Global Journal of Computer Science and Technology
Neural & Artificial Intelligence

Volume 13 Issue 3 Version 1.0 Year 2013
Type: Double Blind Peer Reviewed International Research Journal
Publisher: Global Journals Inc. (USA)
Online ISSN: 0975-4172 & Print ISSN: 0975-4350

CAPTCHA: Attacks and Weaknesses against OCR Technology
By Silky Azad & Kiran Jain
Doon Valley Institute of Engineering
Abstract - The basic challenge in designing these obfuscating CAPTCHAs is to make them easy enough thatusers are not dissuaded from attempting a solution, yet still too difficult to solve using available computer
vision algorithms. As Modern technology grows this gap however becomes thinner and thinner. It is possible
to enhance the security of an existing text CAPTCHA by system-apically adding noise and distortion, andarranging characters more tightly. These measures, however, would also make the characters harder forhumans to recognize, resulting in a higher error rates and higher Network load .This paper presents few ofmost active attacks on text CAPTCHAs existing today.

Keywords : CAPCHA, human interactive proofs, recaptcha, optical character recog-nition, tessaract, security.
GJCST-D Classification : I.2.7

CAPTCHAAttacks and Weaknesses against OCR Technology
Strictly as per the compliance and regulations of:© 2013. Silky Azad & Kiran Jain. This is a research/review paper, distributed under the terms of the Creative Commons AttributionNoncommercial 3.0 Unported License http://creativecommons.org/licenses/by-nc/3.0/), permitting all non-commercial use, distribution,and reproduction inany medium, provided the original work is properly cited.

CAPTCHA: Attacks and Weaknesses against
OCR Technology
CAPTCHAs is to make them easy enough that users are notdissuaded from attempting a solution, yet still too difficult tosolve using available computer vision algorithms. As Modern
technology grows this gap however becomes thinner andthinner. It is possible to enhance the security of an existing text
CAPTCHA by system-apically adding noise and distortion, andarranging characters more tightly. These measures, however,would also make the characters harder for humans torecognize, resulting in a higher error rates and higher Network
load .This paper presents few of most active attacks on text
CAPTCHAs existing today.

Keywords : CAPCHA, human interactive proofs,
recaptcha, optical character recog-nition, tessaract,security.

CI.

CAPTCHAs are visual challenges that require the user toidentify alphanumeric characters present in an image
Obfuscated by some combination of noise anddistortion. Figure 1 shows examples of such visual
CAPTCHAs.
Another example of an excellent CAPTCHA
service is re CAPTCHA[2] , re CAPTCHA is a userdialogue system originally developed by Luis von An,
Ben Maurer, Colin McMillan, David Abraham andManuel Blum at Carnegie Mellon University's main
Pittsburgh campus.

Introduction

APTCHA (Completely Automated Public Turing
test to tell Computers and Humans Apart)[1] , also
known as Human Interactive Proof (HIP), is an
automated Turing test in which both generation ofchallenges and grading of responses are performed bycomputer programs. CAPTCHAs are based on Artificial
Intelligence (AI) problems that cannot be solved bycurrent computer programs or bots, but are easilysolvable by humans.

Figure 1 : CAPTCHAs from Internet Source
Hotmail.com

The term “CAPTCHA” was first introduced in2000 by Von an et al., [1] describing a test that candifferentiate humans from computers. Under commondentitions, the test must be
1. Easily solved by humans
2. Easily generated and evaluated,
3. But, Not easily solved by computer
Over the past decade, a number of different
techniques for generating CAPTCHAs have beendeveloped, each satisfying the properties describedabove to varying degrees. The most commonly foundAuthor α : Department of Computer Science, Doon Valley Institute ofEngineering. E-mail : silkyzd15@gmail.com
Author σ : Department of Computer Science, Doon Valley Institute ofEngineering. Kurukshetra University, Kurukshetra.

It uses the CAPTCHA interface, of asking users
to enter words seen in distorted text images onscreen,
to help digitize the text of books, while protecting
websites from bots attempting to access restricted
areas. [1]a) Applications of CAPTCHAs

CAPTCHAs are used in attempts to prevent
automated software from performing actions which
degrade the quality of service of a given system.
CAPTCHAs are also used to minimize automatedpostings to various sites.
••••
••
••

Preventing Comment Spam in Blogs.
Protecting Website Registration.
Protecting Email Addresses.
Prevention from Scrapers.
Online Polls. IP addresses of voters are recorded inorder to prevent single users from voting more thanonce.
Preventing Dictionary Attacks. CAPTCHAs can also
be used to prevent dictionary attacks in password
systems.
Search Engine Bots. It is sometimes desirable tokeep WebPages un-indexed to prevent others fromfinding them easily.
Preventing Worms and Spam. CAPTCHAs also offer
a plausible solution against email worms and spam.
II.

