Good afternoon, everyone.
My name is Gustavo Vugo CSH.
I'm the old guard of Brazilian Hacking.
This is my second year in H2HC.
I think the first time I came was in 2012.
And now, in these last two years.
Although I always talk about more technical things, low level, this year I decided to talk a little about an experience I had last year, which was to participate in a call for papers, where there were votes, and people had to vote, but I'll talk about that in a little while.
But the idea was that I had to automate to vote for my paper, because I don't have that many friends.
It was really fun.
I want to share with you what I learned, because I don't really understand what's behind Computer Vision, or Optical Recognition of Characters, but I wanted to do this because I was really pissed off.
So, let's go.
What is CAPTCHA?
This ugly name here.
Complete Automated Public Turing Test to Tell Computers and Humans Apart.
Basically, it's a test that the site will do, to know if you're really a human, or if you're a robot.
But that's exactly what I wanted.
I wanted it to be a robot.
I wanted to make several votes for me, obviously.
So, I wrote...
Actually, the story was really funny, because I work at Intel with Rubira, with Gabriel, with Igor, we are doing the Brazilian Mafia at Intel.
The main language is Portuguese.
Marian, who is Austrian, or Tim, who is Russian, we have a few more Chinese on the team.
They are already learning several words in Portuguese, because if they don't, they get really pissed off.
So, it's really fun.
Well, anyway.
Continuing here, so as not to change course, I decided to write an article for the H2HC magazine, talking about all the details of breaking CAPT.
So, my presentation will be a little around this same subject.
So, like, how to do this first analysis, how to identify a CAPT by the other, and how to break the thing.
So, I decided to create a story here, of the dog and such, but for it to be, like, an analogy, because I didn't want to talk about it directly, I didn't want to expose who organized this call for papers.
So, I wanted to do something more fun.
So, I tried to do a little comedy, and speaking more technically, a little of what I did to break it.
So, just for those who didn't read, to go over here, what I wrote, is the story of Carlos Salo Humberto, who is CSH.
Who discovered this?
So, Carlos is the hero of the Gurizada, he is the guy who was penalized.
Salo is Carlos' popular friend, who has a dog, whose name I didn't give, but who is uglier than Humberto, who is Carlos' dog.
And the story I wrote in Reia, is more or less, Humberto is much prettier than Salo's dog.
But then, the score that Humberto was getting was very low.
Why?
Because Salo posted on Facebook that there was a contest, that they were going to travel to Bahamas, and their friends went there, not only gave a high score to his dog, which was uglier, but also zeroed Humberto.
And Humberto went to the last place.
And this made Carlos get pissed off.
So, any resemblance is a mere coincidence.
So, introduction, every time I talk about session, for those who are not used to it, but there is a session between the user and the server.
So , to make a request, all the cookies of the session, etc., considered a session, a solution would be a correct answer to the capture challenge.
So, if some letters appear there, the solution would be those letters that for us it is obvious, but for a computer it is not so obvious.
And a margin is a generic figure.
So, this is how the capture of this event appears.
And above I put an image, just with a word.
Because the type of software that does an analysis of an image and converts it to text is called OCR, Optical Character Recognition.
And let's agree that if you are a computer and you are going to read the first image, it is much easier to decode than the second.
Precisely, the capture, it puts this bunch of noise and puts the wrong letters, etc., to make it difficult for you to write a program to automate or to throw it inside an OCR software.
Then, when I came across this, because the step of the site, you had to create an account, to create the account, it showed the image, it had to have an email, then it sent a link to that email, you had to confirm the email to activate the account, and then you logged in with that account to make the vote.
So, it's more or less, you are already used to this, not only on voting sites, but any site where you want information, they don't give a damn about it.
So, my challenge was, OK, how am I going to do this?
I'm going to learn Computer Vision.
I even started to take a look, but I said, no, this is too complicated.
Use a ready-made tool.
Actually, I put it in reverse order, because I think the first thing I did was, oh, I'm going to see if anyone has already done this.
Then I found a lot of tutorials and scripts that said they broke and such, and obviously I tested it, and it didn't work the way I wanted.
