Slashdot Mirror
Google ReCAPTCHA Cracked In New Automated Attack
An anonymous reader writes: A trio of security researchers have devised a new automated attack that can break the CAPTCHA systems employed by Google and Facebook. On Google's reCAPTCHA system, researchers recorded a 70.78 percent success rate over 2,235 CAPTCHAs. Average CAPTCHA solving time was 19.2 seconds. They achieved a better success rate on Facebook's system, where they had a success rate of 83.5 percent on over 200 CAPTCHAs, but this was mainly because of higher quality images, and photos were selected from different topics, and were also easier to recognize and classify. For attackers, the whole automated system would cost only $110 a day, per IP address, and would allow them to crack around 63,000 CAPTCHAs in 24 hours from one IP address without being detected and getting banned.
now how are we going to stop terminator infiltrators at the door when skynet rises
Captcha generation can be scaled up quite cheaply and the cracking it automatically does not scale well. But why bother to create a complex system to mimic a human brain, when human brain itself is available for hire for a pittance? You could hire someone in India to manually solve some 30 to 60 captcha an hour for about 100 Rs per hour, or less than $1.50. This method of cracking captcha is unbeatable because, you can not make Captcha more difficult without hampering legitimate users.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Wouldn't it be neat if Google's very own system was being used to crack their CAPTCHA system?
I've never even seen a Captcha for Google, and I really have no idea of when you'd see them, or why you'd pay to break them.
If you do a bunch of searches in quick succession, it will occasionally ask you to solve one. Seems kinda random, though, some days I can search for half an hour as fast as I can type without getting one, while others I get a captcha after my third attempt to refine the results.
I'm not sure where the the article summary got its notion about the costs. The article doesn't address that- instead it spoke to how much could be made selling the service. From the article:
Assuming a selling price of $2 per 1,000 solved captchas, our token harvesting attack could accrue $104 - $110 daily, per host (i.e., IP address). By leveraging proxy services and running multiple attacks in parallel, this amount could be significantly higher for a single machine.
I think the authors of the article were trying to communicate how much money they could make selling this 'service' to other unsavory agents. It could be a lucrative business given the assumed market rates of $2 per 1k, and the mentioned optimizations could make it even more attractive. It makes me wonder if you could set up the whole thing in a cloud computing environment like AWS and come out ahead.
trying to enter them as a real human being. Seriously, the captcha system is broken because as long as there is a monetary value to breaking it someone will, even if it is simply paying a few cents per capture to break them to a human in some low wage country. The only authentication system I have seen that didn't rely on a separate hardware device for authentication that was worth a damn were those that, rather than requiring a selection or inputing what you see on screen, asked a question that only someone family with the topic would know. For example, I've seen engineering bulletin boards ask for the name of a specific type of beam, automotive ones that ask something unique to the marque, etc. so automating a process to gain entry is not practical. Of course, one you know the answer you can easily create multiple accounts, but these boards also limited posting ability for a set period of time and or required a secondary confirmation before gaining full access to limit the drive by spamming of EXCELLENT QUALITY!!! YOU BUY CHEAP!!! DESIGNER!!! posts.
I'm a consultant - I convert gibberish into cash-flow.
Google has a Room of Requirement?
Oh, man, I never get to have any fun.
Lost at C:>. Found at C.
I already tried to do that, but in order to sign up for the bot, the company made me solve a captcha.
Gamingmuseum.com: Give your 3D accelerator a rest.
It's bots and capchtas all the way down. ;-)
Lost at C:>. Found at C.