Toggle Main Menu Toggle Search

Open Access padlockePrints

A low-cost attack on a Microsoft CAPTCHA

Lookup NU author(s): Dr Jeff Yan, Ahmad El Ahmad

Downloads

Full text for this publication is not currently held within this repository. Alternative links are provided below where available.


Abstract

CAPTCHA is now almost a standard security technology. The most widely deployed CAPTCHAs are text-based schemes, which typically require users to solve a text recognition task. The state of the art of CAPTCHA design suggests that such text-based schemes should rely on segmentation resistance to provide security guarantee, as individual character recognition after segmentation can be solved with a high success rate by standard methods such as neural networks. In this paper, we present new character segmentation techniques of general value to attack a number of text CAPTCHAs, including the schemes designed and deployed by Microsoft, Yahoo and Google. In particular, the Microsoft CAPTCHA has been deployed since 2002 at many of their online services including Hotmail, MSN and Windows Live. Designed to be segmentationresistant, this scheme has been studied and tuned by its designers over the years. However, our simple attack has achieved a segmentation success rate of higher than 90% against this scheme. It took on average ~80 ms for the attack to completely segment a challenge on an ordinary desktop computer. As a result, we estimate that this CAPTCHA could be instantly broken by a malicious bot with an overall (segmentation and then recognition) success rate of more than 60%. On the contrary, the design goal was that automated attacks should not achieve a success rate of higher than 0.01%. For the first time, this paper shows that CAPTCHAs that are carefully designed to be segmentationresistant are vulnerable to novel but simple attacks.


Publication metadata

Author(s): Yan J, Salah El Ahmad A

Editor(s): Syverson, P; Jha, S; Zhang, X

Publication type: Conference Proceedings (inc. Abstract)

Publication status: Published

Conference Name: CCS 2008: Proceedings of the 15th ACM Conference on Computer and Communications Security

Year of Conference: 2008

Pages: 543-554

Publisher: ACM

URL: http://dx.doi.org/10.1145/1455770.1455839

DOI: 10.1145/1455770.1455839

Library holdings: Search Newcastle University Library for this item

ISBN: 9781595938107


Share