iCAPTCHA: The Next Generation of CAPTCHA Designed to Defend against 3rd Party Human Attacks

Abstract

Abstract-CAPTCHA (Completely Automated Public TuringTest to Tell Computers and Humans Apart) is a simple test that is easy for humans but extremely difficult for computers to solve. CAPTCHA has been widely used in commercial websites such as web-based email providers, TicketMaster, GoDaddy, and Facebook to protect their resources from attacks initiated by automatic scripts. By design, CAPTCHA is unable to distinguish between a human attacker and a legitimate human user. This leaves websites using CAPTCHA vulnerable to 3rd party human CAPTCHA attacks. In order to demonstrate the vulnerabilities in existing CAPTCHA technologies we develop a new streamlined human-based CAPTCHA attack that uses Instant Messenger infrastructure. Facing this serious human-based attack threat, we then present a new defense system called Interactive CAPTCHA (iCAPTCHA), which is the next generation of CAPTCHA technology providing the first steps toward defending against 3rd party human CAPTCHA attacks. iCAPTCHA requires a user to solve a CAPTCHA test via a series of user interactions. The multi-step back-and-forth traffic between client and server amplifies the statistical timing difference between a legitimate user and a human solver, which enables better attack detection performance. A performance and usability study of iCAPTCHA shows the proposed scheme is effective in attack detection, is easy to use, and is a viable replacement of the current text-based CAPTCHA.

DDIM-CAPTCHA: A Novel Drag-n-Drop Interactive Masking CAPTCHA against the Third Party Human Attacks

“…The first paper which mentioned the name "third party human attack" is Truong's iCAPTCHA [12]. A user has to solve a traditional text-based question, and the answering procedure would be divided into several phase.…”

“…We call the first type "hired gun attacks" (special third party human attack [12]) because the attackers perform the attacks by hiring a group of people to solve CAPTCHAs. A hired gun uses the client to send a request to the attacker's server, and the server calls an automated script to scrape a challenge from a victim CAPTCHA system and passes it to the waiting client.…”

“…A third party human attack [12] is a new state-of-the-art attack which employs CAPTCHA redirection and a group of third party users to help attackers solve CAPTCHA challenges. CAPTCHA redirection is a technique usually used by downloading software designed for file hosting services (ex.MEGA, bitshare, rapidgator, etc.)…”

CAPTCHA and its Alternatives: A Review

“…Although using human users to break CAPTCHAs is relatively expensive and is only rational for commercial purposes, in fact, it could be regarded as a concern for the security of CAPTCHAs. To overcome these third‐party attacks, reference was one of the early works that was dedicated for this problem.…”

Strategies and scenarios of CSRF attacks against the CAPTCHA forms

“…"In fact, some unethical businesses are profiting by providing 3rd party human CAPTCHA solving as a service. In India, a CAPTCHA solving economy has developed in which people work as human CAPTCHA solvers, earning $2 for every thousand CAPTCHAs solved" [11]. Although, there are multiple anti-CAPTCHA OCR software solutions, which can be used to break CAPTCHAs and sending spam to forums, but there are no methods to use these software solutions in CSRF attacks.…”