Breaking Visual CAPTCHAs with Naive Pattern Recognition Algorithms

Visual CAPTCHAs have been widely used across the Internet to defend against undesirable or malicious bot programs. In this paper, we document how we have broken most such visual schemes provided at Captchaservice.org, a publicly available web service for CAPTCHA generation. These schemes were effectively resistant to attacks conducted using a high-quality Optical Character Recognition program, but were broken with a near 100% success rate by our novel attacks. In contrast to early work that relied on sophisticated computer vision or machine learning algorithms, we used simple pattern recognition algorithms but exploited fatal design errors that we discovered in each scheme. Surprisingly, our simple attacks can also break many other schemes deployed on the Internet at the time of writing: their design had similar errors. We also discuss defence against our attacks and new insights on the design of visual CAPTCHA schemes.

1 Introduction

CAPTCHA stands for “Completely Automated Public Turing Test to Tell Computers and Humans Apart”, and a CAPTCHA is a program that generates and grades tests that most human can pass, but current computer programs cannot pass [1]. Such tests are often called CAPTCHA challenges, and they are based on a hard, open problem in AI. At present, CAPTCHA is almost a standard security mechanism for defending against undesirable and malicious bot programs on the Internet, e.g., bots that could sign up for thousands of accounts a minute with free email service providers, bots that could send out thousands of spam messages each minute, and bots that could in one act post numerous comments in weblogs (“blogs”) pointing both readers and search engines to irrelevant sites.