CAPTCHA phishing: a practical attack on human interaction proofing

Authors:
Le Kang;Ji Xiang
Affiliations:
State Key Laboratory of Information Security, Chinese Academy of Science, Beijing, China;State Key Laboratory of Information Security, Chinese Academy of Science, Beijing, China
Venue:
Inscrypt'09 Proceedings of the 5th international conference on Information security and cryptology
Year:
2009

Citing 9
Cited 1

Telling humans and computers apart automatically

Communications of the ACM - Information cities
Why phishing works

Proceedings of the SIGCHI Conference on Human Factors in Computing Systems
Keeping bots out of online games

Proceedings of the 2005 ACM SIGCHI International Conference on Advances in computer entertainment technology
Asirra: a CAPTCHA that exploits interest-aligned manual image categorization

Proceedings of the 14th ACM conference on Computer and communications security
Phishing attacks and solutions

Proceedings of the 3rd international conference on Mobile multimedia communications
Machine learning attacks against the Asirra CAPTCHA

Proceedings of the 15th ACM conference on Computer and communications security
A low-cost attack on a Microsoft captcha

Proceedings of the 15th ACM conference on Computer and communications security
Distortion estimation techniques in solving visual CAPTCHAs

CVPR'04 Proceedings of the 2004 IEEE computer society conference on Computer vision and pattern recognition
Recognizing objects in adversarial clutter: breaking a visual captcha

CVPR'03 Proceedings of the 2003 IEEE computer society conference on Computer vision and pattern recognition

A survey and analysis of current CAPTCHA approaches

Journal of Web Engineering

Quantified Score

Hi-index	0.00

Visualization

Abstract

CAPTCHAs are widespread security measures on the World Wide Web that prevent automated programs from massive access. To overcome this obstacle attackers generally utilize artificial intelligence technology, which is not only complicated but also not adaptive enough. This paper addresses on the issue of how to defeat complex CAPTCHAs with a social engineering method named CAPTCHA Phishing instead of AI techniques. We investigated each step of this attack in detail and proposed the most effective way to attack. Then we did experiment with real Internet web sites and obtained a positive results. The countermeasures to prevent this attack are also discussed.