CAPTCHAs: Are They Really Hopeless? (Yes)
Mike Spindel and Scott Torborg details dEF CON 16 - Mike Spindel & Scott Torborg: CAPTCHAs: Are they really hopeless.
Summary
Architecture and Background
DEF CON 16 - Mike Spindel & Scott Torborg: CAPTCHAs: Are they really hopeless? (Yes) CAPTCHAs are widely used to protect websites against malicious robots.
Vulnerability Analysis
Yet, CAPTCHAs are being broken routinely by spammers, malware authors, and other nefarious characters. This talk will review and demonstrate many of the implementation weaknesses that are routinely exploited to break image-based CAPTCHAs, and offer suggestions for improving the effectiveness of CAPTCHAs.
Exploitation and Demonstrations
Rather than attempt an in-depth examination of any single CAPTCHA or technique, we will present a broad overview of tools with the aim of making it easy for anyone to take a shot at cracking the CAPTCHAs on present and future high-profile sites. Mike is a recovering graduate student with a penchant for security research and good bourbon.
Remediation and Defensive Strategies
His interests include distributed systems, MANETs, reverse engineering, and physical access control. Scott Torborg is a web application developer in Silicon Valley. Although equally at home with an oscilloscope probing an electromechanical lock or tinkering with javascript obfuscation, he is most likely to be found indulging vices. For copies of the slides and additional materials please see the DEF CON 16 Archive here:
Related talks
Main Stage·1 hr 54 min
Workshop
Workshop details workshop: Davix Workshop Need help understanding your gigabytes of application logs or network captures.
Main Stage·41 min
Weasel
Weasel details weasel: Compliance: The Enterprise Vulnerability Roadmap Compliance is no longer new.
Main Stage·48 min
Valsmith · Colin Ames
Valsmith and Colin Ames explores metapost-exploitation at DEF CON 16, examining emergency-systems and practical defenses.