Then I said, I'm going to have to learn this shit now, to do this.
But I said, oh , I have little time, because it was 30 days, I think, and we entered the Raffle for Papers, and there would be all the voting, and in the end they wouldn't give the result.
Then I said, well, I don't have time to learn all this, I have to find a way.
Then I saw that some of these sites that had tutorials to break CAPT, they used Tesseract, which I didn't know until then, but it's a tool from Google that does CR.
You pass the image and it gives you the CR.
But obviously, passing the first, it will do wonderfully well, the second, not so much.
Then I thought, no, ok, what do I need to know if I can break this CAPT?
Because if the guy changes the image every time I make a mistake, or, I don't know, blocks my IP, I don't know.
Then I started to think.
I took the URL of the image, opened a new tab, pasted the URL there, and started pressing F5 like crazy.
Every time I did this, the image would change, it would jump to one side, it would jump to the other.
Some details of the image remained the same.
Then I said, ok, I think I can break it.
I had never done this before, but I was indignant with this story.
My dog.
And then, no, I'm going to do this.
Then I thought, no, for the section, for the URL, I have to do a lot of things, like, if I keep pressing F5, there will come a time when it will change this image, or it will stop giving me this image, it will give me a 404 error, something like that.
Because I wanted to determine what is the temporality I have to keep capturing these images.
And then, of course, I tested other sites to have this table to help me understand this.
But basically, what are the criteria for me to determine if a captcha is breakable or not.
So, the more images you have, the better.
I will explain why.
And the question of the section.
So, if there is a section, a unique URL for the image, that you can get several images, or you can associate this section with the resolution, it is also a good thing.
Another important thing, if I submit a post with the captcha resolution, and this solution is wrong, the site that is evaluating this changed the captcha, like, changed it, in my case, I read four letters.
If I tried A, B, C, D, and it was not, if it will change the solution, it will remain the same.
Why is that?
Because if I can, if it remains the same, I can keep trying several times until this temporality no longer exists, or infinite, if it lets me do this indefinitely.
So, this is more or less what I put in my criteria.
It is funny that I am talking about this lecture, after watching Edgar and Thais' lecture, I already think that all of this could be the constraints of my solver.
And to know if a captcha is breakable or not, I could use an SMT to know if it is possible or not.
So, here is just an example of some images that you can see, like this, for example, UPSD, this U goes there, then U goes here, you see?
So, what did I do?
In order not to bother the guys with my IP, taking the images, I did, no, I will do a sample, I will take 50 sessions, 50 images of each session, then I can keep playing, creating my algorithms, see if I can filter this, and so, and break it.
And it was from there that I wanted a proof that it was possible to break it, before automating it.
For me, I think that the most difficult problem was to break the captcha.
Because then it is this automation, like creating an automatic e-mail, I found out there, Guerrilla Mail, I don't know if anyone knows it, but it is cool that you create a temporary account, while the session is open there, you can go to a website, create an account with that temporary e-mail,
it will send the e-mail, you don't need, there is even an AJAX API, that creates automatic users, and it is really cool.
So, decoding process, I put four steps, one, I will normalize this image, what does normalization mean, I will get into it, I do a pre-filter, and then I separate the letters, and I send each letter to Tesseract, because I found out that, because they keep dancing,
they put the letters in different angles, Tesseract didn't recognize it very well for me.
Maybe there are other options, or configurations of Tesseract that I don't know, because there are dozens, maybe hundreds of options in Tesseract, and I didn't have time, so I had to, I will separate these letters, because I think it is easier.
So, the first thing I did, I will make an histogram of these images, in width, I will take all the images, I will know how many pixels are in width, how many pixels are in height, I will see what the average is, and I will normalize all the images to the same size,
because I can then overlay them, and maybe there is something that I can see, in this story.
So, although you can't see it, but I think the average here is like 78 pixels in width, by, I think, 58, something like that, in height.
But this one you can see that it is more or less normalized, but this other one, the vast majority, is in that height there, and I think it was the height I used.
And then I realized that this line, I think, this is a trick they do, because the image with the lowest resolution is more difficult to break.