Related WorkMarti Motoyama, et al [2] The Authors describes
the reverse Turing tests, or CAPTCHAs, have become a© 2013 Global Journals Inc. (US)15

Global Journal of Computer Science and Technology ( DD ) Volume XIII Issue III Version I

Abstract - The basic challenge in designing these obfuscating

Year 2 013

Silky Azad α & Kiran Jain σYear 2 013

CAPTCHA: Attacks and Weaknesses against OCR Technology

ubiquitous defense used to protect open Web resourcesfrom being exploited at scale. An effective CAPTCHA
resists existing mechanistic software solving, yet can besolved with high probability by a human being.
They have argued that CAPTCHAs, while
traditionally viewed as a technological impediment to anattacker, should more properly be regarded as an
economic one, as witnessed by a robust and mature
CAPTCHA-solving industry which by passes theunderlying technological issue completely.

Global Journal of Computer Science and Technology ( DD ) Volume XIII Issue III Version I

16Figure 2 : Image to Text error rate for the custom Asirra
CAPTCHA over time [2]CAPTCHAs are suitable for use with standard
solver image APIs. The authors wrote the instructions“Find all cats” in English, Chinese (Simplified), Russianand Hindi across the top, as the majority of the workers
speak one of these languages. They submitted thisimage once every three minutes to all services over 12days.
Image to Text displayed a remarkableadaptability to this new CAPTCHA type, successfully
solving the CAPTCHA on average 39.9% of the time.
Figure 2shows the declining error rate for Image to Text;
as time progresses, the workers become increasingly
adept at solving CAPTCHA.
Elie Burstein, et al, [7] describe that theCAPTCHAs are designed to be easy for humans but
hard for machines. However, most recent research has
focused only on making them hard for machines. In thispaper, they presented what is to the best of theirknowledge the first large scale evaluation of CAPTCHAs
from the human perspective, with the goal of assessing
how much friction CAPTCHAs present to the averageuser. For the purpose of this study they have asked
workers from Amazon’s Mechanical Turk and anunderground CAPTCHA breaking service to solve morethan 318000 CAPTCHAs issued.
In the paper, “Text-based CAPTCHA Strengths
and Weaknesses“ by Elie Burstein and Mathieu Martin[4], The authors carry out a systematic study of existingvisual CAPTCHAs based on distorted characters thatare augmented with anti-segmentation techniques.
Applying a systematic evaluation methodology
to 15 current CAPTCHA schemes from popular web
sites, the authors find that 13 are vulnerable toautomated attacks. Based on this evaluation, we identify
a series of recommendations for CAPTCHA designers
and attackers, and possible future directions for© 2013 Global Journals Inc. (US)producingmorereliablehuman/computer
distinguishers.
In the paper, “Attacks and Design of Image
Recognition CAPTCHAs” [6], the authors systematicallystudy the design of image recognition CAPTCHAs(IRCs). They first reviewed and examine all IRCs
schemes known to them and evaluate each scheme
against the practical requirements in CAPTCHA
applications, particularly in large-scale real-life
applications such as Gmail and Hotmail. Then theauthors present a security analysis of the representative
schemes the authors have identified. For the schemesthat remain unbroken,
In the paper they presented their novel attacks.
For the schemes for which known attacks are available,
the authors propose a theoretical explanation why thoseschemes have failed. The authors have attempted asystematic study of image recognition CAPTCHAs.
The authors provided a thorough review of thestate-of-the-art, presented a novel attack on arepresentative scheme, and analyzed successful attacks
on the other representative schemes. Learned fromthese attacks, the authors defined for the first time a
simple but novel framework for guiding the design ofrobust image recognition CAPTCHAs.
The framework led to their design of Cortcha, anovel CAPTCHA that exploits semantic contexts forimage object recognition. Their usability study showedthat Crotch yielded a slightly better human accuracy rate
than Google’s text CAPTCHA. Cortcha offers thefollowing novel features.
III.

