The Robustness of CAPTCHAs: A Security Engineering Perspective

CAPTCHA (or Human Interaction Proof) is now almost a standard security technique for defending against undesirable or malicious bot programs on the Internet. However, the robustness of CAPTCHAs has so far been studied mainly just in communities such as computer vision, and document analysis and recognition. This paper motivates a security engineering perspective of the robustness of CAPTCHAs. Specifically, we show that a number of CAPTCHAs that appeared to be secure, including schemes widely deployed by Microsoft, Yahoo and Google and some other less well-known ones, could be broken with a high success rate with simple but novel attacks. In contrast to earlier work that relied on sophisticated computer vision algorithms, our attacks exploited critical design errors that we discovered in each scheme. The main lesson is that security engineering expertise and experience, in particular adversarial thinking skills, can make a unique and significant contribution to the improvement of the robustness of CAPTCHAs. © 2009 University of Newcastle upon Tyne. Printed and published by the University of Newcastle upon Tyne, Computing Science, Claremont Tower, Claremont Road, Newcastle upon Tyne, NE1 7RU, England. Bibliographical details YAN, J., EL AHMAD, A.S. The Robustness of CAPTCHAs: A Security Engineering Perspective [By] J. Yan, A.S. El Ahmad, Newcastle upon Tyne: University of Newcastle upon Tyne: Computing Science, 2009. (University of Newcastle upon Tyne, Computing Science, Technical Report Series, No. CS-TR-1180)