Breaking reCAPTCHAs with Unpredictable Collapse: Heuristic Character Segmentation and Recognition

Abstract

Abstract. In this paper we present a novel approach for automatic segmentation and recognition of reCAPTCHA in Web sites. It is based on CAPTCHA image preprocessing with character alignment, morphological segmentation with three-color bar character encoding and heuristic recognition. The original proposal consists in exploiting three-color bar code for characters in CAPTCHA for their robust segmentation with presence of random collapse overlapping letters and distortions by particular patterns of waving rotation. Additionally, a novel implementation of SVM-based learning classifier for recognition of combinations of characters in training corpus has been proposed that permits to increment more than twice the recognition success rate without time extension of system response. The main goal of this research is to reduce vulnerability of CAPTCHA from spam and frauds as well as to provide a novel approach for recognizing either handwritten or degraded and damaged texts in ancient manuscripts. Our designed framework implementing the proposed approach has been tested in real-time applications with sites used CAPTCHAS achieving segmentation success rate about of 82% and recognition success rate about of 94%.

Text-based CAPTCHAs over the years

“…In fact, Google's popular "reCAPTCHA", which was text-based at the time and designed to be segmentation-resistant, was successfully broken using a holistic approach of recognizing shape con-texts of entire words [14] and also in an approach using heuristic character segmentation and recognition [15].…”

Captcha Breaking using Segmentation and Morphological Operations

“…However, text-based systems appear to be the most populardue to their easy implementation and usability. For this reason a set of design rules has been proposed to increase CAPTCHA security without compromising the user experience [2,[9][10][11]. This has significantly reduced the number of CAPTCHA APIs allowing only the most mature remain in preference of Web security providers.…”

“…While anti-recognition mechanisms alter individual letter features such as font size, type and count, distortion, blurring and independent rotation of each character, the main secure mechanism to avoid breaking CAPTCHAs relies on anti-segmentation techniques that guarantee their robustness [9,11,13]. Some of the principal anti-segmentation techniques used in new versions of CAPTCHA and reCAPTCHA are the variable orientation of characters in word, the collapse between letters in a word, the addition of random dots and lines of different sizes, cluttered backgrounds and similar foreground/background colors [2,3,9,10]. For example, reCAPTCHA test proposes to recognize two out-of-context words, where waviness and horizontal stroke were added to increase the difficulty of breaking the CAPTCHA by a computer program.…”

“…The most complete analysis of CAPTCHA beating mechanisms provided by Bursztein presents various systems able to recognize CAPTCHAs of some popular Internet sites, which include Wikipedia, eBay, CNN, Baidu, Mega upload and others with accuracy rates ranging from 40% to 95% [9,11,13]. However, these systems do not recognize CAPTCHAs provided by sites like Google or reCAPTCHA of new versions [10,13]. In Ref.…”

“…The precision of the segmentation step reported by newCAPTCHA beating systems lies between 40% [10, 13,16] and 95% [9,10,24]. Interesting approach is presented by Liu [25], which exploitsa set of morphological filters that break satisfactorily security mechanism based on asymmetric-ellipses sometimes presented in reCAPTCHA.…”