Conclusion

It is possible to enhance the security of an
existing text CAPTCHA by systematically adding noiseand distortion, and arranging characters more tightly.
These measures, however, would also make thecharacters harder for humans to recognize, resulting ina higher error rate. There is a limit to the distortion andnoise that humans can tolerate in a challenge of a text
CAPTCHA. Usability is always an important issue indesigning a CAPTCHA. With advances of segmentation
and Optical Character Recognition (OCR) technologies,
the capability gap between humans and bots inrecognizing distorted and connected characters
becomes increasingly smaller. This trend would likely
render text CAPTCHAs eventually ineffective.
In the paper,” The Robustness of Google
CAPTCHAs” [5], they reported a novel attack on two
CAPTCHAs that have been widely deployed on theInternet, one being Google's home design and the otheracquired by Google (i.e. re CAPTCHA). With a minorchange, their attack program also works well on thelatest Re CAPTCHA version, which uses a new defense
mechanism that was unknown. When they designed
their attack.

CAPTCHA: Attacks and Weaknesses against OCR Technology

IV.

Future Scope

Symposium on Security and Privacy (SP '10). IEEE
Computer Society, Washington, DC, USA, 399-413.
5. Elie Bursztein, Mathieu Martin, and John Mitchell.
2011. Text-based CAPTCHA strengths andweaknesses. In Proceedings of the 18th ACM
6. Ahmad Salah El Ahmad, Jeff Yan, and Lindsay
Marshall. 2010. The robustness of a new CAPTCHA.
In Proceedings of the Third European Workshop on
System Security (EUROSEC '10). ACM, New York,NY, USA.
7. Bin B. Zhu, “Attacks and Design of Image
Recognition
CAPTCHAs”,
ACM,Microsoft
Research, Temple University, Computer andInformation Science, OCT 2010.
8. Marti Motoyama, Krill et al. Re: CAPTCHAs:
understanding CAPT-CHA solving services in an
economic context. In Proceedings of the 19th
USENIX conference on Security 28-28. v. 2010.

A lot of work has been done in Enhancing
CAPTCHA usability and Security one such example isuse of re CAPTCHA[2], However emergence of recentadvents and techniques made it more difficult to prevent
automated bots and other dangerous spammers
against CAPTCHA attacks. some techniques we havediscussed in this paper provide more than 40% successrate, and as the faulty CAPTCHA requests are reevaluated by the server and absence limiting countmeans that CAPTCHA decryption will be successful inconsecutive attacks. In future we would like to use open
source OCR Engines to validate such claims.

References Références Referencias
1. Luis Von An, Manuel Blum, Nicholas J. Hopper, andJohn Langford. 2003. CAPTCHA: using hard AI
problems for security. In Proceedings of the 22nd
international conference on Theory and applicationsof cryptographic techniques (EUROCRYPT'03), Eli
Biham (Ed.). Springer-Overflag, Berlin, Heidelberg,
294-311.
2. Luis von An, Ben Maurer, Colin McMillan, David
Abraham and Manuel Blum (2008). Re CAPTCHA:
Human-Based Character Recognition via Web
Security Measures. Science 321 (5895): 1465–1468.
3. Marti Motoyama, Krill Levchenko, Chris Kanich,Damon McCoy, Geoffrey M. Volker, and Stefan
Savage. 2010. Re: CAPTCHAs: understanding
CAPTCHA-solving services in an economic context.
In Proceedings of the 19th USENIX conference onSecurity (USENIX Security'10). USENIX Association,
Berkeley, CA, USA, 28-28.
4. Elie Bursztein, Steven Bet hard, Celine Fabry, John
C. Mitchell, and Dan Jurafsky. 2010. How Good Are
Humans at Solving CAPTCHAs? A Large ScaleEvaluation. In Proceedings of the 2010 IEEE
© 2013 Global Journals Inc. (US)Year 2 013

conference on Computer and communications
security (CCS '11). ACM, New York, NY, USA

17

Global Journal of Computer Science and Technology ( DD ) Volume XIII Issue III Version I

This suggests that their attack works in afundamental level. Their attack appears to be applicable
to a whole family of text CAPTCHAs that build on top of
the popular segmentation resistant mechanism of"crowding character together" for security. They also
proposed a novel framework that guides the applicationof their well-tested security engineering methodology forevaluating CAPTCHA robustness, and proposed a newgeneral principle for CAPTCHA design.
They concluded that CAPTCHAs are still a newresearch area. Open problems include the mislabelingproblem. Of all the problems they discussed,mislabeling causes the most human errors. The authors
may be able to solve this using collaborative filtering,where known human users rate images according tohow well they evoke their label. They presented more
images per round in the anomaly detection CAPTCHA todebate computer performance.

Year 2 013

CAPTCHA: Attacks and Weaknesses against OCR Technology

Global Journal of Computer Science and Technology ( DD ) Volume XIII Issue III Version I

18This page is intentionally left blank© 2013 Global Journals Inc. (US)