TY - GEN

T1 - A low-cost attack on a Microsoft captcha

AU - Yan, Jeff

AU - El Ahmad, Ahmad Salah

PY - 2008

Y1 - 2008

N2 - CAPTCHA is now almost a standard Security technology. The most widely deployed CAPTCHAs are text-based schemes, which typically require users to solve a text recognition task. The state of the art of CAPTCHA design suggests that Such text-based schemes should rely on segmentation resistance to provide Security guarantee, as individual character recognition after segmentation can be solved with a high Success rate by standard methods such as neural networks. In this paper, we present new character segmentation techniques of general Value to attack a number of text CAPTCHAs, including the schemes designed and deployed by Microsoft, Yahoo and Google. In particular, the Microsoft CAPTCHA has been deployed since 2002 at many of their online services including Hotmail, MSN and Windows Live. Designed to be segmentation-resistant, this scheme has been studied and tuned by its designers over the years. However, our simple attack has achieved a segmentation success rate of higher than 90% against this scheme. It took on average similar to 80 ms for the attack to completely segment a challenge on an ordinary desktop computer. As a result, we estimate that this CAPTCHA Could be instantly broken by a malicious hot with an overall (segmentation and then recognition) Success rate of more than 60%. On the contrary, the design goal was that automated attacks Should not achieve a success rate of higher than 0.01%. For the first time, this paper shows that CAPTCHAs that are carefully designed to be segmentation-resistant are Vulnerable to novel but simple attacks.

AB - CAPTCHA is now almost a standard Security technology. The most widely deployed CAPTCHAs are text-based schemes, which typically require users to solve a text recognition task. The state of the art of CAPTCHA design suggests that Such text-based schemes should rely on segmentation resistance to provide Security guarantee, as individual character recognition after segmentation can be solved with a high Success rate by standard methods such as neural networks. In this paper, we present new character segmentation techniques of general Value to attack a number of text CAPTCHAs, including the schemes designed and deployed by Microsoft, Yahoo and Google. In particular, the Microsoft CAPTCHA has been deployed since 2002 at many of their online services including Hotmail, MSN and Windows Live. Designed to be segmentation-resistant, this scheme has been studied and tuned by its designers over the years. However, our simple attack has achieved a segmentation success rate of higher than 90% against this scheme. It took on average similar to 80 ms for the attack to completely segment a challenge on an ordinary desktop computer. As a result, we estimate that this CAPTCHA Could be instantly broken by a malicious hot with an overall (segmentation and then recognition) Success rate of more than 60%. On the contrary, the design goal was that automated attacks Should not achieve a success rate of higher than 0.01%. For the first time, this paper shows that CAPTCHAs that are carefully designed to be segmentation-resistant are Vulnerable to novel but simple attacks.

U2 - 10.1145/1455770.1455839

DO - 10.1145/1455770.1455839

M3 - Conference contribution/Paper

C2 - 1.05721043050248e+19

SN - 9781595938107

SP - 543

EP - 554

BT - Proceedings of the 15th ACM conference on Computer and communications security - CCS '08

PB - ACM

CY - New York

ER -