The Vulnerabilities of the New “No CAPTCHA ReCAPTCHA”

#1

Post by FunCaptcha_Jim » Wed, Jan 07, 2015, 12:44 AM UTC

The Vulnerabilities of the New “No CAPTCHA ReCAPTCHA”
funcaptcha.co

Re: The Vulnerabilities of the New “No CAPTCHA ReCAPTCHA”

#2

Post by FunCaptcha_Jim » Wed, Jan 07, 2015, 12:48 AM UTC

Hey all, this is a blog post that aims to simplify the findings from Egor Homakov in early December (http://homakov.blogspot.in/2014/12/the-no-captcha-problem.ht...). We've included a video (http://youtu.be/718EOIoWKAE) of a major exploit in action and chat about the implications of Mr. Homakov's findings. Hope you enjoy reading it as much as I enjoyed writing it. Any questions, fire away!

Re: The Vulnerabilities of the New “No CAPTCHA ReCAPTCHA”

#3

Post by mtmail » Wed, Jan 07, 2015, 1:02 AM UTC

FunCaptcha_Jim wrote: post #2

Hey all, this is a blog post that aims to simplify the findings from Egor Homakov in early December ( http://homakov.blogspot.in/2014/12/the-no-captcha-problem.ht... ). We've included a video ( http://youtu.be/718EOIoWKAE ) of a major exploit in action and chat about the implications of Mr. Homakov's findings. Hope you enjoy reading it as much as I enjoyed writing it. Any questions, fire away!

So issue #2 is about click jacking. The same security consultant tweeted 3 days later it was fixed. https://twitter.com/homakov/status/541636430712156160

Re: The Vulnerabilities of the New “No CAPTCHA ReCAPTCHA”

#4

Post by FunCaptcha_Jim » Wed, Jan 07, 2015, 1:23 AM UTC

mtmail wrote: post #3

FunCaptcha_Jim wrote: post #2

Hey all, this is a blog post that aims to simplify the findings from Egor Homakov in early December ( http://homakov.blogspot.in/2014/12/the-no-captcha-problem.ht... ). We've included a video ( http://youtu.be/718EOIoWKAE ) of a major exploit in action and chat about the implications of Mr. Homakov's findings. Hope you enjoy reading it as much as I enjoyed writing it. Any questions, fire away!

So issue #2 is about click jacking. The same security consultant tweeted 3 days later it was fixed. https://twitter.com/homakov/status/541636430712156160

We actually tested the theory as of yesterday and it was still possible, re: the video we posted up: https://www.youtube.com/watch?v=718EOIoWKAE

Re: The Vulnerabilities of the New “No CAPTCHA ReCAPTCHA”

#5

Post by mtmail » Wed, Jan 07, 2015, 1:39 AM UTC

FunCaptcha_Jim wrote: post #4

mtmail wrote: post #3

Earlier quoted context omitted.

So issue #2 is about click jacking. The same security consultant tweeted 3 days later it was fixed. https://twitter.com/homakov/status/541636430712156160

We actually tested the theory as of yesterday and it was still possible, re: the video we posted up: https://www.youtube.com/watch?v=718EOIoWKAE

thanks! I didn't notice the video was new.

Re: The Vulnerabilities of the New “No CAPTCHA ReCAPTCHA”

#6

Post by FunCaptcha_Jim » Wed, Jan 07, 2015, 1:45 AM UTC

mtmail wrote: post #5

FunCaptcha_Jim wrote: post #4

Earlier quoted context omitted.

We actually tested the theory as of yesterday and it was still possible, re: the video we posted up: https://www.youtube.com/watch?v=718EOIoWKAE

thanks! I didn't notice the video was new.

No problem :)