So, the higher the resolution, the more definition the images have, or the noise, it is easier for you to break the capture, because there are several ways for you to work the images, to reduce the noise.
But I found that there was a line here, I think there is another line there, and an arc, that has all the images.
So, when I normalized all my 2,500 images, and made a sum of all of them, and divided by the number of images, you can do this, OpenCV, I had to, I did all this stuff in Python, so OpenCV helped me, how to open an image, convert it to a matrix, all these things,
so far so good.
But, only with these images, I was able to extract these things, applying this average of all the images, on top of the images, you can see that the noise has decreased a lot.
Removing the peripheral part, around the image, it almost cleaned everything automatically.
But you can see that the thing is still a little strange, it is not very clear.
But then you have some things, I think I used two or three functions of OpenCV, to improve, because it has something that I think is, I forgot the name of the function, but it kind of agglutinates small spaces between, for example, in the C there, that has some flaws,
it will extend that shape, to try to complete it.
And then, once I did that, I think the hardest part was breaking the four letters, I tried a lot of things, like, you can see that there is a certain cloud here, between each letter.
I imagined, maybe if I take only these regions here, extract these regions after applying this pre-filter, extract each one of these, send it to Tesseract and see what happens.
I did that.
And I had a good initial result, I don't know, 20, 30% of the images, I was able to decode the letters.
But a lot of times, because of that dancing of the letters, there was a lot of pieces of the letter out of each one of these regions, and that got in the way.
So I had to use, again, OpenCV, there is a function that returns me, given this image, how many outlines do I have?
Then it goes and says, there are so many outlines.
Then, of course, you can see, for example, this T down here, it would tell me that there were two outlines, or regions of outlines, which is the T itself, and there is a dirt down there.
So, for example, that other H there, from 40 to 40, there is a dot in the middle of the H, and there is also a dirt up there.
So I had to do, I have N outlines, then I made the algorithm, there is an outline inside another outline, and I will consider making a union of these two outlines, then I say, what is the size that I have of my width of each outline, adding all of them,
does it make sense to have four letters?
Because if there were more...
Then I did something kind of rough, just to separate, when I think that the thing is not very good, I discard that image, and I try to find a new image on the site.
But this was my proof of concept, I am doing this on top of my 2,500 images, to know if my algorithm will work, before I lose my time automating that.
And...
I think this is where I lost more of my time, to try to do things, just to write this little Python, to make the letters pretty, and that took me some time.
But it helped me to have a general vision, like, I think the algorithm is good, I think it is not.
And then I did a statistical analysis, of each of the letters.
So, for example, the first set of images, I apologize to those of you who cannot see well, but I will try to explain more or less.
But the first set of images, the first letter, sorry, the second letter, which is this first image here, the solution is R.
But the tesseract of the 15 images that it decoded...
Wait, let me do...
No, I am not on my computer.
Damn.
This is a Google Spreadsheet.
You can send me an e-mail, I can share this spreadsheet with you, you can look at the numbers.
But the idea is...
The tesseract does not give me the correct answers sometimes.
It told me twice that it was a C, four times that it was a D, once that it was an O, once that it was a P, once that it was a Q, and six times that it was an R.
The right answer was an R.
But as you can see, it is not very precise.
It is really rough.
So...
My message to you is that image decoding is an analog process.
I do not know if...
I was talking to someone on Friday who told me that there is a tool that breaks captures, that makes automatic filters, and it already breaks.
I was interested, because I did not find this tool when I researched it.
So, maybe there are more automated ways, but...
I went through this to try to understand and make a shortcut in this process.
And...
And this is what I wanted to share.
So...
My conclusion was that image decoding is an analog process.
In my case, I have to have a function that decodes, passes as a parameter an image, and I return four letters.
It may be that the third-party cannot interpret any letter, or it may be that that letter is not the correct answer.
So...
There is a high error rate.
After I made the presentation...
For the first time in my life, I finished a presentation before half an hour of my presentation.
So I'll have to remember the lies I'm going to tell you.
So sometimes I'll get stuck, but...
