8 ms·
Breaking the MintEye image CAPTCHA in 23 lines of Python
- StavrosK 14y agoVery interesting article, and an insightful realization. I had no idea Sobel could do that.
- experiment0 14y agoWhat? Edge detection is pretty much the only use for the Sobel operator. http://en.wikipedia.org/wiki/Sobel_operator http://en.wikipedia.org/wiki/Sobel_operator
- Goranek 14y agoBreaking captcha is bad, mkay :)
- daeken 14y agoNo more so than finding security vulnerabilities. Captchas that are trivial to break are going to be broken no matter what, so it's better for someone non-malicious to break it and make it well known, so that people don't use the captcha, than for it to go unnoticed.
- hcarvalhoalves 14y agoIf you're using a CAPTCHA, you're doing it wrong already.
- brownbat 14y agoYeah, all these CAPTCHA stories are definitely making me think there's no refuge left of simple tasks humans can do that machines can't. What's the replacement? Tying every account to a mobile phone or credit card?
- hcarvalhoalves 14y agoThe thing is, CAPTCHAs are used to validate it's a human operating the interface, not a robot. That's a stupid idea, based on some weird assumption that it's somehow safe to give access to your system for a user, but not for a robot. If the only thing stopping people from messing your system is automation, you should rethink it from the get go.
- brownbat 14y ago> weird assumption that it's somehow safe to give access to your system for a user, but not for a robot. Nice point. > If the only thing stopping people from messing your system is automation, you should rethink it from the get go. Are there systems that can't be abused through automation, or where that's much less of a concern? (Serious question, not intended as snark.) Maybe throttling activity is a better approach... it's volume that is harmful to the system, not interactions with programs per se. Don't know how you throttle spammers distributing activity across a number of accounts and IP addresses though...
- hcarvalhoalves 14y ago> Are there systems that can't be abused through automation, or where that's much less of a concern? Let's analyze. One place CAPTCHA has been used a lot is in comment forms. It increases the opportunity cost of posting a comment via automation by introducing a complicated challenge. Fair enough. But that doesn't solve the underlying problem (abusive comments). You'll still have abuse and spam, it will just come from humans instead of robots. If I'm a blackhat SEO with a budget, I pay people to solve CAPTCHAs all day and spam the internet (that's what happens). If you design the comment system to fight abuse from the ground up (e.g., markov chain spam filters, user flagging), you don't need to care anymore wether it's a human or a robot behind the POST, because all the spam actually improves your training set. You defeat spammers with their own data.
- Goranek 14y agoHhahahaha, comment on the blog "Please post the Visual Basic codes for this. The language you post in the article is not Visual Basic. Thank you." xD God !
- borplk 14y agoIt's totally sarcasm
- raverbashing 14y agoWasn't there something about how 'high' sarcasm is undistinguishable from the real thing. Unfortunately I can't make the distinction, and I think it's most likely the commenter was serious
- mikeash 14y agoSounds like Poe's Law to me. http://en.wikipedia.org/wiki/Poes_law http://en.wikipedia.org/wiki/Poes_law
- hcarvalhoalves 14y agoNot sure it's sarcasm, more like some blackhat SEO who wants to exploit it.
- Osiris 14y agoI agree. With a name like Zhou, it sounds like a Chinese guy wants to try to use the code in the wild. I guess one plus for the MintEye captcha is that it's hard to defeat with only Visual Basic.
- quink 14y agoIt just works on so many levels. It really makes me wish for some kind of federated comments system or unique username so I can go out and find more of his work!
- boyter 14y ago
- borplk 14y agoI'd love to see MintEye respond.
- paulgb 14y ago"Like all CAPTCHAs, sliding CAPTCHA can be cracked . Still, it's more usable and mobile friendly" https://twitter.com/EyeOnTheMark/status/291837470486704129 https://twitter.com/EyeOnTheMark/status/291837470486704129
- buster 14y agoIts actually a super fun excercise to do. I did that years ago with a browser game that showed images on login, some years ago. Also with python. It was a fun learning experience because it's so much more visual then your typical "todo list tutorial" or "hello world".
- mistercow 14y agoThat's a really clever way of detecting the swirl effect. As for simply measuring overall sharpness, that could be thwarted by normalizing the FFT after swirling. That wouldn't help against the sum-of-edges technique though (in fact, it would make it worse).
- martinced 14y agoLove it. +1. But wouldn't an obvious answer to this be to use a background full of swirl, then add people onto it, then swirl again (so the background swirl is swirled twice). Then when you'd be "deswirling" with you code, you'll be finding something always swirled? maybe even use a background who's "swirled right" and then "swirl left" the "backgroung + people" (or nyan cat or whatever)?
