Koobface Tries CAPTCHA Breaking

Most of us has probably encountered and used CAPTCHA but did not know it actually has a name to it.

A CAPTCHA or Captcha is a type of challenge-response test used in computing to ensure that the response is not generated by a computer. The process usually involves one computer (a server) asking a user to complete a simple test which the computer is able to generate and grade. Because other computers are unable to solve the CAPTCHA, any user entering a correct solution is presumed to be human.

Eg:

 As CAPTCHA works against spammers and botnets, cybercriminals find ways to farm and overcome these distorted characters to break the code. Below is an interesting method by worm Koobface.

by Joey Costoya (Advanced Threats Researcher)
Early this week, we’ve encountered a new Koobface spam campaign which involved links that eventually led users to this Youtube copycat web page.

The scheme uses the old flash player trick (see Figure 1) where the user is told that they need to download the latest version of Adobe Flash Player to view a certain video. In this case, the Flash Player in the page is an actual Flash .SWF file, which will redirect users to a file named setup.exe detected by Trend Micro as TROJ_KOOBFACE.DU through the Smart Protection Network.

A short while after running setup.exe, Koobface fetches a picture file from a remote server which is actually a CAPTCHA image. The user is then presented with the Windows prompt as shown in Figure 2.

The panic-inducing screen displays the time before the system will shutdown as shown in Figure 3, while the image (blurred) in the middle is the downloaded CAPTCHA image. The above prompt is essentially telling the user that the system will shutdown in 2 minutes and 29 seconds unless they enter the CAPTCHA correctly!

After the user correctly solved the CAPTCHA image, Koobface promptly reports the solved CAPTCHA code to a remote server. This Koobface strategy creates a low-cost, distributed CAPTCHA breaking service. This time though, instead of using cheap labor, Koobface is now using the infected users themselves to break CAPTCHAs.

Comments

[jenifer]

6cuoHn http://djtnG49Nsl0g2KasFu.com

[tomphson]

8Id15d http://cry82Nqp94NsW0sl2VvqhJ4m.com

[albert]

1iQZGX http://fh82nGsQk0fQsn3Ldap1f.com

[Qkbwswbu]

Very Good Site