| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20070201005244.GA5115@acs.uni-duesseldorf.de> Date: Thu, 1 Feb 2007 01:52:44 +0100 From: Andreas Beck <becka-list-bugtraq@...atec.de> To: bugtraq@...urityfocus.com Subject: Re: Defeating CAPTCHAs via Averaging Lou Katz <lou@...ron.com> wrote: > On Wed, Jan 31, 2007 at 12:55:41AM +0100, Fred Leeflang wrote: > > distortion isn't noise-like. So when getting the same captcha several > > times and averaging out the noise-like distortion will not result in > I wonder if noise averaging can be trivially defeated (or at least made > more computationally expensive) by randomly changing the size of the > captcha images, with or without changing the size of the 'captcha' > characters/numbers. No, but it can be easily defeated by changing the placement/appearance of the number(s) as well as that of the noise or by keeping both constant over reloads. What is exploited here, is the fact that noise and payload behave differently on reload. This allows to separate them. Please note, that averaging is a very simple technique to do that. Depending on the type of captcha, one can use methods that converge much more quickly. Simplest one would be to use the simple majority of pixel values or the median value, if slight global noise (e.g. from compression artefacts) is expected. This should yield almost perfect results with as low as 3 different images. Adding a tiny bit of spatial filtering might help as well. Kind regards, Andreas Beck -- Andreas Beck http://www.bedatec.de/
Powered by blists - more mailing lists