List of weakness
Jeans
Found at http://www.jeans.com.ua/sms/.
One more mobile operator - Jeans. Guys who made this CAPCTHA was inspired by Rapidshare CAPCTHA. But they don't trace it's changings - such model was hacked very quickly. Due to color model separating to chars is very easy. Then neural network makes the rest.
UMC (ver 0.2)
Found at http://www.umc.ua/ukr/sendsms.php.
New version of UMC CAPTCHA is much better then previous (see demo). Char overlapping is great. BUT - it's random there, so, sometimes there is no overlaping at all. And, of course, the char color. Thank you very much for making overlapped chars with different colors. Due to this feature overlapping means nothing, and gives no additional obfuscation. Must say that readability went down - it's now not too easy to read it correctly.
Kyivstar (ver 0.3)
Found at kyivstar.net/sms/.
The third incarnation of Kyivstar CAPTCHA is much easier then previous. In general - nothing to speak about. It's almost the same as old UMS and first KS CAPTCHAs - see OCR demo at our site.
MTS-Bashkortostan
Found at: http://www.bashkortostan.mts.ru/mymts/sms/sending/form.php
One more with same font, same size, similar position. Easy to recognize.
MTS
Found at: http://sms.mts.ru/cgi-bin/cgi.exe?function=sms_send&isFree=1
Very interesting feature. Not bad CAPTCHA, but look to URL of the picture... it is http://sms.mts.ru/cgi-bin/cgi.exe?function=sms_show_antispam_image&ImageNumber=335&time=26206_83200_5 Do you see something interesting? :) I see the following: ImageNumber=335. Let's set couple of experiments... you can check yourself, but allowed numbers are only 3-digits. What does it mean? It means - only 1000 pictures there, and all of them are numerated! Let's calculate... I personaly can recognize near 1 picture at a second, typing it takes 1 more sec. So, to make a database with full number-message set takes near 2000 seconds, halfhour :) Work for one hour if work not too fast. And no OCR needed :)
But! We are here to see what CAPTCHA is implemented there. And it is strong enough. But beatable, of course. Weak noise, but same font.
Kyivstar (old one, v0.1)
Found at: http://www.kyivstar.net/en/sms
As UMC, it has same font, same size, same position. And still too easy to recognize. We have done it in php too.
UMC (ver 0.1)
Found at: http://www.umc.ua/umc_sendsms_u.php
Same font, same size, same position. Too easy to recognize. We even done it in php.
- F.A.Q.
Q: What does this list include?
A: This is the list of CAPTCHAs we found, which are easy to break, and we are either already broke it or we are absolutely sure we can do this.Q: What do you mean telling "broke"?
A: This mean that we have working application which takes image and outputs the text written on it with accuracy which allows to make automation process reasonable (or we sure we can do this).Q: Can you check CAPTCHA on my site and tell me it it's secure enough?
A: Yes, we can. Contact us.