1. Breaking Visual CAPTCHAs with Naïve Pattern Recognition Algorithms
Jawaharlal Nehru National College of Engineering, Shimoga – Department of Computer Science & Engineering
Technical Seminar on,
Breaking Visual CAPTCHAs with Naïve Pattern Recognition Algorithms
Presented By
Bhavatarini.N
2nd semester, M.Tech.
Under the guidance of,
Poornima.K.M B.E.,M.Tech.,
Associate Professor.
Dept. of CS&E,JNNCE
Coordinator,
Dr. R Sanjeev Kunte B.E., M.Tech., Ph.D
Professor.
Dept. of CS&E,JNNCE

2. Abstract

3. CAPTCHAs are an effective way to counter bots and reduce spam over the internet. A good CAPTCHA system should give consideration both to computer security and human friendliness.
Captchaservice.org is one of the service providers which generate various CAPTCHAs to clients. The CAPTCHAs designed were resistant against OCR but failed with the naive pattern recognition algorithms which use vertical segmentation and snake segmentation. It is alarming because it provides a false sense of security. Thus the systematically breaking representative schemes will generate convincing evidence and establish valuable insights that will benefit the design of the next generation of robust and usable CAPTCHAs

4. Snake segmentation to break captcha
Introduction
Turing test
Why CAPTCHA?
Types of CAPTCHA
Vertical segmentation to break captcha
Snake segmentation to break captcha
Applications

5. V/S
WHAT HUMAN CAN DO BUT COMPUTERS CAN’T!

6. Completely
Automated
Public
Turing test to tell
Computer and
Humans
Apart

7. Created in 2000 for Yahoo to prevent automated account registration, by Luis von Ahn and team, Carnegie Mellon University.
A program that can tell whether its user is a human or a computer.
It uses a type of challenge-response test to determine that the response is not generated by a computer.

8. Turing test

9. Turing Test “Standard Interpretation"
Player C, the interrogator, is tasked with trying to determine which player - A or B - is a computer and which is a human.

10. Administered by a machine and
Reverse Turing Test
A CAPTCHA is sometimes described as a reverse Turing test, because it is
Administered by a machine and
targeted to a human.

11. Why CAPTCHA???

13. Types of CAPTCHA

14. Types of CAPTCHA
Text CAPTCHA
Graphic CAPTCHA
Audio CAPTCHA
ReCAPTCHA

15. 1.Gimpy 2.Ez-gimpy 3.Baffle text 4.MSN CAPTCHA TEXT CAPTCHAs :
Designed by Yahoo
Picks up 10 random words from dictionary and distorts, fills with noise
User has to recognize at least 3 words
Text CAPTCHA

16. 2.Ez-gimpy 1.Gimpy 3.Baffle text 4.MSN CAPTCHA TEXT CAPTCHAs :
A simplified version of Gimpy.
Has only 1 random string of characters which is a dictionary word.
Prone to dictionary attack

17. 1.Gimpy 2.Ez-gimpy 3.Baffle text 4.MSN CAPTCHA TEXT CAPTCHAs :
Doesn’t contain dictionary words
Picks up random alphabets to create CAPTCHA not prone to dictionary attacks

18. 1.Gimpy 2.Ez-gimpy 3.Baffle text 4.MSN CAPTCHA TEXT CAPTCHAs :
Use eight characters (upper case) and digits.
Foreground is dark blue, and background is grey.
Warping is used to distort the characters, to produce a ripple effect, which makes computer recognition very difficult.

19. Visual Pattern recognition problem
GRAPHIC CAPTCHAs :
1.Bongo
2. PIX
Visual Pattern recognition problem

20. 1.Bongo 2.PIX GRAPHIC CAPTCHAs :
PIX is program that has a large database of images related to certain objects.
Program picks 4 or 6 random images of a certain object then asks the question “what are these pictures of ?”

22. Audio CAPTCHA CAPTCHA based on sound.
Program picks a word or a sequence of numbers randomly into a sound clip and distorts the sound clip

23. reCAPTCHA and book digitization
New form of CAPTCHA that also helps digitize books:
The words displayed to the user come directly from old books that are being digitized;
Words that OCR could not identify.

24. Pairs an unknown word with a known one;
Distorts them both and puts a line through them and then sent them to be proofread;
Respondent answers both elements:
half of effort validates the challenge;
the other half is captured as work.

25. Breaking visual CAPTHAs with naïve pattern recognition algorithms

26. Breaking CAPTCHA
Most text based CAPTCHAs have been broken by software:
OCR(Optical Character Recognization)
Segmentation
captchaservice.org is the first website designed solely for generating CAPTCHA.

27. captchaservice.org supports the following visual schemes:
• word_image : distorted image of a six-letter word.
• random_letters_image: random six-letter sequence.
• user_string_image: user-supplied string of at most 15 characters.
• number_puzzle_text_image: a distorted image of a random number, as well as a textual description of a puzzle involving the number.

28. Breaking scheme 1: To break word_image
Empirical observations from CAPTCHAservice.org
Only 2 colors were used-one for background and another for foreground
Only capital letters were used
Although letters were distorted into different shapes each time , it consisted of a constant number of pixels.

