CGISecurity Logo

Website CAPTCHA only as good as the porn offered to break it

"The Captcha Trojan disguises itself as a stripper game that offers
voyeurs the chance to see images of a model getting undressed. In order
to get "Melissa" to lose an item of clothing, the user must identify
the letters or numbers found within a scrambled text image that forms
the basis of a captcha (Completely Automated Public Turing test to tell
Computers and Humans Apart). Providing users identify the letters
correctly, Melissa shows a bit more skin."

So by deciphering the text, voyeurs are unwittingly helping crooks get
around checks designed to stop them establishing accounts. These
newly-created accounts may later be used to send junk mail or other
malign purposes.

Captchas have been used to defeat automatic sign-ups to email
accounts by services including Yahoo! Mail and GMail for years.
Increasingly hackers have had more success at defeating the approach.
For example, the HotLan Trojan has created more than 500,000 spam email
accounts with Hotmail, Yahoo! and GMail since its arrival back in July."

Link to this Story:
Website CAPTCHA only as good as the porn offered to break it