Let's go.
So, it's a statistical process.
If the number of images is infinite, it is certain that you will get a capture.
This is kind of obvious.
If the number of attempts is infinite, it is also kind of obvious that you will be able to crack, but you can also use brute force.
So, in my case, there are 26 letters in the alphabet, in the fourth power, if there is a number of combinations to get the capture.
So if there is a small latency in the network, with the network of the contest, it trolls the guys, and then it breaks.
And...
Here I made an histogram with the four letters and...
the axis of the Y will tell me how many images it was able to decode from each of my image sets, which are 25.
So there are 25 sets of four bars there.
So you can see, for example, the fourth letter, there are some places where it was able to decode very few letters.
And...
But I was calm, because I thought, but it is obvious that if I can map this number of things, I can guess what the capture is.
And this is, I think, the great moral of the story.
I will try to go a little in my algorithm to detect who has more statistical knowledge will understand this directly, who doesn't, I will try to be a little didactic.
But the idea is the following, let's say that my initial state is the first line there.
In the first line I have no letter that I was able to decode and no letter from that set of five letters or...
that set of letters that I have, of possibilities.
So, when my script processes the first image, the Tesseract returns three letters, T, R, C, and I couldn't decode the fourth letter.
So I will enter my frequency table that will have there, well, I have one T in the first, one R in the second, one C in the third, and I have one unknown in the fourth letter.
Then the question is, could I make some attempt to decode?
No, because I don't have enough information, right?
So I go on, until, for example, in the third image a K appears in the fourth letter.
So I have here, for example, the T, I analyzed three images and the Tesseract returned three times the letter T.
I said, wow, this gives me hope that the first letter is the T.
In the second letter it gave me two R's and one unknown.
So I have a 66% chance to know that the second letter is R.
My other 33%, or my other third, tells me that I have no way to evaluate.
In the third letter, the same thing, I have 66% chance that it is a C and 1% chance that it is a G.
In the fourth letter I have 66,666, or 2% chance that it is that I don't know and one third that it is a K.
Then I made an algorithm that thought like this, what is the most obvious to try?
I get the letters in the highest frequency in each of the positions And this is the one I'm going to try.
And if it doesn't work, well, if it doesn't work, I'm going to start doing a simulation of a lot of things.
I'm going to take a dice, I'm going to start throwing a dice, and I'm going to try to know what the letters are.
And that's what I did, but notice that in the third image, my script will try to guess the CAPTCHA.
It will try to say that it's T, R, C, K.
And the site will reject it, saying, no, this CAPTCHA is not valid.
What do I do?
I take this attempt and throw it in a table of attempts that didn't work.
I'm only going to have another letter in the fourth house, here, at this point.
But at this point, my whole scenario has changed.
I'm going to have...
Sorry, let me go back a little before.
Since I have K in the fourth house, I'm going to have...
But in the third image, I only have...
No, actually, it even makes a permutation.
Because I have the possibility of being T, R, G, K.
Because in the second image, it said it could be a G.
Is that it?
That's it.
So my script will take and play randomly, based on the weight.
So it will take, for example, for the first letter, I have 3 T's, 2 R's, 2 C's and 1 G.
So it will make, in each of the groups, a random sample with weights.
And it will try this other one without.
So it could try, there, in the fourth image, it could try T, R, G, K, which would also fail.
It takes this password, puts it in the attempt table, which were not successful.
And so it goes.
So, for example, in the fifth line, it introduces an O, then it introduces an I and an F.
And that's where it will be stuck.
So, while it is capturing the images and updating the frequency table, the algorithm that tries to generate, the combinations of the answer will be running in parallel.
But it will always try, this is what I did, it will always try the one with the highest frequency before trying to make this random attempt.
And when I did this, I tested it several times, I was improving my filter algorithm of the image, and I managed, out of my 50 samples, I managed to break 48 of them.
Just doing these tricks.
Some had like 400, 500 attempts to get to the right answer, but they did it.
So, I put here, like, what are the results.
In the first letter, 57% of the images managed to decode, whether it is the correct one or not.
