A low-cost attack on a Microsoft CAPTCHA

  1. Lookup NU author(s)
  2. Dr Jeff Yan
  3. Ahmad El Ahmad
Author(s)Yan J, Salah El Ahmad A
Editor(s)Syverson, P; Jha, S; Zhang, X
Publication type Conference Proceedings (inc. Abstract)
Conference NameCCS 2008: Proceedings of the 15th ACM Conference on Computer and Communications Security
Conference LocationAlexandria, Virginia, USA
Year of Conference2008
Legacy Date27-31 October 2008
Volume
Pages543-554
ISBN9781595938107
Full text for this publication is not currently held within this repository. Alternative links are provided below where available.
CAPTCHA is now almost a standard security technology. The most widely deployed CAPTCHAs are text-based schemes, which typically require users to solve a text recognition task. The state of the art of CAPTCHA design suggests that such text-based schemes should rely on segmentation resistance to provide security guarantee, as individual character recognition after segmentation can be solved with a high success rate by standard methods such as neural networks. In this paper, we present new character segmentation techniques of general value to attack a number of text CAPTCHAs, including the schemes designed and deployed by Microsoft, Yahoo and Google. In particular, the Microsoft CAPTCHA has been deployed since 2002 at many of their online services including Hotmail, MSN and Windows Live. Designed to be segmentationresistant, this scheme has been studied and tuned by its designers over the years. However, our simple attack has achieved a segmentation success rate of higher than 90% against this scheme. It took on average ~80 ms for the attack to completely segment a challenge on an ordinary desktop computer. As a result, we estimate that this CAPTCHA could be instantly broken by a malicious bot with an overall (segmentation and then recognition) success rate of more than 60%. On the contrary, the design goal was that automated attacks should not achieve a success rate of higher than 0.01%. For the first time, this paper shows that CAPTCHAs that are carefully designed to be segmentationresistant are vulnerable to novel but simple attacks.
PublisherACM
URLhttp://dx.doi.org/10.1145/1455770.1455839
DOI10.1145/1455770.1455839
ActionsLink to this publication
Library holdingsSearch Newcastle University Library for this item