Abstract
Image captchas have recently become very popular and are widely deployed across the Internet to defend against abusive programs. However, the ever-advancing capabilities of computer vision have gradually diminished the security of image captchas and made them vulnerable to attack. In this paper, we first classify the currently popular image captchas into three categories: selection-based captchas, slide-based captchas, and click-based captchas. Second, we propose simple yet powerful attack frameworks against each of these categories of image captchas. Third, we systematically evaluate our attack frameworks against 10 popular real-world image captchas, including captchas from tencent.com, google.com, and 12306.cn. Fourth, we compare our attacks against nine online image recognition services and against human labors from eight underground captcha-solving services. Our evaluation results show that (1) each of the popular image captchas that we study is vulnerable to our attacks; (2) our attacks yield the highest captcha-breaking success rate compared with state-of-the-art methods in almost all scenarios; and (3) our attacks achieve almost as high a success rate as human labor while being much faster. Based on our evaluation, we identify some design flaws in these popular schemes, along with some best practices and design principles for more secure captchas. We also examine the underground market for captcha-solving services, identifying 152 such services. We then seek to measure this underground market with data from these services. Our findings shed light on understanding the scale, impact, and commercial landscape of the underground market for captcha solving.
Highlights
Automated Public Turing tests to tellComputers and Humans Apart (Captcha)[1,2,3,4] is a widely used method to increase the security of websites
We provide background knowledge and review related work covering four aspects: first, we review the most widely used image captchas; second, we outline the existing techniques for attacking image captchas; third, we give an account of the advanced vision techniques and online image recognition services that are currently available; and fourth, we detail popular underground captcha-solving services
We compare our attacks with two previous methods, nine online image recognition services, and eight captcha-solving services that employ human labor
Summary
Automated Public Turing tests to tellComputers and Humans Apart (Captcha)[1,2,3,4] is a widely used method to increase the security of websites. There are three approaches that adversaries may take to solve image captcha challenges: using automated captcha breaking attacks, using image recognition services, and hiring human labor. In relation to automated approaches, we design three attacks and evaluate them against 10 popular real-word captcha schemes. We hire human labor from a broad range of underground captcha-solving services to break realworld captchas. We provide background knowledge and review related work covering four aspects: first, we review the most widely used image captchas; second, we outline the existing techniques for attacking image captchas; third, we give an account of the advanced vision techniques and online image recognition services that are currently available; and fourth, we detail popular underground captcha-solving services
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
