Gmail crack causes spam flood

The software tool used by Google's Gmail to stop spammers has been cracked, leading to a big increase in spam sent from Gmail accounts last month, according to security firm MessageLabs.

Most Web services use a type of "Captcha" programs when signing up users for an online account. They typically consist of a box with some characters, either distorted or displayed against some noisy background, and you have to type the letters and numerals in exactly as you see them before the system will accept your sign-in.

MessageLabs created this graphic that shows how a bot fakes out a captcha and uses the newly created e-mail accounts to send out spam.
(Credit: MessageLabs)

They are designed to catch, or stop, automated programs called bots that are written to create new accounts for spammers to use. Annoying as the captcha systems are, they have been successful in keeping bots out, until recently.

Yahoo Mail and Hotmail captcha mechanisms were broken in July 2007, according to MessageLabs. And now, Gmail has succumbed.

As a result, the proportion of spam sent from Gmail accounts doubled from 1.3 percent in January to 2.6 percent in February, mostly promoting adult-oriented Web sites, MessageLabs says.

A Google representative said she could not confirm or deny that the captcha method used in Gmail had been broken, but did confirm that there had been an increase in spam recently.

The Gmail captcha problem was reported in late February by another security firm, Websense.

Gmail is an attractive target for spammers because a Google account is free and offers access to a wide range of services. Also, Google domains are unlikely to be blacklisted, Websense says.

This screenshot shows network analysis of a bot cracking Gmail's captcha mechanism, a more sophisticated attack than one used to crack Live Mail's captcha technique, Websense says.
(Credit: Websense)