Spammers enroll users to break protection
By Jerome Saiz, Wed, October 31st, 2007
A new malicious code is making rounds, trying to enroll users in a stripping game for the benefit of spammers. A virtual stripper in exchange of some captcha breaking.
The Captchar malware is installed on already-compromised PCs through another malware, probably a bot. It then offers the user to engage in a stripping game, the partner being a virtual girl named Melissa.
To win (ie, to get Melissa fully naked), the user has to enter graphical text and number sequences the game displays. Those are in fact captchas coming from legitimate websites trying to protect against automated enrollments. Those captchas are designed to be hard to break by a computer, but easy to a human.
By making users "work" for them, spammers get around the hassle to decrypt captchas automatically. Thanks to Melissa, they build a library of already-broken captchas that can then be used to create new spamming accounts on webmails or to post comment spam at blogs.
Captchas breaking is not new, and online services, program APIs and even paid human labor have already been used to break them in mass. It only was a matter of time for porn, the web's greatest driver, to be used to break captchas, too.
More about this news : see http://vil.nai.com/vil/content/v_143504.htm
Into IAM ?
The IAM 2008 Series
SecurityNewsletter interviews major Identity & Access Management players to give you the lead on what IAM will be in 2008.

Print this news
