Final published version
Research output: Contribution in Book/Report/Proceedings - With ISBN/ISSN › Conference contribution/Paper › peer-review
Research output: Contribution in Book/Report/Proceedings - With ISBN/ISSN › Conference contribution/Paper › peer-review
}
TY - GEN
T1 - A low-cost attack on a Microsoft captcha
AU - Yan, Jeff
AU - El Ahmad, Ahmad Salah
PY - 2008
Y1 - 2008
N2 - CAPTCHA is now almost a standard Security technology. The most widely deployed CAPTCHAs are text-based schemes, which typically require users to solve a text recognition task. The state of the art of CAPTCHA design suggests that Such text-based schemes should rely on segmentation resistance to provide Security guarantee, as individual character recognition after segmentation can be solved with a high Success rate by standard methods such as neural networks. In this paper, we present new character segmentation techniques of general Value to attack a number of text CAPTCHAs, including the schemes designed and deployed by Microsoft, Yahoo and Google. In particular, the Microsoft CAPTCHA has been deployed since 2002 at many of their online services including Hotmail, MSN and Windows Live. Designed to be segmentation-resistant, this scheme has been studied and tuned by its designers over the years. However, our simple attack has achieved a segmentation success rate of higher than 90% against this scheme. It took on average similar to 80 ms for the attack to completely segment a challenge on an ordinary desktop computer. As a result, we estimate that this CAPTCHA Could be instantly broken by a malicious hot with an overall (segmentation and then recognition) Success rate of more than 60%. On the contrary, the design goal was that automated attacks Should not achieve a success rate of higher than 0.01%. For the first time, this paper shows that CAPTCHAs that are carefully designed to be segmentation-resistant are Vulnerable to novel but simple attacks.
AB - CAPTCHA is now almost a standard Security technology. The most widely deployed CAPTCHAs are text-based schemes, which typically require users to solve a text recognition task. The state of the art of CAPTCHA design suggests that Such text-based schemes should rely on segmentation resistance to provide Security guarantee, as individual character recognition after segmentation can be solved with a high Success rate by standard methods such as neural networks. In this paper, we present new character segmentation techniques of general Value to attack a number of text CAPTCHAs, including the schemes designed and deployed by Microsoft, Yahoo and Google. In particular, the Microsoft CAPTCHA has been deployed since 2002 at many of their online services including Hotmail, MSN and Windows Live. Designed to be segmentation-resistant, this scheme has been studied and tuned by its designers over the years. However, our simple attack has achieved a segmentation success rate of higher than 90% against this scheme. It took on average similar to 80 ms for the attack to completely segment a challenge on an ordinary desktop computer. As a result, we estimate that this CAPTCHA Could be instantly broken by a malicious hot with an overall (segmentation and then recognition) Success rate of more than 60%. On the contrary, the design goal was that automated attacks Should not achieve a success rate of higher than 0.01%. For the first time, this paper shows that CAPTCHAs that are carefully designed to be segmentation-resistant are Vulnerable to novel but simple attacks.
U2 - 10.1145/1455770.1455839
DO - 10.1145/1455770.1455839
M3 - Conference contribution/Paper
C2 - 1.05721043050248e+19
SN - 9781595938107
SP - 543
EP - 554
BT - Proceedings of the 15th ACM conference on Computer and communications security - CCS '08
PB - ACM
CY - New York
ER -