29. Pixel count for each of the letters were thus tabulated.

30. Observations: Most of the letters had distinct pixel count
Few letters overlapped or touched each other in the challenge
So CAPATCHA was decided to be broken by “Vertical segmentation”—
Image would be vertically divided by a program into segments each containing a single character

31. Vertical segmentation algorithm
1. Obtaining the top-left pixel’s color value:
which defines the background color of an image. Any pixel of a different color value in this image is in foreground

32. (0,0) (Image width,0) (0,image height)
2. Identifying the first segmentation line. map the image into a coordinate system, in which the top-left pixel has coordinates (0, 0), the top-right pixel (image width, 0) and the bottom-left pixel (0, image height).
(0,0)
(Image width,0)
(0,image height)

33. Starting from point (0, 0), a vertical “slicing” process traverse pixels from top to bottom and then from left to right. This process stops once a pixel with a non-background color is detected. The X co-ordinate of this pixel, x1, defines the first vertical segmentation line X = x1 -1.
(0,0)

34. 3. Vertical slicing continues from (x1+1, 0), until it detects another vertical line that does not contain any foreground pixels – this is the next segmentation line.
4. Only when the vertical slicing process cuts through the next letter, the next vertical line that does not contain any foreground pixels is the next segmentation line.

35. 5. Step 4 repeats until the algorithm determines the last segmentation line (after which, the vertical slicing will not find any foreground pixels).
Once a challenge image is vertically segmented, the attack program simply counts the number of foreground pixels in each segment. Then, the pixel count obtained is used to look up Table, telling the letter in each segment.

37. Enhancement : dictionary attack

39. Breaking Scheme 2--random_letters_image
Observations
Each image is of the same dimension: 178 × 83 pixels.
Only two colors are used in the image, one for background and another for foreground.
Only capital letters are used.
Each letter has an (almost) constant pixel count and table is valid.

40. Snake segmentation Inspired by the popular “snake” game.
In the algorithm, a snake is a line that separates the letters in an image. It starts at the top line of the image and ends at the bottom.

41. The snake can move in four directions: Up, Right, Left and Down, and it can touch foreground pixels of the image but never cuts through them.
The first step : Preprocess an image to obtain the first and last segmentation lines which is done by vertical segmentation.

42. Rules for movement of the snake
1. Whenever feasible, a snake moves down vertically as much as possible. That is, Down is the direction that has the highest priority.
2. A snake moves down from its starting point until it is immediately above a foreground pixel.
3. When a snake can move Left and Up only, it moves left one pixel. And then moves down as much as possible.

43. 4. When a snake can move Right and Up only, it moves right one pixel
4. When a snake can move Right and Up only, it moves right one pixel. And then moves down as much as possible.
5. When a snake can move right and left only, it goes right. (Priority order: D > R > L > U)
6. When a snake moves left, it cannot go to any point that is to the left of a previously completed segmentation line.

44. 7. A vertical slicing line could be a legitimate segmentation line.
8. Distance control: when a snake reaches the bottom line, it is done.
9. If a snake cannot reach the bottom, it is aborted and all its trace is deleted.
10. No matter whether or not the previous snake succeeded in reaching the bottom, the next snake starts one pixel to the right of the previous starting point.

46. Enhancement technique 2 : Differentiating letters with identical pixel count

47. Differentiating between ‘P’ and ‘V’.
When a segment had a pixel count of 162, it could be either ‘P’ or ‘V’.
Vertical segmentation is done to obtain single letter.
Then, a vertical line would be drawn in the middle of the segment.

48. Telling ‘O’ and ‘K’ apart.
When a segment had a pixel count of 178, it could be either ‘K’ or ‘O’.
Draw a vertical line in the middle of the segment.
The distance between two intersections, denoted by d, was larger for ‘O’ than for ‘K’.

49. APPLICATIONS

50. Online Polls
E-Ticketing
spam

51. Preventing comment spam
Protecting Web Registration

52. As a tool to verify digitized books
Preventing Dictionary Attacks

53. Conclusion

54. CAPTCHAs are an effective way to counter bots and reduce spam
CAPTCHAs are an effective way to counter bots and reduce spam. A good CAPTCHA system should give consideration both to computer security and human friendliness.
However, CAPTCHAs are broken by many image processing techniques. It is alarming because they are likely to provide a false sense of security. Thus the systematically breaking representative schemes will generate convincing evidence and establish valuable insights that will benefit the design of the next generation of robust and usable CAPTCHAs.

55. References
[1] L. von Ahn, M. Blum, N. J. Hopper, and J. Langford. CAPTCHA: Using hard AI problems for security. Proc. of Int. Conf. on the Theory and Applications of Cryptographic Techniques (EUROCRYPT 2003), vol of LNCS, pp. 294– 311, May 2003
[2] Sarika et al., International Journal of Advanced Research in Computer Science and Software Engineering: Understanding Captcha: Text and Audio Based Captcha with its Applications, June , pp
[3] Jeff Yan and A. S. E. Ahmad. Breaking visual CAPTCHAs with naive pattern recognition algorithms. Proc. of 23rd Annual Computer Security Applications Conference (ACSAC 2007), pp. 279–291, Dec
[4] T Converse, “CAPTCHA generation as a web service”, Proc. of Second Int’l Workshop on Human Interactive Proofs (HIP’05), ed. by HS Baird and DP Lopresti, Springer-Verlag. LNCS 3517, Bethlehem, PA, USA, pp

56. [5] Athanasopoulos. E and Antonatos. S
[5] Athanasopoulos.E and Antonatos.S. Enhanced CAPTCHAs: Using animation to tell humans and computers apart. Proc. of 10th Int. Conf. on Communicationsand Multimedia Security (CMS 2006), vol of LNCS, pp. 97–108, October 2006.
[6] Ferzli, R.; Bazzi, R.; Karam, L.J.; A Captcha Based on the Human Visual Systems Masking Characteristics; IEEE International Conference on Multimedia and Expo, 2006,pp
[7] T.-Y. Chan. Using a text-to-speech synthesizer to generate a reverse Turing test. Proc. of 15th IEEE Int.Conf. on Tools with Artificial Intelligence (ICTAI 03), pp. 226–232, November 2003.

57. Thank you