Pitfalls in CAPTCHA design and implementation: The Math CAPTCHA, a case study

Carlos Javier Hernández‐Castro

doi:10.1016/j.cose.2009.06.006

2010-02-01

PRE

Carlos Javier Hernández‐Castro *

Arturo Ribagorda

DOI：10.1016/j.cose.2009.06.006

原文链接

原文求助

摘要

En 中文

We present a black-box attack against an already deployed CAPTCHA that aims to protect a free service delivered using the Internet. This CAPTCHA, referred to as Math CAPTCHA or QRBGS CAPTCHA, requests the user to solve a mathematical problem in order to prove human. We study significant problems both in its design and its implementation, and how those flaws can be used to completely solve this CAPTCHA using a low-cost attack. This attack requires no development in Artificial Intelligence or automatic character recognition, the intended path, thus becoming a side-channel attack, based on the previously mentioned CAPTCHAs flaws. We relate these flaws to common flaws found in other CAPTCHA proposals. We conclude with some tips for enhancing this CAPTCHA that can be considered as general guidelines. (C) 2009 Elsevier Ltd. All rights reserved.

Keyword:

CAPTCHA

QRBGS

Math

Design flaw

Implementation flaw

Design-pitfall

Side-channel

OCR