RECENT RESEARCH IS sug¬gesting that Google's audio capture is the latest in a string of CAPTCHAs to have been defeated by software.
A CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans
Apart), is the squiggly hard to read let¬ters that many sites now have you enter to prove you are human.

Image CAPTCHAs for Google, Win¬dows Live, and Yahoo! have been bro¬ken in recent months, and is believed to account for the increasing levels of spam that are coming from webmail services that those companies provide. It has been theorized that one cost¬effective means of breaking audio cap¬tures and image captures that have not yet had automated systems developed is to use a mechanical turk and pay low rates for per-CAPTCHA reading by humans, or provide another form of motivation such as access to adult sites for reading the CAPTCHA. However, it always required a significant level of resources to achieve.



The development of software to auto¬matically interpret CAPTCHAs brings up a number of problems for site oper¬ators - in particular, software that can rapidly interpret the tests effectively negates any barrier to entry that the CAPTCHA once represented. Audio CAPTCHAs are a means to allow vision-impaired Internet users access to site areas that they would otherwise be denied to. Much like the image counterparts, audio CAPTCHAs apply distortion to a set of numbers or letters that are read out in a small audio file. The idea is that a human is able to efficiently disregard the distor¬tion and interpret the characters being read Qut while software would struggle with the distortion being applied, and need to be effective at speech to text translation in order to be successful.

The problem, as discovered by Win¬tercore Labs and published at the start
of March is that there are repeatable patterns evident in the audio file and by applying a set of complex but straight for¬ward processes, a library can be built of the basic signal for each possible character that can appear in the CAPTCHA.
Wintercore point to other audio CAPTCHAs that could be easily reversed using this technique, includ¬ing the one for Facebook.

The wider impact of this work might take some time to appear, but it provides an interesting proof of breaking audio CAPTCHAs. At the least, it shows that both of Google's CAPTCHA tools have now been defeated by software and it should only be a matter of time until the same can be said for Microsoft and Yahoo!'s offerings. Even with an effectiveness of only 90percent, any failed CAPTCHA can easily be reloaded for a second try. Even though Wintercore have declined to release their tool, the increasing awareness of the capabilities described should see competing tools emerge in the near future.