Character recognising spam breaking CAPTCHA defences

Webmail and OCR based spam is on the increase, which traditional web filters are having difficulty detecting.

Spam sent from webmail accounts created using CAPTCHA breaking technology is on the increase, according to Marshal.

It said that there was more spam capable of beating the response test, which is used to ensure content is generated by a human manually typing letters and numbers rather than a computer. CAPTCHA (Completely Automated Public Turing Test to tell Computers & Humans Apart) was developed by Carnegie Mellon University in 2000 to stop spam robots.

However there are ways to get past this security such as Optical Character Recognition (OCR), which is mechanical or electronic translation of the electronic images. Sometimes it was possible to completely bypass the CAPTCHA.

"In email security we've developed pretty advanced OCR technology to deal with image based spam," said Bradley Anstis, vice president of products at Marshal. "I think some spammers are using tools we've created against the industry to help them break the CAPTCHA codes."

However, he did go on to say that the bigger problem was that many businesses and websites were not even bothering to implement CAPTCHA.

"Even though CAPTCHA technology is evolving and there are new ways of doing it its still up to the companies to deploy these on their websites," Anstis said. "That traditionally has been the hardest thing to do."

The report said that using webmail accounts for spam made IP reputation or message header inspection less effective. Spam would be generated from Gmail, Yahoo and Hotmail accounts, so they would look to come from legitimate sources.

"This email is typically generated using a well-formatted composition type engine so the headers are really tidy and bodies are really neat," Anstis said.

"Traditional spam filters that look at the structure of an email message looking for addresses of bulk mailers are less effective. Webmail messages conform to all right the standards."

Featured Resources

Key considerations for implementing secure telework at scale

Identifying the security risks and advanced requirements of a remote workforce

Download now

The State of Salesforce 2020

Your guide to getting the most from Salesforce

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Rethink your cybersecurity strategy for the new world

5 steps to secure the enterprise and be fit for a flexible future

Download now

Recommended

Andrew Daniels joins Druva as CIO and CISO
Cloud

Andrew Daniels joins Druva as CIO and CISO

22 Jul 2020
University of California gets fleeced by hackers for $1.14 million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Australia announces $1.35 billion investment in cyber security
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
CSA and ISSA form cyber security partnership
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

3 Aug 2020
How to use Chromecast without Wi-Fi
Mobile

How to use Chromecast without Wi-Fi

4 Aug 2020
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

3 Aug 2020