Spammers' bot cracks Microsoft's CAPTCHA

Bot beats Windows Live Mail's registration test a third of the time, says Websense

Spammers are using a bot to sidestep barriers that Microsoft has erected to keep scammers from creating massive numbers of accounts on its Live Mail service, a security researcher said.

Dan Hubbard, vice president of security research at Websense, said the bot was designed to break CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart) defenses, the distorted, scrambled character codes many Web services use to block automated registration of hundreds or thousands of accounts at a time.

The bot, said Hubbard, grabs the CAPTCHA -- which is not plain text but actually an image -- and sends it back to the spammer's server, where the image is somehow "read" and a clear text match generated. The text is then sent back to Live Mail, where it's plugged into the box where users normally type the CAPTCHA characters.

On average, the bot returns the correct response 30 to 35 per cent of the time, Hubbard claimed, and successfully creates an account.

"This is the first time that we've seen a bot like this," Hubbard said, "at least one that does the full loop of coming up with the CAPTCHA and registering an account."

Some specifics of the account-creation scam are still murky, he admitted. "What we don't know is what happens on the back end, at the spammer's server." Once the CAPTCHA image reaches the server, the spammers could be running it through some kind of optical character recognition (OCR) process or using one of several CAPTCHA "busters" tools. Or there could be people viewing the images, then typing in the character code, although Hubbard said that was unlikely.

Spammers' appetite for large numbers of free e-mail accounts has driven them to come up with the bot, Hubbard said. "They use these addresses once and dispose of them," he said, "or they use an address one or two days." That's about the lifespan of a spamming address, he continued. "Accounts get shut down quickly, or they get listed in the spam filtering products."

Live Mail, and rivals like Yahoo Mail, are favorite targets for spammers because the services are free, their domains cannot be blocked by blacklisting anti-spam tools and the millions of accounts they control make it easy for the spamming addresses to hide in the crowd, Hubbard said.

The bot's success rate shows that CAPTCHA is in danger. Unfortunately, there's no single technology waiting in the wings that could step in to replace it, especially in high-volume settings like Live Mail or Yahoo Mail.

"You have to make something that's simple and easy enough for people to accept, but too difficult for a computer to do" on its own," Hubbard said. That's a fine line, he added.

In fact, Websense's findings mark the second time in less than three weeks that CAPTCHA-cracking claims have been made. Last month, a Russian programmer using the alias John Wane posted a decoder he said could crack Yahoo's CAPTCHA system 35 percent of the time.

"Where there's a will, there's a way," Hubbard concluded.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?