Like, Tesseract can see an A, but it will tell you that it is a, I don't know, a symbol of truth, or, I don't know, upside down, I don't know.
It gives a crazy code, which I assume is null, which is not inside, between A and Z, I consider it to be garbage.
But, incredibly, my process of filter and letter separation gave me all these results.
And then, I managed to decode the solution, like, the first letter, 100%, the second letter, 98%, because two cases failed, I think, the third letter, the same thing, the fourth letter, 100%.
And this is what is interesting.
Like, the solution is inside the most frequently decoded letter, which means that, from A to Z, let's say I have decoded 50 images, I have 40 Zs, is this Z the solution?
In 76% of the cases, yes.
The second letter, in 70% of the cases, no.
In other words, I...
Actually, the process I did was to get to this point, and then I decided, no, I will have to go back and do that random weight sample to improve it.
Because this made...
That algorithm I explained to you before, of the random weight sample, made me raise my solution from 76% of the cases, from the first letter, to 100%.
Because then it is not always focused on what has the highest frequency, it tries to catch all the letters it managed to decode.
So, in summary, of this decoding process, having the sample, making a way to automate, like I did, 50 sessions, 50 images each, I can work without alerting the organization of the contest, or whatever, because I can work this locally, manipulate the images,
make the filters, I don't need to automate all this stuff now, it gives me a good idea to know, well, I think this is going to work.
And when I got to this point, I said, no, it's cool.
So I can start automating.
I made some quizzes here for you, because the idea I want to pass is that maybe one captcha is different from another captcha, right?
And then I got a government website that I knew had online voting, and then I did what I...
I took the URL of the image, opened another tab, I pressed 7 times refresh, although you don't notice, first, it's the same captcha.
Second, the letters don't dance, so it seems to be easier to break.
The only thing that changes is the noise they add.
So, for example, here you have some dots here, which are not here, here are others, and so on.
Then I thought, ah, this is very easy to break.
You just apply a simple filter, pass it to the tesseract, I even believe that if you pass this directly to the tesseract, it will decode directly, and then you already have the answer of the captcha.
Like...
Very easy.
This is another captcha.
This one is cool, this kind of captcha, because it applies...
it's a simple equation, like 7x4, 9-1, 4x1, blah, blah, blah.
You have to give the right answer.
If you miss the answer, it gives you another equation.
So , like, it's good to have an algorithm of image analysis, to be able to make all the necessary filters, so that you can decode that in text, and then be able to make the resolution.
It would even be cool to make a little thing there, like an eval, something like that, and then...
It would also be cool to...
This is what I'm thinking about now.
But if you wanted to break the breaker, it would be cool to put it there, if it's doing an eval, to make an exploit here, then the tesseract decodes it, puts it in the eval, and you open a shell in the cracker.
That would be cool.
This was another one, this captias.net, another site I saw, and although you can't see it, it bends the letters a little, but they stay in the same angle.
So, it generated these random letters, it generated more or less the angle of each letter, and it remained the same.
The only difference is that it added a lot of random noise in the background.
So, again, this with...
a basic image manipulation, you can take all this noise and send it to the tesseract to break it.
The interesting thing about this is that this site that provides this solution, I think it's in PHP, I don't remember now, they keep, they give you the same image with the same answer several times.
So, for me, this is a failure.
So, the more dynamic the answer is, the error, it generates a totally new thing.
Like Google's Recaptcha, which shows some sentences...
Actually, Google's Recaptcha is a separate chapter, maybe I could make a whole presentation about it.
I looked at it, discovered several things.
One, Google's APIs keep looking at where you are moving the mouse, where you are clicking, and so on.
And then it tells you, ah, you are not a robot.
So, every time you enter a site that will show like this, Google's robot verification, and it already gives a little OK, that you can continue, it's because it's looking where you are going to have the mouse, where you are clicking, and assuming that,
analyzing the set of these events, that you are not a robot script.
If it thinks that you are not moving the mouse enough, it shows you those things like, ah, identify traffic signs in these images.
Then you go there, you have to keep clicking about four times.
But I discovered one thing.