- hcarvalhoalves 14y ago> Then when you'd be "deswirling" with you code, you'll be finding something always swirled? It wouldn't change what he is detecting, which is the sum of the edges.
- moccajoghurt 14y agoDid you read the article?
- flaviojuvenal 14y agoremembered me of how Interpol was willing to keep the reverse twirling capability as confidential: http://thelede.blogs.nytimes.com/2007/10/08/interpol-untwirls-a-suspected-pedophile http://thelede.blogs.nytimes.com/2007/10/08/interpol-untwirl...
- paulgb 14y agoFor those interested, the minteye captcha has been broken by other methods as well. Speech recognition: https://gist.github.com/4520930 https://gist.github.com/4520930 Laplace: https://gist.github.com/4564489 https://gist.github.com/4564489 Fourier transform: http://nbviewer.ipython.org/urls/raw.github.com/rjw57/minteye-captcha/master/captcha-test.ipynb http://nbviewer.ipython.org/urls/raw.github.com/rjw57/mintey...
- aidos 14y agoCould someone explain the general idea behind using FFT in these situations (excusing my ignorance)? I recall it from my university days but that was completely out of context. I know you can use it to decompose audio signals into frequency components, I don't understand how it applies to images though.
- kens 14y agoThe basic idea is that just as an audio signal can be decomposed into frequency components, an image can be decomposed into frequency components, but in two dimensions. (Imagine stripes of varying frequency and direction instead of sine waves of various frequencies.) Sharp edges in an image have high frequency components, just like a sharp transition in an audio signal. Filtering the high frequencies will blur the image, while filtering low frequencies will enhance edges. This is very oversimplified, but will hopefully give you a bit of an idea. I encourage people to learn more about Fourier theory, because it explains a lot. One introductory page that you may find useful is: http://cns-alumni.bu.edu/~slehar/fourier/fourier.html http://cns-alumni.bu.edu/~slehar/fourier/fourier.html
- aidos 14y agoThat makes perfect sense. Thanks for the link - that's given me a much better intuitive understanding. I'll have a dig around some of the other transformations mentioned now.
- deleted 14y ago[deleted]
- wrt54g 14y agoSince the algorithm can only detect the relative swirled amounts of a set of the same images, a solution could be to, rather than using a set of the same image, use a set of different images swirled different amounts (or with some other transformation), and the user must select the unmodified image.
- robomartin 14y agoThis is nitpicking. Well, maybe not. This code does not take a swirled image and solve it. It takes a set of images with various swirl levels and finds the one with shortest sum of edge lengths. The code does not do any un-swirling of the image. It also uses external libraries to convert to grayscale, apply the Sobel filter and the sum of edges. I other words, it is far from breaking the swirled CAPTCHA in 23 lines of Python. If you had to write the un-swirling, gray-scaling, Sobel filtering and summation code in Python you'd be looking at a much larger pile-o-code. The demo and the intent is good. I just wish the title didn't say "23 lines of". I don't think the article would have suffered at all if the title was "Breaking the MintEye image CAPTCHA with Python". Again, the intent and what is being demonstrated are excellent. The title, in my not-so-humble opinion, is hugely misleading.
- chmod775 14y ago>it is far from breaking the swirled CAPTCHA in 23 lines of Python Except it does break the captcha in 23 lines. I don't get your point. Why would he need to do any 'un-swirling' in the first place? That's not the point of the captcha. The captcha provides you with multiple images and you have to pick the least swirled one - which is exactly what his code does. And you argue that because he did use external libraries it's not 23 lines of python. Of course it is. He had to write only 23 lines that make up the logic to break the captcha. If you'd argue that one would have to add any previous work (or lines) done by other people to the linecount of your own project, I could also argue that 'print("Hello")' is not one line of python, because it uses some standard python library, which in turn calls native code, that native code would make a few syscalls and at some point resulting in multiple hundred lines of compiled kernel C code being executed. So the linecount of his 23 lines python script would actually be: 23 lines of python + various libraries + the entire Linux kernel = roughly 20 million lines of code. Good job. And yes, that was nitpicking. And I'm angry for some reason.
- cidquick 14y agoWell put. The title is indeed completely factual! Including '23 lines' was just to let people know at first glance that the solution is simple. > If you had to write the un-swirling, gray-scaling, Sobel filtering and summation code in Python you'd be looking at a much larger pile-o-code I would also like to point out these are also all very simple operations, which would only take a few lines of Python/C/whatever to do. Python just happens to have a pre-written libraries to save reinventing the wheel.