When you sign up for an e-mail account at Google's Gmail, you have to navigate past a CAPTCHA -- squiggly words and letters that need to be typed into a box to prove you're human and not an automated system looking to send spam. But in the war against spammers, CAPTCHAs are not holding up well and the latest attacks let spambots into Gmail.
CAPTCHA stands for "Completely Automated Public Turing test to tell Computers and Humans Apart." Typically image files, the challenge-and-response system has been fairly successful in preventing spammers from opening e-mail accounts on popular Web domains like Gmail, Yahoo and Hotmail. Those accounts are prized by spammers because Web administrators can't simply blacklist the popular domains.
Spammers have found ways to break CAPTCHAs, according to Stephan Chenette, manager of Websense Security Labs. "What we're seeing is the technology on the hacker side has surpassed the simple CAPTCHAs," Chenette told us. "In the public domain there are several tools available right now for everyone to use to break simple CAPTCHAs."
Human and Computer Attacks
Chenette said organized attackers are using automated tools to sign up for Gmail and other Web-mail accounts. When the CAPTCHA image appears, it's automatically sent off to a large and low-paid workforce, typically in another country, where a worker enters the code and sends it back so the account can be created.
This type of attack has been used against other Web-mail sites, Chenette said, but in the attacks on Gmail there's a new wrinkle. "One of the more interesting things about the Gmail CAPTCHA breaking is that we believe that this might be happening through an automated process, which is the next step to breaking CAPTCHAs as opposed to hiring a large workforce to break them," he said.
In fact, Chenette believes these are two-pronged attacks. The first uses the offshore workforce, while the second may rely on bot networks, large sets of compromised computers that work together for attackers. Websense experts can see how often CAPTCHAs are being broken, and for the Gmail traffic there's only a 20 percent success rate for one prong of the attack.
"It would be very odd if a human would fail one out of five times in understanding what that CAPTCHA was," Chenette said. "From that we conclude it's possibly a bot network with automated tools involved."
Most of the IP addresses and networks involved in these attacks are from the United States, Chenette said. But when he visited some of the Web pages, the text was in Russian, leading Websense to conclude that the authors -- who specify a pay rate of $3 per broken CAPTCHA -- are likely Russian as well. That wouldn't be a surprise. "In malicious activity in general, the U.S., Russia, China and Brazil are the top offending countries," he said.
Still Hope for CAPTCHAs
Douglas Merrill, vice president of engineering at Google, told us that the CAPTCHA attacks are being dealt with quickly and he has no concern that this is the tip of a larger security issue. "We've disabled the accounts that were set up as result of CAPTCHA violation. But this does not in any way weaken the security of our users or our users' Gmail. We have many, many layers of security, technical and physical, in place at Google to secure information, and those layers remain strong," he said.
Despite the attacks on Web-mail providers, CAPTCHAs are not dead yet. Websense's Chenette suggested that making them more difficult will make it more difficult for humans as well, so he recommended using CAPTCHAs as one of several steps in authenticating. Newer versions of CAPTCHAs play an audio file that the user listens to and types, so that may help stave off malicious attacks for a while.
But only for a while. "We can't underestimate the malicious community, because they are a hired workforce of very capable programmers, with a mission of gaining profit," Chenette said. And spam remains a very profitable business.