Home > Research > Publications & Outputs > A simple generic attack on text captchas

Electronic data

  • simple-generic-attack-text-captchas

    Rights statement: Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author’s employer if the paper was prepared within the scope of employment. NDSS ’16, 21-24 February 2016, San Diego, CA, USA Copyright 2016 Internet Society

    Final published version, 811 KB, PDF document

    Available under license: CC BY-NC: Creative Commons Attribution-NonCommercial 4.0 International License

Links

Text available via DOI:

View graph of relations

A simple generic attack on text captchas

Research output: Contribution in Book/Report/Proceedings - With ISBN/ISSNConference contribution/Paperpeer-review

Published
Publication date22/02/2016
Host publicationNDSS Symposium 2016
Number of pages14
<mark>Original language</mark>English
EventNetwork and Distributed System Security Symposium 2016 - Catamaran Resort Hotel & Spa, San Diego, United States
Duration: 21/02/201624/02/2016
http://www.internetsociety.org/events/ndss-symposium-2016

Symposium

SymposiumNetwork and Distributed System Security Symposium 2016
Abbreviated titleNDSS ’16
Country/TerritoryUnited States
CitySan Diego
Period21/02/1624/02/16
Internet address

Symposium

SymposiumNetwork and Distributed System Security Symposium 2016
Abbreviated titleNDSS ’16
Country/TerritoryUnited States
CitySan Diego
Period21/02/1624/02/16
Internet address

Abstract

Text-based Captchas have been widely deployed across the Internet to defend against undesirable or malicious bot programs. Many attacks have been proposed; these fine prior art advanced the scientific understanding of Captcha robustness, but most of them have a limited applicability. In this paper, we report a simple, low-cost but powerful attack that effectively breaks a wide range of text Captchas with distinct design features, including those deployed by Google, Microsoft, Yahoo!, Amazon and other Internet giants. For all the schemes, our attack achieved a success rate ranging from 5% to 77%, and achieved an average speed of solving a puzzle in less than 15 seconds on a standard desktop computer (with a 3.3GHz Intel Core i3 CPU and 2 GB RAM). This is to date the simplest generic attack on text Captchas. Our attack is based on Log-Gabor filters; a famed application of Gabor filters in computer security is John Daugman’s iris recognition algorithm. Our work is the first to apply Gabor filters for breaking Captchas.

Bibliographic note

Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author’s employer if the paper was prepared within the scope of employment. NDSS ’16, 21-24 February 2016, San Diego, CA, USA Copyright 2016 Internet Society