bugtraq - Re: Defeating CAPTCHAs via Averaging

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 1 Feb 2007 01:52:44 +0100
From: Andreas Beck <becka-list-bugtraq@...atec.de>
To: bugtraq@...urityfocus.com
Subject: Re: Defeating CAPTCHAs via Averaging

Lou Katz <lou@...ron.com> wrote:
> On Wed, Jan 31, 2007 at 12:55:41AM +0100, Fred Leeflang wrote:
> > distortion isn't noise-like. So when getting the same captcha several
> > times and averaging out the noise-like distortion will not result in
> I wonder if noise averaging can be trivially defeated (or at least made
> more computationally expensive) by randomly changing the size of the
> captcha images, with or without changing the size of the 'captcha'
> characters/numbers.

No, but it can be easily defeated by changing the placement/appearance 
of the number(s) as well as that of the noise or by keeping both
constant over reloads.

What is exploited here, is the fact that noise and payload behave
differently on reload. This allows to separate them.

Please note, that averaging is a very simple technique to do that.
Depending on the type of captcha, one can use methods that converge 
much more quickly. Simplest one would be to use the simple majority
of pixel values or the median value, if slight global noise (e.g. from
compression artefacts) is expected. 

This should yield almost perfect results with as low as 3 different 
images. Adding a tiny bit of spatial filtering might help as well.

Kind regards,

Andreas Beck

-- 
Andreas Beck
http://www.bedatec.de/