Captcha-ing the power of porn

Internet users – many of them, at least – will do just about anything to see pictures of attractive women without their clothes on (the women are naked, not the Internet users … except, well, let’s not go there.)

Anyway, you knew that.

What you may not have known is that this oftentimes all-consuming lust for lascivious images can be leveraged by malicious social engineering types to turn those annoying antispam captchas we all struggle to decipher into tools for creating fake e-mail accounts. Such bamboozlement has been around for awhile, but two security firms Trend Mirco and Panda Software, have in recent days turned their blog spotlights on to the newest turn of the trick.

Writes Tend:

A nifty little program that Trend Micro detects as TROJ_CAPTCHAR.A disguises itself as a strip-tease game, wherein a scantily clad “Melissa” agrees to take off a little bit of her clothing. However, for her to strut her stuff, users must identify the letters hidden within a CAPTCHA. Input the letters correctly, press “go,” and “Melissa” reveals more of herself.

However, the “answers” are then sent to a remote server, where a malicious user eagerly awaits them. The strip-tease game is actually a ploy by ingenious malware authors to identify and match ambiguous CAPTCHA images from legitimate sites, using the unsuspecting user as the decoder of the said image.

The post includes screen shots that are safe for all but the most restrictive of workplaces. Because the images detected in circulation are of Yahoo captchas, Trend speculates that someone may be hording Yahoo accounts for spamming purposes.

While the current application may be new, the concept is not. Simson Garfinkle writing in MIT’s June 2003 issue of Technology Review speculated about an alternative to using ultra-cheap foreign laborers as a means to subvert captchas:

Spammers who don't want to hire Chinese labor can set up "free" porno Web sites, where the cost of admission is solving a captcha every few minutes. The spammer then writes a program that goes to Hotmail, signs up for an account, gets a captcha, shows that test to the porn fiend, and supplies said fiend's response to Hotmail. Problem solved!

Moral to the story: Never underestimate the power of porn.

Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind.
Related:
Must read: 10 new UI features coming to Windows 10