2017/02/13 by Carlos Javier Hernández‐Castro, Carlos Javier Hernández-Castro, María D. R-Moreno +7
Computer Science · #Advanced Authentication Protocols Security #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Spam and Phishing Detection #User Authentication and Security Systems #cs.CR
paper · pdf · doi:10.48550/arxiv.1702.03815
arxiv created 2017/02/13 · openalex publication_date 2017/02/13 · arxiv updated 2017/02/14 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
CAPTCHAs/HIPs are security mechanisms that try to prevent automatic abuse of services. They are susceptible to learning attacks in which attackers can use them as oracles. Kwon and Cha presented recently a novel algorithm that intends to avoid such learning attacks and "detect all bots". They add uncertainties to the grading of challenges, and also use trap images designed to detect bots. The authors suggest that a major IT corporation is studying their proposal for mainstream implementation. We present here two fundamental design flaws regarding their trap images and uncertainty grading. These leak information regarding the correct grading of images. Exploiting them, an attacker can use an UTS-CAPTCHA as an oracle, and perform a learning attack. Our testing has shown that we can increase any reasonable initial success rate up to 100%.