Image captchas have recently become very popular and are widely deployed across the Internet to defend against abusive programs. However, the ever-advancing capabilities of computer vision have gradually diminished th...Image captchas have recently become very popular and are widely deployed across the Internet to defend against abusive programs. However, the ever-advancing capabilities of computer vision have gradually diminished the security of image captchas and made them vulnerable to attack. In this paper, we first classify the currently popular image captchas into three categories: selection-based captchas, slide-based captchas, and click-based captchas. Second, we propose simple yet powerful attack frameworks against each of these categories of image captchas. Third, we systematically evaluate our attack frameworks against 10 popular real-world image captchas,including captchas from tencent.com, google.com, and 12306.cn. Fourth, we compare our attacks against nine online image recognition services and against human labors from eight underground captcha-solving services. Our evaluation results show that(1) each of the popular image captchas that we study is vulnerable to our attacks;(2) our attacks yield the highest captcha-breaking success rate compared with state-of-the-art methods in almost all scenarios; and(3) our attacks achieve almost as high a success rate as human labor while being much faster.Based on our evaluation, we identify some design flaws in these popular schemes, along with some best practices and design principles for more secure captchas. We also examine the underground market for captcha-solving services, identifying 152 such services. We then seek to measure this underground market with data from these services. Our findings shed light on understanding the scale, impact, and commercial landscape of the underground market for captcha solving.展开更多
基金supported by the National Natural Science Foundation of China (Nos. 61772466 and U1836202)the Zhejiang Provincial Natural Science Foundation for Distinguished Young Scholars (No. LR19F020003)+1 种基金the Provincial Key Research and Development Program of Zhejiang Province (No. 2017C01055)the Alibaba-ZJU Joint Research Institute of Frontier Technologies
文摘Image captchas have recently become very popular and are widely deployed across the Internet to defend against abusive programs. However, the ever-advancing capabilities of computer vision have gradually diminished the security of image captchas and made them vulnerable to attack. In this paper, we first classify the currently popular image captchas into three categories: selection-based captchas, slide-based captchas, and click-based captchas. Second, we propose simple yet powerful attack frameworks against each of these categories of image captchas. Third, we systematically evaluate our attack frameworks against 10 popular real-world image captchas,including captchas from tencent.com, google.com, and 12306.cn. Fourth, we compare our attacks against nine online image recognition services and against human labors from eight underground captcha-solving services. Our evaluation results show that(1) each of the popular image captchas that we study is vulnerable to our attacks;(2) our attacks yield the highest captcha-breaking success rate compared with state-of-the-art methods in almost all scenarios; and(3) our attacks achieve almost as high a success rate as human labor while being much faster.Based on our evaluation, we identify some design flaws in these popular schemes, along with some best practices and design principles for more secure captchas. We also examine the underground market for captcha-solving services, identifying 152 such services. We then seek to measure this underground market with data from these services. Our findings shed light on understanding the scale, impact, and commercial landscape of the underground market for captcha solving.
