Hacker News Reader

Comment by mixmax | Hacker News Reader

Some users from 4chan managed to hack recaptcha and embarrass Time magazine seriously at the same time not long ago.

Basically they stuffed the ballots on the Time online voting page where users could vote for most influential person of the year. Most influential person ended up being Moot, founder of 4chan. Just to rub it in they managed to spell "marblecake also the game" out of the first letters of the top 21 entries.

Note: This hack shows more about Time's incompetence than recaptcha's.

In-depths story here: http://musicmachinery.com/2009/04/27/moot-wins-time-inc-lose...

View on HN

No, they didn't come close to "hacking recaptcha":

Update – Just to be perfectly clear, anon didn’t hack reCAPTCHA. It did exactly what it was supposed to do. It shut down the auto voters instantly and effectively. The only option left after Time added reCAPTCHA to the poll was a brute force attack. Ben Maurer, (chief engineer on reCAPTCHA) comments on the hack: “reCAPTCHA put up a hard to break barrier that forced the attackers to spend hundreds of hours to obtain a relatively small number of votes. reCAPTCHA prevented numerous would-be attackers from engaging in an attack. In any high-profile system, it’s important to implement reCAPTCHA as part of a larger defense-in-depth strategy”. As Dr. von Ahn points out “had Time used reCAPTCHA from the beginning, this would have never happened — anon submitted tens of millions of votes before Time added reCAPTCHA, but they were only able to submit ~200k afterwards. And to do this, they had to resort to typing the CAPTCHAs by hand!” One thing that Time inc. did that made it much easier for the anonymous hack was to allow leave the door open for cross-site request forgeries which allowed anon to create a streamlined poll that never had to fetch data from Time.com.

While not completely cracking it, didn't they figure out that they could skip one of the two words, and which word to skip effectively halving the time it takes to solve the captcha?

That's why I wrote This hack shows more about Time's incompetence than recaptcha's.

Sorry if I didn't make it clear enough that the fault lay with Time and not recaptcha.

Thanks for bringing that up, I'd almost forgotten about that.

The way I understand it, reCAPTCHA gives you 2 words to analyze, one which reCAPTCHA "knows" and one it is trying to learn about. As long as you get the word it knows about correct, it'll say you're a human. You're answer to it's unknown word is simply stored and (I'd assume) analyzed until it has enough responses to consider it a known word. Knowing this allowed 4chan users to nearly cut their response time to the captchas in half.

I'd be fascinated to hear more details (or be corrected) on how reCAPTCHA works if anyone has them.

I think you've pretty much got it right. Once there's a significant amount of "agreement" on what a word says, reCAPTCHA will assume it's correct. My guess is it will keep unknown words in its "unknown" pool until a minimum amount of responses are given, AND the responses are in agreement over a minimum (likely very high) percentage.

4chan users were never able to successfully break recaptcha without some significant brute force techniques as detailed in the blog post, so there is still a lot of hope yet for recaptcha.

That said, I doubt the attacks perpetuated by 4chan are the wrong place to start searching if what you're looking for is intelligent attempts to crack the system. They are among the truest supporters of the rule to "When in doubt, use brute force." The fact that they fell back on that technique probably means very little for the actual security of recaptcha.

Reply on news.ycombinator.com