CAPTCHA

From Wikipedia, the free encyclopedia

Early CAPTCHAs such as these, generated by the EZ-Gimpy program, were used on Yahoo. However, technology was developed to read this type of CAPTCHA^[1].

A modern CAPTCHA, rather than attempting to create a distorted background and high levels of warping on the text, might focus on making segmentation difficult by adding an angled line.

Another way to make segmentation difficult is to crowd symbols together. This can be read by humans but can't be segmented by bots

A CAPTCHA (IPA: /ˈkæptʃə/) is a type of challenge-response test used in computing to determine whether the user is human. The process involves one computer (a server) asking a user to complete a simple test which the computer is able to generate and grade. Because other computers are unable to solve the CAPTCHA, any user entering a correct solution is presumed to be human. A common type of CAPTCHA requires that the user type the letters of a distorted image, sometimes with the addition of an obscured sequence of letters or digits that appears on the screen.

The term "CAPTCHA" was coined in 2000 by Luis von Ahn, Manuel Blum, Nicholas J. Hopper (all of Carnegie Mellon University), and John Langford (then of IBM). It is a contrived acronym for "Completely Automated Public Turing test to tell Computers and Humans Apart", trademarked by Carnegie Mellon University.

A CAPTCHA is sometimes described as a reverse Turing test, because it is administered by a machine and targeted to a human, in contrast to the standard Turing test that is typically administered by a human and targeted to a machine.

Currently, reCAPTCHA is recommended as the official CAPTCHA implementation by the original CAPTCHA creators.^[2]

[edit] Characteristics

A CAPTCHA system is a means of automatically generating new challenges which:

• Current computers are unable to solve accurately.
• Most humans can solve.
• Does not rely on the type of CAPTCHA being new to the attacker. Although a checkbox "check here if you are not a bot" might serve to distinguish between humans and computers, it is not a CAPTCHA because it relies on the fact that an attacker has not spent effort to break that specific form.

In practice, the algorithm used to create the CAPTCHA does not need to be made public, though it may be covered by a patent (in countries where algorithms are patentable). Although publication can help demonstrate that breaking it requires the solution to a difficult problem in the field of artificial intelligence, deliberate withholding of the algorithm can increase the integrity of a limited set of systems, as in the practice of security through obscurity. The most important factor in deciding whether an algorithm should be made open or restricted is the size of the system. Although an algorithm which survives scrutiny by security experts may be assumed to be more conceptually secure than an unevaluated algorithm, an unevaluated algorithm specific to a very limited set of systems is always of less interest to those engaging in automated abuse. Breaking a CAPTCHA generally requires some effort specific to that particular CAPTCHA implementation, and an abuser may decide that the benefit granted by automated bypass is negated by the effort required to engage in abuse of that system in the first place.

[edit] Origin

The potential difficulty of differentiating humans from computers pretending to be humans was addressed at least as early as 1950, when Alan Turing described his now-famous Turing test. Automated tests which distinguish humans from computers for the purpose of controlling access to web services were first discussed in 1996.^[3]

Primitive CAPTCHAs seem to have been developed in 1997 at AltaVista by Andrei Broder and his colleagues to prevent bots from adding URLs to their search engine. In order to make the images resistant to OCR (Optical Character Recognition), the team simulated situations that scanner manuals claimed resulted in bad OCR. In 2000, Luis von Ahn and Manuel Blum developed and publicized the notion of a CAPTCHA, which included any program that can distinguish humans from computers. They invented multiple examples of CAPTCHAs, including the first CAPTCHAs to be widely used, which were those adopted by Yahoo!.