I'm sorry, it was very interesting.
I'm just opening a parenthesis here for this Google thing.
If you have vision problems, or are blind, Google's Captcha will put you in the old ReCaptcha, because it shows two words, all distorted, but you have the option to hear what is in that word.
Then I heard this and said, ah, but I'm going to research about it.
Because, in my opinion, I think that our hearing is much worse than our vision.
So, you show some things like this, most human beings can read, but because the noise level is very high.
But now, what kind of noise are you going to put in audio?
Because I'm talking to you here without any noise, maybe you don't understand a word I've said, and verbal communication is much more difficult than written communication.
This is a fact.
Then I found a guy who wrote an article that he took the output of this ReCaptcha, that is, when Google asked him, he said to Google that he was blind, showed this, and he threw the audio of ReCaptcha for a dictation like this, I think it could even be from Google,
to translate, to make the description of the voice, and then he just used Google's API, by Google's API, and broke ReCaptcha.
But anyway, the site I went to, the guys are not even there for those who are blind, so you had to see it to break it, there was no such option.
Which is exactly what I did, I put it as a home theme, because maybe one day, if I'm a little boring, I'll do this, which must be different.
Because I think that's what he did.
I think this is the site, but I don't remember.
If not, it will be something else cool about ReCaptcha, I put it here for some reason.
And that was it.
I mean, this is my name, my email, you can find me.
I think we have time.
I have ten minutes.
I broke it here in three points, which was what I did later to automate this vote, just in terms of curiosity.
But the idea is, I have the registration part, I have the confirmation part, and I have the vote part.
Once I reached a result, adequate to break the Captchas, then I set up a program to go there, I generate a random name, a random email, I talk to Guerrilla Mail there, I registered an email here, with a password, I go to the site, I try to kill the Captcha,
I take there, I don't know, half a dozen images, ten images, it breaks, and then I receive the email, I click on the link's email to activate that account, then I log in and post the vote.
Of course, my first version took, I don't know, about two minutes, I think, to do all this process.
Then I broke it in...
Actually, I started breaking it in two scripts, one that created the accounts, and another that only voted.
Then I got all this, and I made a thread that only analyzed the images and sent them to Tesseract, updating my frequency table, while another thread only did the permutations, and generating random accounts, and trying to get the password in parallel.
Once he got that password, there was another thread that was just to confirm the email, but it already sent the other thread that was capturing the images and cracking, like, start a new session, start a new session, then I was able to automate it.
Then I created, like, what?
About 20,000, 30,000 accounts.
And then I started voting, and voting, and voting, and voting, and then I left the dog of the others with zero, on average.
But then the thing kind of got out of control.
Like, the guys from the event said, like, the first thing that got out of control, I asked them to vote, and, like, it took about two minutes for them to compute the vote.
Damn, the system crashed.
What the fuck did I do?
Then I came to the conclusion that, no, it can't be.
I had voted this, I don't know, about 10,000, 15,000 times.
Then I kept thinking, like, no, there's something wrong.
Then I thought, well, what do I think the guys are doing?
There must be a table there, or whatever, that must have, like, what is the TOC, what is the username, I don't know, with a foreign key, and what is the password, like, the note that you gave for that lecture.
And then, when it showed the website, it should select that table, and then it would do the average, and put it on the screen.
So I think that when I did 10,000, it was kind of rough to go through the whole table, so it took a long time.
Then the guys went on Twitter and said, like, we're going to use our own criteria, it won't be the one with the biggest table.
Then I was like, okay, cool.
So, like, I know the guys and stuff, like, who knows, it will work out.
Then, in parallel, they changed the system, from one time to another, it was fast.
Like, I was like, wow, they changed the system.
And they really did.
Like, that's what they did.
Like, they updated it right away.
Keep the number of votes and the sum of all scores, divide one by the other, so you can have the average, right?
And then it got faster.
Then I was like, okay, I kept going, I put another 30,000 votes there.
There was a week left on the tie.
Then the guys went on Twitter and said, like, now we've changed the criteria, the criteria will be the one with the biggest table.
