Google's CAPTCHA - caught by spammers!

Alex Zaharov-Reutt
Friday, 29 February 2008 05:56

Opinion and Analysis

Websense notes that spammers are using bots that are now “capable of signing up and creating random Gmail accounts for spamming purposes”.

Websense explains that, that from the spammers’ perspective, there are four main advantages to this approach.

“First, signing up for an account with Google allows access to its wide portfolio of services. Second, Google’s domains are unlikely to be blacklisted. Third, they are free to sign up. And fourth, it may be hard to keep track of them as millions of users worldwide are using various Google services on a regular basis”.

Websense then goes on to explain that these email accounts could be used by spammers at any time for abusing Google’s infrastructure. A wide range of attacks could be possible as the same account credentials can be used to target various services offered by Google.

Websense have posted a detailed report showing why they believe Google’s CAPTCHA has been compromised, and if you’re interested it’s well worth taking a look.

Websense note that they saw bots (or bot-infected machines) trying to sign up as many accounts as possible with Gmail mail services, and as they are having success in signing up for Gmail accounts, which necessitates CAPTCHA authentication, they have clearly broken through.

So... the upshot of all of this is we can all expect even more spam. Wonderful news, isn’t it?

No doubt Google will not stand to see their system being so badly abused, and will work to close the loophole, although I’m sure Google will think twice before promising the end to spam that Bill Gates did!