[edit] Applications

CAPTCHAs are used to prevent automated software from performing actions which degrade the quality of service of a given system, whether due to abuse or resource expenditure. Although CAPTCHAs are most often deployed as a response to encroachment by commercial interests, the notion that they exist to stop only spammers is mistaken^{[citation needed]}. CAPTCHAs can be deployed to protect systems vulnerable to e-mail spam, such as the webmail services of Gmail - there is also a claim that the Gmail CAPTCHA has been compromised^[4] -, Hotmail, and Yahoo!. CAPTCHAs have also found active use in stopping automated posting to blogs, forums and wikis, whether as a result of commercial promotion, or harassment and vandalism. CAPTCHAs also serve an important function in rate limiting, as automated usage of a service might be desirable until such usage is done in excess, and to the detriment of human users. In such a case, a CAPTCHA can enforce automated usage policies as set by the administrator when certain usage metrics exceed a given threshold. The article rating systems used by many news web sites are another example of an online facility vulnerable to manipulation by automated software.^[5].

[edit] Accessibility

See also: Web accessibility

Because CAPTCHAs rely on visual perception, users unable to view a CAPTCHA (for example, due to a disability or because it is difficult to read) will be unable to perform the task protected by a CAPTCHA. As such, sites implementing CAPTCHAs may provide an audio version of the CAPTCHA in addition to the visual method. The official CAPTCHA site recommends providing an audio CAPTCHA for accessibility reasons.

[edit] Attempts at more accessible CAPTCHAs

Even an audio and visual CAPTCHA will require manual intervention for some users, such as those who are both deaf and blind. There have been various attempts at creating CAPTCHAs that are more accessible. Attempts include the use of JavaScript,^[6] mathematical questions ("what is 1+1" or even more complex problems like derivatives or polynomial factorization -- also known as a MAPTCHA, or Mathematical CAPTCHA), or "common sense" questions ("what color is the sky"). These attempts violate one or both of the principles of CAPTCHAs: either they cannot be automatically generated or they can be easily cracked given the state of artificial intelligence. As such, the only security these CAPTCHAs provide is security through obscurity; an attacker is unlikely to have encountered the formulation of the CAPTCHA in question, and unlikely to find it worth the time spending resources to break the CAPTCHA of a small site.

Due to the lack of security provided by text based CAPTCHAs, most sites choose to use an audio and visual CAPTCHA as a way of balancing accessibility and security. Often, email or telephone support is used to manually provide access to users who are unable to solve a CAPTCHA.

[edit] Circumvention

There are a few approaches to defeating CAPTCHAs: exploiting bugs in the implementation that allow the attacker to completely bypass the CAPTCHA, improving character recognition software, or using cheap human labor to process the tests.

[edit] Insecure implementation

Like any security system, design flaws in a system implementation can prevent the theoretical security from being realized. Many CAPTCHA implementations, especially those which have not been designed and reviewed by experts in the fields of security, are prone to common attacks.

Some CAPTCHA protection systems can be bypassed without using OCR simply by re-using the session ID of a known CAPTCHA image. A correctly designed CAPTCHA does not allow multiple solution attempts at one CAPTCHA. This prevents the reuse of a correct CAPTCHA solution or making a second guess after an incorrect OCR attempt.^[7]. Other CAPTCHA implementations use a hash (such as an MD5 hash) of the solution as a key passed to the client to validate the CAPTCHA. Often the CAPTCHA is of small enough size that this hash could be cracked.^[8] Further, the hash could assist an OCR based attempt. A more secure scheme would use an HMAC. Finally, some implementations use only a small fixed pool of CAPTCHA images. Eventually, when enough CAPTCHA image solutions have been collected by an attacker over a period of time, the CAPTCHA can be broken by simply looking up solutions in a table, based on a hash of the challenge image.

[edit] Computer character recognition

A number of research projects have attempted (often with success) to beat visual CAPTCHAs by creating programs that contain the following functionality:

1. Extraction of the image from the web page.
2. Removal of background clutter, for example with color filters and detection of thin lines.
3. Segmentation, i.e. splitting the image into regions each containing a single letter.
4. Identifying the letter for each region.

Steps 1, 2, and 4 are easy tasks for computers ^[9] The only part where humans still outperform computers is segmentation. If the background clutter consists of shapes similar to letter shapes, and the letters are connected by this clutter, the segmentation becomes nearly impossible with current software. Hence, an effective CAPTCHA should focus on the segmentation.

