A New Text Based CAPTCHA

Abstract:

Attacks on text-based CAPTCHAs are getting more sophisticated. Most existing schemes defend attacks by increasing deformation or distortion rate of words which sacrifice the friendliness of the system. In this paper, we propose a secure one time text-based CAPTCHA scheme which can effectively defend multiple attacks without decreasing the friendliness of the scheme for valid users. The core of our design is an information obfuscation scheme which determines which character image to display and which to hide in an online manner from a sequence of 62 character images which makes it more difficult to attack. Encryption method is employed for protecting display policies which control showing and hiding of information. Prototype has been implemented and the preliminary results are encouraging.

• Periodical: Applied Mechanics and Materials (Volumes 373-375)
• Pages: 644-649
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.373-375.644
• Online since: August 2013
• Authors: Eric Ke Wang, Yun Ming Ye
• Keywords: CAPTCHA, CSS, OCR-Based Attack, Replay Attack

References

[1] M. Blum, L. A. von Ahn, and J. Langford, The CAPTCHA Project, Completely Automatic Public Turing Test to Tell Computers and Humans Apart, http: /www. captcha. net, Dept. of Computer Science, Carnegie-Mellon Univ., November (2000).

[2] Jeff Yan and Ahmad Salah El Ahmad, A Low-cost Attack on a Microsoft CAPTCHA, Proceedings of the 15th ACM conference on Computer and communications security, (2008).

DOI: 10.1145/1455770.1455839

[3] L. von Ahn, M. Blum, and J. Langford, Telling Humans and Computers Apart Automatically, Communications of the ACM, vol. 47, no. 2, pp.57-60 , February (2004).

DOI: 10.1145/966389.966390

[4] M. Shirali-Shahreza and S. Shirali-Shahreza, Collage CAPTCHA, Proceedings of the 20th IEEE International Symposium Signal Processing and Application (ISSPA 2007), Sharjah, United Arab Emirates, February 12-15 (2007).

DOI: 10.1109/isspa.2007.4555329

[5] M.H. Shirali-Shahreza and M. Shirali-Shahreza, Persian/Arabic Baffletext CAPT-CHA, Journal of Universal Computer Science, vol. 12, no. 12, pp.1783-1796, Dec. (2006).

DOI: 10.1109/isspit.2006.270838

[6] Shirali-Shahreza, M., Shirali-Shahreza, S., Question-Based CAPTCHA, Confe-rence on Computational Intelligence and Multimedia Applications, 2007. International Conference on Volume 4, Issue , 13-15, Page(s): 54 – 58, Dec. (2007).

DOI: 10.1109/iccima.2007.10

[7] Greg Mori, Jitendra Malik: Recognizing Objects in Adversarial Clutter: Breaking a Visual CAPTCHA. IEEE Computer Society Conference on Computer Vision and Pattern Recognition CVPR (1) , (2003).

DOI: 10.1109/cvpr.2003.1211347

[8] Kurt Alfred Kluever, Breaking the PayPal HIP: A Comparison of Classiers, ，(2008).

[9] Abhay Bansal, Divye Garg, Anup Gupta, Anand Gupta, Breaking a Visual Captcha: A Novel Approach Using Hmm, 2nd National Conference on Chal-lenges&Opportunities in Information Technology(COIT 2008), Punjab, (2008).

[10] XRumer, Wikipedia, http: /en. wikipedia. org/wiki/XRumer.

[11] Walsh, N. , Cascading style sheets, World Wide Web Journal, Volume 2 , Issue 1, (1997).

[12] Philippe Golle, Machine Learning Attacks Against the Asirra CAPTCHA, , ACM Computer and Communications Security Conference (CSS) , (2008).

DOI: 10.1145/1455770.1455838

[13] Y. Xu, G. Reynaga, S. Chiasson, J-M. Frahm, F. Monrose and P. van Oorschot, Security and usability challenges of moving-object CAPTCHAs: decoding codewords in motion, I Proceedings of the 21st USENIX conference on Security symposium (2012).

DOI: 10.1109/tdsc.2013.52

[14] Hakem Beitollahi, Geert Deconinck , Analyzing well-known countermeasures against distributed denial of service attacks, Volume 35, Issue 11, Pages 1312–1332, 15 June (2012).

DOI: 10.1016/j.comcom.2012.04.008