Re: Defeating CAPTCHAs via Averaging
Lou Katz <lou@xxxxxxxxxx> wrote:
> On Wed, Jan 31, 2007 at 12:55:41AM +0100, Fred Leeflang wrote:
> > distortion isn't noise-like. So when getting the same captcha several
> > times and averaging out the noise-like distortion will not result in
> I wonder if noise averaging can be trivially defeated (or at least made
> more computationally expensive) by randomly changing the size of the
> captcha images, with or without changing the size of the 'captcha'
> characters/numbers.
No, but it can be easily defeated by changing the placement/appearance
of the number(s) as well as that of the noise or by keeping both
constant over reloads.
What is exploited here, is the fact that noise and payload behave
differently on reload. This allows to separate them.
Please note, that averaging is a very simple technique to do that.
Depending on the type of captcha, one can use methods that converge
much more quickly. Simplest one would be to use the simple majority
of pixel values or the median value, if slight global noise (e.g. from
compression artefacts) is expected.
This should yield almost perfect results with as low as 3 different
images. Adding a tiny bit of spatial filtering might help as well.
Kind regards,
Andreas Beck
--
Andreas Beck
http://www.bedatec.de/