Spam Bots and CAPTCHAs

The Yahoo CAPTCHA is broken press-release reveals some numbers. I’m highlighting them:

It’s not necessary to achieve high degree of accuracy when designing automated recognition software. The accuracy of 15% is enough when attacker is able to run 100 000 tries per day, taking into the consideration the price of not automated recognition — one cent per one CAPTCHA.

So:
* 15% recognition rate is enough
* 1 cent per 1 CAPTCHA when using monkeys

Evil spammers and renegade programmers aren’t who you think they are. Sure, both types of Internet abusers can trace their origins back to random individuals who weren’t commercially organized and whose actions didn’t really cause a huge ripple effect across the ‘Net. But all of that has changed.

Today’s virus attacks are written by professional software developers who charge fees to buyers who want to release their own spam, virus or Trojan horse attack. Developers sell plug-and-play “instant virus outbreaks” and root kits that can be purchased and downloaded online. Organized crime cartels from around the world have sunk their claws into the Internet and they’re making billions of dollars per year running their spam networks and phishing sites.

(more…)

You can have the best anti-spam protection on the planet and still find yourself getting spammed by actual human beings who aren’t using any robots. Fortunately, with the number of forums and blogs on the ‘net, the chances of yours getting targeted by the lone typing monkey is slim. Even so, it does happen.

(more…)