Spam originating from Google's Gmail domain doubled last month, showing spammers are still defeating the CAPTCHA – the distorted text meant to thwart mass registration of email accounts and other website abuse.
Gmail spam went from 1.3 percent of all spam email to 2.6 percent in February, according to data released by email security vendor MessageLabs.
The new statistics are another nail in the coffin for CAPTCHA – which stands for Completely Automated Public Turing test to tell Computers and Humans Apart.
Google is the latest free webmail provider to be victimised by spammers' efforts to create software to solve the codes. At times, spammers also employ people to solve the codes en masse.
"It's only a matter of time before [CAPTCHAs] are comprehensively defeated," said Paul Wood, senior analyst at MessageLabs, which has predicted a spam bonanza in 2008.
Last month, security vendor Websense ascertained that spammers were using two hosts to crack Gmail's CAPTCHAs. The method appeared to be successful only 20 percent of the time. But if the procedure is repeated thousands of times, many new accounts can be generated and used to send spam.
Most of the messages use links and images to advertise adult entertainment sites, Wood said.
While other vulnerable domains can simply be blocked by antispam software, businesses are reluctant to cut off free webmail providers because of their legitimate use, he said. Spam from webmail providers comprises 4.2 percent of all spam.
Google's CAPTCHA system is considered hard to crack, but so once was Yahoo's, which is also now regularly beaten. MessageLabs said 88.7 percent of the spam from free webmail providers comes from Yahoo's domains.
Microsoft's CAPTCHA, used for registering accounts on its Windows Live Mail service, has also been cracked. Websense believes the same group of spammers are responsible for breaking both Google and Microsoft's systems.
Wood said MessageLabs provides Google and other companies with data that helps fight spam.
MessageLabs sells a security service to companies, filtering email before passing it to their 17,000 customers. Per day, the company snags 2.5 billion spam messages from a total of more than 3 billion messages.