I was like, holy shit.
Because I had put myself between the 5th and the 6th, so as not to draw attention.
But I basically chose who was going to give the lectures, because I said, man, this lecture seems to be cool, so I'm going to give a higher grade to this guy.
And so it went.
Then, after I saw in the whole story that it wasn't going to work, I said, okay, so I'm going to change my...
There were about two days left.
Okay, I'm going to change all the photos I took.
Then I took it like this, no, okay, so I'm going to make the average of my talk be pi.
3.14, 15, something like that.
So I kept doing it, changing the grades, to see if it was closer to pi or not.
Until I converted the value.
And it was a lot of fun.
Obviously, I got an email saying, oh, you weren't selected, and such.
But there's no time for fooling around, right?
I did this presentation here, they're going to do the same thing again, I doubt they'll change the caption thing, and I'm going to make fun of them again.
But the title of my lecture will be How They Made Fun of Call of Papers.
I don't think they're going to accept it.
But I'm going to try.
Then I put it here, like, you know, to make it complete, in quotes, right?
But how would you protect against CAPTCHA ideas?
Oh, I don't have any, I like to break things, I don't like to protect.
But if you have ideas, if you want to share, or if you have questions, that's it.
That's it for now.
Let's open for questions.
I'm going to ask.
First question.
Very cool lecture.
My question is this.
You said that the automation process was a little boring.
What did you use to automate?
Especially that part, I don't know, a Selenium or something like that?
No, I used Python.
Pure Python?
Get, host, everything in the arm.
Here's Selenium's tip for you.
Ok, I'll take a look.
By the way, in the article I wrote in the magazine, there's an URL where I put all the Python scripts I wrote to do this analysis in the samples.
So , all those images I generated, you can generate with the scripts I left there.
Any questions you have, send me an email.
I think the guerrilla mail part and the automation of the bots is not there, but whoever wants a tip, just send it to me, I'll help.
Good lecture, I liked the research, it was interesting.
Gustavo, suddenly you try to work on an algorithm that would vectorize the letters and give a certain score.
For example, you take a letter without any noise, generate its vectorization, give it a score, and then you try to break all those letters, even dirty ones, try to vectorize what is more solid, and try to get an approximation inside it, because even if it is dancing,
you, by its outline and texture, you would have more or less a number close and you start working with this type of vectorization and score.
So, for example, even if I take two very close letters, but they are different, one would always have a higher score.
And see if this would really work with CAPTCHA.
I think you are right, but I don't know.
I think this is the path of computer vision that I didn't have time to enter.
I think it makes sense what you are saying, but I don't have this knowledge.
I even think I could vectorize these letters, but I don't know what I would do next, you know?
Like, how do I make them all the same?
How do I compare one to the other?
Which, in fact, is the basis of machine learning and computer vision, of having all these things.
Like, I saw several articles that said how to break CAPTCHA when I researched there, ah, you will use TensorFlow.
Because then I think the knowledge base that I would have to have to make this useful to me, it would take a long time, I think.
And then there would be no time for me to vote in the thing.
I think that was the interesting thing, you know?
Because I always liked to understand things in a complete way.
And time was never a factor.
I was never good at capturing the flag, because I like to have time to look, like, ah, I'm not good with time.
But this made me take away my perfectionism of trying to have the basic knowledge for later, to solve the problem, to be more practical.
Because I was pissed off with the guys, you know?
I mean, I wasn't pissed off with the organizers, I was pissed off with the guys that had, I don't know, for example, a professor from a college.
How many guys doesn't this guy have to vote?
It has nothing to do with this thing of information.
So, the moral of my story, of this story that I think, if you want to make an online vote, don't do it.
Because I think that, like, specifically in this issue of the Call of Papers, you know?
Like, for other things, yeah.
But I don't know, like, those things like Big Brother and such, that you can vote and such.
Maybe it's a cool thing to take a look to see if...
It would be cool, right?
Find one of those datacenters from Globo and then you get a cheap virtual hosting and a match post.
It would be cool, right?
Any other questions, guys?
Well, as you may have seen, I had a lot of fun.