A computer vision attack on the ARTiFACIAL CAPTCHA

• Published in: Multimedia tools and applications Vol. 74; no. 13; pp. 4583 - 4597
• Main Author: Li, Qiujie
• Format: Journal Article
• Language: English
• Published: New York Springer US 01.06.2015; Springer Nature B.V
• Subjects: Algorithms; Analysis; Artificial intelligence; Automation; Computation; Computer Communication Networks; Computer Science; Computer vision; Computers; Cultural differences; Data Structures and Information Theory; Design engineering; Facial; Human; Logic; Multimedia computer applications; Multimedia Information Systems; Network security; Sensors; Special Purpose and Application-Based Systems; Studies; Success; Texts; Vision systems; CAPTCHA; Computer vision; ARTiFACIAL; Attack
• ISSN: 1380-7501; 1573-7721
• DOI: 10.1007/s11042-013-1823-z

Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) is a reverse Turing test that is used to differentiate bots from humans. Text CAPTCHAs have been widely used in commercial applications, but most of the text CAPTCHAs have been successfully attacked. An alternative is to develop image CAPTCHAs to replace text CAPTCHAs. ARTiFACIAL (Automated Reverse Turing test using FACIAL features) Rui and Liu ( 2003 ) is an image CAPTCHA system based on detecting human face and facial features and claimed to be attack-resistant and user-friendly. This paper proposes a compute vision attack on ARTiFACIAL. By carefully analyzing the limitations of face and facial feature detectors that ARTiFACIAL exploits, tailor-made attacking algorithm is designed instead of using general face and facial feature detectors directly. When tested with the 800 ARTiFACIAL challenges, the overall success rate of the attacking algorithm is 18.0 %, which is significantly higher than the estimate of 0.0006 % given in Rui and Liu ( 2003 ) for computer vision attacks. It takes an average time 1.47s for a PC with 3.2GHz Intel P4 and 2GB memory to pass an ARTiFACIAL test, compared with 14s for a human subject given in Rui and Liu ( 2003 ). From the successful attack, useful lessons for guiding the design of image CAPTCHAs are derived to advance the current understanding of the design of image CAPTCHAs and lead to more secure design.