Breaking the Silk Road's Captcha

This a great writeup and super easy to follow along with. The figures are really nice!

One observation: training a neural net to classify segmented characters is probably overkill. The author observed that the font never changed, but never ended up exploiting this fact. After the very effective preprocessing, thresholding, etc the characters are almost identical to the 'average' representations the author generated!

I bet it would be enough simply to classify an unknown character by the letter that it shows highest correlation with.

FYI: Captchas are generally considered "broken" at between 1% and 10% rates of success with automated approaches, because attackers can run hundreds of thousands of requests, generally "for free" at the margin. There is no practical difference in the amount of abuse suffered by a site with a 90% captcha and a 9% captcha -- the first one just requires 10X as many HTTP requests to abuse.

This is one of the unfortunate "math favors the bad guy" consequences in a lot of anti-abuse filtering tasks. (Anti-spam research has similar problems, which is why the main innovation wasn't making filters better but radically increasing the cost of getting caught, via burning the reputation of the offending IP. IP addresses are a lot more expensive to acquire in quantity than packets.)

Author here. Here's the corresponding proggit thread: http://www.reddit.com/r/programming/comments/2hisfk/breaking...

That was a surprisingly simple and easy-to-follow write-up. I will have to try some captcha-breaking for myself soon.

Very cool and well-written post.

I've created many similar programs to defeat captcha's. I would classify this as a medium severity bug, you would still need to brute force the passwords on a terribly slow and intermittent connection.

Silk Road used ReCaptcha long ago and it finished bad: http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leak...

I feel like a much smarter programmer after reading that.

And more + reddit captcha

https://github.com/dawjan/Open_Me/tree/master/Captcha%20Crac...

Also /.. is php tor

Could that last step be considered a kind of Levenshtein distance measurement?

The lesson? Include a developer API with your site, so people don't have to undermine your security to use it.

I believe that the Silk Road was built on the CodeIgniter frameowkr for PHP.

Why wouldn't you just pay a captcha breaking service to get a near-100% success rate? Less noticable for botting and $10 will buy you around 10k captchas on antigate or deathbycaptcha. Don't really need to log in and out that much, so that'd probably be plenty.