CAPTCHA is Pwned

"Completely Automated Public Turing test to tell Computers and Humans Apart," otherwise known as CAPTCHA, seems to have been trounced by some spammers. CAPTCHA is best known as the box that features an image of a word that is smudged or struck through with a line that is placed in security or spam-sensitive places like blog comments sections or password verification pages, in order to confirm that the user is, indeed, a human. Other forms of CAPTCHA are used in many of these sensitive areas of Web pages across the Internet.

Microsoft and Yahoo! utilize the CAPTCHA line of defense in order to prevent dubious e-mail accounts from being automatically created by spammers with bad intentions.

Security and antivirus company BitDefender says that spammers have actually found a way to overcome this security measure and have generated more than 15,000 phony Hotmail accounts.

The new threat is called Trojan.Spammer.HotLan.A, and is automatically creating Hotmail and Yahoo! e-mail accounts that are used to send out spam.

These e-mail accounts are being used to channel unsuspecting recipients to pharmacy products online.

"There are only about 500 or so new accounts being created every hour," said Viorel Canja, the head of the BitDefender Antivirus Lab. "But still, we’ve seen 15,000+ Hotmail accounts being used so far. It’s hard to estimate how many spam e-mails have already been sent."

Source:

http://tech.blorge.com/Structure:%20/2007/07/08/spammers-overcome-
hotmail-and-yahoo-captcha-systems/