staf - Slashdot User

Google ReCAPTCHA Cracked In New Automated Attack 66

Posted by msmash on Thursday April 07, 2016 @10:40AM from the breaking-the-code dept.

An anonymous reader writes: A trio of security researchers have devised a new automated attack that can break the CAPTCHA systems employed by Google and Facebook. On Google's reCAPTCHA system, researchers recorded a 70.78 percent success rate over 2,235 CAPTCHAs. Average CAPTCHA solving time was 19.2 seconds. They achieved a better success rate on Facebook's system, where they had a success rate of 83.5 percent on over 200 CAPTCHAs, but this was mainly because of higher quality images, and photos were selected from different topics, and were also easier to recognize and classify. For attackers, the whole automated system would cost only $110 a day, per IP address, and would allow them to crack around 63,000 CAPTCHAs in 24 hours from one IP address without being detected and getting banned.

Comment If you want more information ... (Score 0) 353

by staf on Saturday May 31, 2003 @08:31AM (#6083857) Attached to: Application Layer Packet Shaping on Linux

The layer 7 filtering is only a small part of a shaping setup. First of all, you need a htb or cbq setup. This changes the behaviour of the packets you send. You can create multiple cbq/htb classes. Each class can be seen as a seperate traffic channel that sends the packets that are placed in this class. Each class can have it's own config like minimal and maximal bandwidth, delays and so on.

To place the packets in the classes, you need some filters. The 2 most used filters are fw (it can use iptables marks) and u32 (it can use any bit in a packet). So basically, you are limited to ip-addresses and ports.

But with l7 filtering, you can look in the packets and use the contents of the packet to filter the packets and place them in the class you want. To do so, you have to be able the recognise the traffic. And that's what the extra kernel patch will do.

The more people are looking for ways to recognise patterns, the better. So if you find a new way to recoginise kazaa traffic (use tcpdump or so to examine the packets), send it to the l7 patch author so he can update the protocol definition file.

Some handy URL's :
lartc.org : information about "linux advanced routing and traffic control"
docum.org : my site :) with more info about traffic shaping with cbq/htb.

Slashdot Top Deals