Defeating audio captcha systems

2009-09-15 / 2009-09-16
Credit: Jose
Risk: Low
Local: No
Remote: Yes
CWE: CWE-264


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

Hi all, Some days ago I wrote an advisory which demonstrates how the Peter's Math Antispam Spinoff plugin for wordpress (http://www.theblog.ca/math-anti-spam) can be defeated by its audio file. It's hard to summarize, you better read the advisory, but in a very small nutshell, the flaw its about not using any kind of distortion on the audio clip, which makes it easily identificable by a script. Here is the link: http://docs.google.com/View?docid=df36cd52_19xzmkwqcg I'm sure you will find the advisory inspirational, as the approach is applicable to many other capthas, and anti-script methods. Regards Jose

References:

http://xforce.iss.net/xforce/xfdb/39688
http://www.securityfocus.com/bid/27287
http://www.securityfocus.com/archive/1/archive/1/486331/100/200/threaded
http://docs.google.com/View?docid=df36cd52_19xzmkwqcg


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top