Several research projects have broken real world CAPTCHAs, including one of Yahoo's early CAPTCHAs called "EZ-Gimpy"^[10] and the CAPTCHA used by popular sites such as Paypal and LiveJournal as well as open source software such as phpBB.^{[11] [12]}. In January 2008 Network Security Research released their program for automated Yahoo! CAPTCHA recognition.^[13]

In February 2008 it was reported that spammers had achieved a success rate of 30% to 35%, using a bot, in responding to CAPTCHAs for Microsoft's Live Mail service ^[14] and a success rate of 20% against Google's Gmail CAPTCHA.^[15]

[edit] Human solvers

CAPTCHA is vulnerable to a relay attack that uses humans to solve the puzzles. One approach involves relaying the puzzles to a sweatshop of human operators who can solve CAPTCHAs. In this scheme, a computer fills out a form and when it reaches a CAPTCHA, it gives the CAPTCHA to the human operator to solve. Unless the humans are dedicated employees who receive minimum wage this is not likely to be viable.^[16] Another variation of this technique involves copying the CAPTCHA images and using them as CAPTCHAs for a high-traffic site owned by the attacker. With enough traffic, the attacker can get a solution to the CAPTCHA puzzle in time to relay it back to the target site.^[17] In October 2007, a piece of malware appeared in the wild which enticed users to solve CAPTCHAs in order to see progressively further into a series of "striptease" images. ^[18][19]

[edit] Legality

The circumvention of CAPTCHAs may violate the anti-circumvention clause of the Digital Millennium Copyright Act (DMCA) in the United States. In 2007 Ticketmaster sued software maker RMG Technologies^[20] for its product which circumvented the ticket seller's CAPTCHAs on the basis that it violates the anti-circumvention clause of the DMCA. In October 2007, an injunction was issued stating that Ticketmaster would "likely succeed" in making its case.^[21]

[edit] Image-recognition CAPTCHAs

Some researchers promote image recognition CAPTCHAs as a possible alternative for text based CAPTCHAs. To date, no major website has made use of an image based CAPTCHA. However, many amateur users of the phpBB forum software (which has suffered greatly from spam^[22]) have implemented an open source image recognition CAPTCHA system in the form of an addon called KittenAuth^[23] which in its default form presents a question requiring the user to select a stated type of animal from an array of thumbnail images of assorted animals. The images (and the challenge questions) can be customized, for example to present questions and images which would be easily answered by the forum's target userbase.

Image recognition CAPTCHAs face many potential problems which have not been fully studied.

It is difficult for a small site to acquire a large dictionary of images which an attacker does not have access to and without a means of automatically acquiring new labelled images, an image based challenge does not meet the definition of a CAPTCHA. KittenAuth by default only had 42 images in its database^[24]. Microsoft's "Asirra", which it is providing as a free web service, attempts to address this by means of Microsoft Research's partnership with Petfinder.com, which has provided it with more than three million images of cats and dogs, classified by people at thousands of US animal shelters.^[25]

Human solvers are a potential weakness for strategies such as Asirra. If the database of cat and dog photos can be downloaded, then paying workers $0.01 to classify each photo as either a dog or a cat means that almost the entire database of photos can be deciphered for $30,000. Photos that are subsequently added to the Asirra database are then a relatively small data set that can be classified as they first appear.

Another potential weakness is that only a yes/no answer for each picture is required by most designs. Even with sixteen images, a bot has a 1 in 65536 (2¹⁶) chance of getting the captcha right. In order to be effective against a botnet attack, the user would be forced to solve an annoyingly large number of images.

