The robustness of hollow CAPTCHAs

Abstract

CAPTCHA is now a standard security technology for differentiating between computers and humans, and the most widely deployed schemes are text-based. While many text schemes have been broken, hollow CAPTCHAs have emerged as one of the latest designs, and they have been deployed by major companies such as Yahoo!, Tencent, Sina, China Mobile and Baidu. A main feature of such schemes is to use contour lines to form connected hollow characters with the aim of improving security and usability simultaneously, as it is hard for standard techniques to segment and recognize such connected characters, which are however easy to human eyes. In this paper, we provide the first analysis of hollow CAPTCHAs' robustness. We show that with a simple but novel attack, we can successfully break a whole family of hollow CAPTCHAs, including those deployed by all the major companies. While our attack casts serious doubt on the viability of current designs, we offer lessons and guidelines for designing better hollow CAPTCHAs.

A Survey on Breaking Technique of Text-Based CAPTCHA

“…In [41], a CAPTCHA image contains several hollow characters, whose contours naturally form several closed regions (see Figure 8(a)). According to this structural feature, a character is segmented to several character components by color filling (see Figure 8(b)).…”

“…In the existing research results, a typical CNN is widely used [2,4,36,38,41] with a good recognition accuracy. Reference [30] trained large, distributed deep convolutional neural networks and achieved 99.8% accuracy in recognizing CAPTCHA images of reCAPTCHA.…”

“…In [41], all candidate characters are found by the graph traversal, and then the string with the highest sum of characters recognition confidence values is taken as the final result, while in [5,42], to avoid enumerating all candidate characters, a dynamic programming is used to determine the final result with the highest sum of characters' recognition confidence values directly. Compared with graph traversal, the dynamic programming is more effective and accurate.…”

“…In subsequent years, many research results were reported in international conferences including CVPR, NIPS, CCS, and NDSS. Many internationally renowned universities and research institutions have established research groups on CAPTCHA technology, such as CMU [1,[8][9][10][11][12][13][14], PARC [15][16][17][18][19], UCB [16,17,20,21], Microsoft [2,[22][23][24][25][26][27], Google [28][29][30], Bell Laboratory [31,32], Yan et al [4,[33][34][35][36][37][38][39][40][41][42], Xidian University [41][42][43][44][45][46][47], and University of Science and Technology of China [48,49]. In addition, many websites offer CAPTCHA services...…”

Development of two novel face-recognition CAPTCHAs: A security and usability study

“…This violation of authorization has been discussed widely in the security-related literature [1,98,14,85] and recent studies indicate that many state-of-the-art, text-based Captchas have been broken [7,12,18,25,37,56,65,83]. Consequently, the need for new (non text-based) types of Captchas is manifest, as suggested by several researchers [7,12,20,54,56].…”