bugtraq - Defeating audio captcha systems

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 15 Jan 2008 06:01:03 +0000
From: "José M. Palazón Romero" <josem.palazon@...il.com>
To: bugtraq@...urityfocus.com
Subject: Defeating audio captcha systems

Hi all,

Some days ago I wrote an advisory which demonstrates how the Peter's
Math Antispam Spinoff plugin for wordpress
(http://www.theblog.ca/math-anti-spam) can be defeated by its audio file.

It's hard to summarize, you better read the advisory, but in a very
small nutshell, the flaw its about not using any kind of distortion on
the audio clip, which makes it easily identificable by a script.

Here is the link:

http://docs.google.com/View?docid=df36cd52_19xzmkwqcg

I'm sure you will find the advisory inspirational, as the approach is
applicable to many other capthas, and anti-script methods.

Regards

Jose