[edit] The 3-D CAPTCHA

An image recognition CAPTCHA that offers a virtually infinite number of unique labeled images is possible. The 3-D CAPTCHA and modern video games use the same basic mechanism to generate unique images. Manually created 3-D objects are automatically juxtaposed together in a scene forming a unique image. For example a random sampling of 3-D objects (e.g. a flower in a vase and a man sitting on a chair) are automatically placed together in a unique image. The computer will then tag each feature of each object (e.g. the back of the chair, the vase, the left foot of the man) with an alphanumeric character. The user will be asked to type the alphanumeric character that overlies a particular feature.

A single 3-D CAPTCHA image might contain 26 identifiable features and asking for the identification of 3 of those features will result in (26)*(25)*(24) = 15,600 possible combinations while the requirement to identify 5 features will result in 7,893,600 combinations making a brute force attack impractical.

Designing a computer vision program that can recognize the objects within the 3-D CAPTCHA images is intrinsically difficult. In addition a compromised object will be identified by the sudden influx of responses that correctly name the compromised object while incorrectly naming the other objects; the compromised object will be instantly removed from the library used by the 3-D CAPTCHA and replaced by another object that was kept in reserve in a separate library of never-before-seen objects.^[26]

The instructions that accompany the 3-D CAPTCHA image are bound by language dependency. Any entity deploying the 3-D CAPTCHA will need to select the language to be used for the instructions that will accompany the image.

[edit] Collateral benefits

Some of the original inventors of the CAPTCHA system have implemented a means by which some of the effort and time spent by people who are responding to CAPTCHA challenges can be harnessed as a distributed work system. This system, called reCAPTCHA, works by including "solved" and "unrecognized" elements (images which were not successfully recognized via OCR) in each challenge. The respondent thus answers both elements and roughly half of his or her effort validates the challenge while the other half is captured as work.

[edit] Criticisms

This section does not cite any references or sources. (March 2008) Please improve this section by adding citations to reliable sources. Unverifiable material may be challenged and removed.

As systems owners make it more difficult for computers to interpret the characters on the CAPTCHA, many humans also find it hard to read the characters and often get stuck in a 'loop' until they enter the correct letters. This has led to three recommendations:

1) The CAPTCHA should be no longer than 6 characters.
2) The letter O and the number 0 should not be required (which causes confusion).
3) CAPTCHA surrounds (pixels added around the numbers or letters to prevent computers from interpreting the characters) should not resemble letters or part-letters.

[edit] References

[edit] See also

• Turing test
• Image spam, where spammers exploit the inability of computers to read to avoid junkmail filtering
• reCAPTCHA - is the process of utilizing CAPTCHA to improve the process of digitizing books
• one-way function

[edit] External links

• The CAPTCHA Project
• Internet Captcha ASP or PHP Captcha, completly configurable and with visual flash effects.
• Inaccessibility of CAPTCHA: Alternatives to Visual Turing Tests on the Web, a W3C Working Group Note.
• CAPTCHA History from PARC.
• Google Tech Talk on Human Computation
• Luis von Ahn discusses CAPTCHA technology on the PBS show Wired Science, December 19, 2007. [1].
• The 3-D CAPTCHA An image recognition CAPTCHA that generates unique images by juxtaposing together 3-D objects.

Defeating CAPTCHAs:

• Breaking a Visual CAPTCHA (Gimpy) By Greg Mori and Jitendra Malik
• Breaking CAPTCHAs without using OCR (talks about a common but easy to fix bug in programming CAPTCHAs, allowing session re-use)
• Defeating a simple CAPTCHA with Open Source software
• Will Solve Captcha for Money? - Article on Slashdot about using low-paid data entry workers to defeat CAPTCHAs in bulk.
• Captcha Exchange Server - Distributed project, defeating captchas from one-click hostings (description in Russian)
• New virus attempts to defeat CAPTCHA with porn - "Virtual Stripper" takes off clothing for each CAPTCHA entered
• Yahoo! CAPTCHA is broken - Russian researchers released a program for automated Yahoo! CAPTCHA recognition
• Recently Gmail! CAPTCHA is also reported to be broken - But it involves two compromised hosts instead of one contrasted over that was used to crack the yahoo