems counter-intuitive, character recognition (even with your filtering) is a relatively easy problem for a computer to solve. The hard problem is segmentation. It is relatively easy for a human to segment characters when they are somehow joined together, by artifacts or occlusion, it can be very hard to do with current methods.

      Hence all good modern captchas have moved away from character recognition captchas (such as yours) to segmentation based captchas. You only need to read the wikipedia article on CAPTCHAs to see some examples: http://en.wikipedia.org/wiki/Captcha [wikipedia.org].

  • That's really impressive. (Score:5, Insightful)

    by heyguy (981995) on Tuesday January 29 2008, @07:59PM (#22229530)
    I've found Yahoo's CAPTCHA to be really annoying. I probably get it wrong about 20% of the time because the picture is so distorted (and I've been surprised that I got it right a lot of the time). I even considered writing them an email complaining about it, but then I realized they probably don't give a crap.
  • We hate CAPTCHA. Most thing they do to make it difficult for computers to decode, make it a lot more difficult for humans to decode. Most of them are not usable by text browsers (dah), and the blind. Some have audio that is hard for people to hear, and sill easy for computer to decode. Last, CAPTCHA's are so over used that people just do them without thinking. For all you know that Porn/ware site is using you to do CAPTCHA for them. Not that it is needed. This is just one more nail in the CAPTCHA coffin.

  • Only Yahoo? (Score:5, Informative)

    by Sigma 7 (266129) on Tuesday January 29 2008, @08:00PM (#22229550)
    33% of Yahoo capitchas isn't really impressive - you still get a large quantity of negative hits, and unless you have an array of IP addresses (most people don't), there will still be a large quantity of addresses registered from a given IP. Also, a large quantity of negatives would cast doubt on any positive matches from the same IP.

    Also, Yahoo captchas aren't that "hard" - they are black text from known font pools on a white background that get slightly warped and have black lines drawn on some characters. This is hardly strong since it doesn't hit all letters within the word (which is done by reCAPTCHA) or use a large font-pool variety.

    Even the Slashdot Captcha is harder - it hits the whole image and uses different fonts within the word.
    • 33% of 100,000 attempts per day is 33,000 posts per day. The idea of Captchas is to reduce this to nearly 0 successful hits per day.

      • 33% of 100,000 attempts per day is 33,000 posts per day.
        That also has 67,000 failed captchas per day - something you generally notice. If your captcha system detects rapid-fire captcha attempts (requests, failed, etc), you can auto-block the IP address that is making that many requests.

        You'd probably want to do that anyway, since 1.15 requests per second for captchas is on par with flooding.
  • Ya, if its not malware, I'll buy a bridge from somebody, and then go bungee jumping without a chord...
  • This might account for the recent increase in spam chat messages I've been seeing there. My guess is that the spam filtering is not as effective on chat as email. Indeed, chat may not pass through any kind of filtering at all afaik. That will probably change soon, but in the meantime I suppose the people who cracked the captcha will make a tidy profit.

  • 35%??? (Score:4, Informative)

    by wbren (682133) on Tuesday January 29 2008, @08:22PM (#22229730) Homepage
    I'm impressed. That's better than I can do. Some CAPTCHAs take me five or six tries to get right.

    • Re:35%??? (Score:4, Insightful)

      by GiMP (10923) on Tuesday January 29 2008, @08:49PM (#22229952) Homepage
      I agree, that is better than I normally do as well. Maybe someone could make this a firefox plugin so that mere mortals can actually access webpages that use CAPTCHAs.

      It is sad because with corrective lenses, my vision is 20/20, and I'm highly technical. I should not have any problems with CAPTCHAs; However, my grandmother is another story. She has poor vision, can't figure out how to do a carriage return on her computer, has difficulty understanding the concept of scrollbars, and I'm sure would not be able to deal with even the easiest CAPTCHAs in use today. This is not usability. Granted, given the choice between SPAM or CAPTCHAs, I'll chose the lesser of the two evils...
  • This is why you need a queryable, updateable public spam database like Akismet [akismet.com] where, with a little effort in telling it the odd time it gets it wrong, you can eliminate 99% of spam. This might not help for a registration script, but you could use it on the content ultimately used by the registered user to determine whether the signup was likely a bot or a human.

  • Warning on playing with the demo (Score:5, Insightful)

    by xynopsis (224788) on Tuesday January 29 2008, @08:32PM (#22229814)
    Did anyone notice that the image recognition code is imported from a binary DLL? I was under the impression that the Russian hackers would provide the source for the recognition code as well. But then, the people who released this are only interested in generating as much spam. Why should you trust them? You would be foolish enough to _not_ execute your test program that imports this dll in a vmware instance instead of your actual machine. Anybody done a comprehensive strace to determine sockets/descriptors opened by using this dll?

  • Gee, Ya THINK (Score:4, Insightful)

    by buss_error (142273) <`buss_error' `at' `yahoo.com'> on Tuesday January 29 2008, @09:14PM (#22230148) Homepage Journal
    Yahoo!'s captcha has been hacked, perhaps not as well, in the past. I've seen open http proxies pounding away at Yahoo to the tune of 100,000 per hour and more. Hotmail's is broken, so are others. The real shame is that the Storm Worm controllers are being protected by a national government and law enforecement system.

    So what's the answer?

    I'm sure I don't know. I do know that the wild west theory of accepting any kind of behaviour isn't acceptable. I know that some minimum standard of what's allowed and what isn't is going to have to take place. Where these limits are placed is a thing for a global conversation, and there will be differances of opinion.

    Is cracking a captcha acceptalbe? Is phishing and identity theft acceptable? Is fraud and uncontrolled spam acceptable? What limits, and on what actions?

    I'm just not that smart. But I think we can agree on a few things. Let's start to find out what those things are... and acting in concert with other network operators to enforce those standards. Fail to meet them, and your network routing gets dropped...

  • Other interesting work on CAPTCHAs (Score:3, Interesting)

    by ChoppedBroccoli (988942) on Tuesday January 29 2008, @09:23PM (#22230216)
    Segmentation and intersecting arcs can be difficult for automated attacks: http://portal.acm.org/citation.cfm?id=1054972.1055070 [acm.org]

    You know those annoying flash advertisement games (shoot the monkey for a free iPod)? Well, they could potentially be adapted for CAPTCHAs as well: http://cups.cs.cmu.edu/soups/2006/posters/misra-poster_abstract.pdf [cmu.edu]

    • Re: (Score:2, Interesting)

      by Anonymous Coward
      Are you bashing MS just to bash them. Honestly, their so called 'stupid system' is the best thing I've seen out there. Please enlighten me wise one, and link me to a better alternative.

      p.s. How do you know that Gmail accounts haven't been hacked into? Do you have data validating this?

      It's not a challenge to bash MS, that comes way to easy, but to add some useful content to /. , might be a challenge for yourself, wise one.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.