Skip to main content

New attack could make website security captchas obsolete

New attack could make website security captchas obsolete :

Researchers have created new artificial intelligence that could spell the end for one of the most widely used website security systems.
The new algorithm, based on deep learning methods, is the most effective solver of captcha security and authentication systems to date and is able to defeat versions of text captcha schemes used to defend the majority of the world's most popular websites.
Text-based captchas use a jumble of letters and numbers, along with other security features such as occluding lines, to distinguish between humans and malicious automated computer programmes. It relies on people finding it easier to decipher the characters than machines.
Developed by computer scientists at Lancaster University in the UK as well as Northwest University and Peking University in China, the solver delivers significantly higher accuracy than previous captcha attack systems, and is able to successfully crack versions of captcha where previous attack systems have failed.
The solver is also highly efficient. It can solve a captcha within 0.05 of a second by using a desktop PC.
It works by using a technique known as a 'Generative Adversarial Network', or GAN. This involves teaching a captcha generator programme to produce large numbers of training captchas that are indistinguishable from genuine captchas. These are then used to rapidly train a solver, which is then refined and tested against real captchas.
By using a machine-learned automatic captcha generator the researchers, or would be attackers, are able to significantly reduce the effort, and time, needed to find and manually tag captchas to train their software. It only requires 500 genuine captchas, instead of the millions that would normally be needed to effectively train an attack programme.
Previous captcha solvers are specific to one particular captcha variation. Prior machine-learning attack systems are labour intensive to build, requiring a lot of manual tagging of captchas to train the systems. They are also easily rendered obsolete by small changes in the security features used within captchas.
Because the new solver requires little human involvement it can easily be rebuilt to target new, or modified, captcha schemes.
The programme was tested on 33 captcha schemes, of which 11 are used by many of the world's most popular websites -- including eBay, Wikipedia and Microsoft.
Dr Zheng Wang, Senior Lecturer at Lancaster University's School of Computing and Communications and co-author of the research, said: "This is the first time a GAN-based approach has been used to construct solvers. Our work shows that the security features employed by the current text-based captcha schemes are particularly vulnerable under deep learning methods.
"We show for the first time that an adversary can quickly launch an attack on a new text-based captcha scheme with very low effort. This is scary because it means that this first security defence of many websites is no longer reliable. This means captcha opens up a huge security vulnerability which can be exploited by an attack in many ways.
Mr Guixin Ye, the lead student author of the work said: "It allows an adversary to launch an attack on services, such as Denial of Service attacks or spending spam or fishing messages, to steal personal data or even forge user identities. Given the high success rate of our approach for most of the text captcha schemes, websites should be abandoning captchas."
Researchers believe websites should be considering alternative measures that use multiple layers of security, such as a user's use patterns, the device location or even biometric information.
The research is published in the paper 'Yet Another Text Captcha Solver: A Generative Adversarial Network Based Approach' which was presented at the ACM Conference on Computer and Communications Security (CCS) 2018 in Toronto.
The research benefitted from funding from the Engineering and Physical Sciences Research Centre, or EPSRC, The Royal Society and the National Natural Science Foundation of China.

Comments

Post a Comment

Popular posts from this blog

Size matters: New data reveals cell size sparks genome awakening in embryos

Transitions are a hallmark of life. When dormant plants flower in the spring or when a young adult strikes out on their own, there is a shift in control. Similarly, there is a transition during early development when an embryo undergoes biochemical changes, switching from being controlled by maternal molecules to being governed by its own genome. For the first time, a team from the Perelman School of Medicine at the University of Pennsylvania found in an embryo that activation of its genome does not happen all at once, instead it follows a specific pattern controlled primarily by the various sizes of its cells. The researchers published their results this week as the cover story in  Developmental Cell . In an early embryo undergoing cell division, maternally loaded RNA and proteins regulate the cell cycle. The genomes of the zygote -- a term for the fertilized egg -- are initially in sleep mode. However, at a point in the early life of the embryo, these zygotic nuclei "wake...
Post a Comment
Read more

Home births as safe as hospital births: International study suggests

A large international study led by McMaster University shows that low risk pregnant women who intend to give birth at home have no increased chance of the baby's perinatal or neonatal death compared to other low risk women who intend to give birth in a hospital. The results have been published by  The Lancet 's  EClinicalMedicine  journal. "More women in well-resourced countries are choosing birth at home, but concerns have persisted about their safety," said Eileen Hutton, professor emeritus of obstetrics and gynecology at McMaster, founding director of the McMaster Midwifery Research Centre and first author of the paper. "This research clearly demonstrates the risk is no different when the birth is intended to be at home or in hospital." The study examined the safety of place of birth by reporting on the risk of death at the time of birth or within the first four weeks, and found no clinically important or statistically different risk between home...
Post a Comment
Read more

Molecular adlayer produced by dissolving water-insoluble nanographene in water

Molecular adlayer produced by dissolving water-insoluble nanographene in water : "Nanographene incorporated micelle capsules" can be prepared by simply pulverizing and mixing nanographene with amphiphilic V-shaped anthracene molecules in water at room temperature. Even though nanographene is insoluble in water and organic solvents, Kumamoto University (KU) and Tokyo Institute of Technology (Tokyo Tech) researchers have found a way to dissolve it in water. Using "molecular containers" that encapsulate water-insoluble molecules, the researchers developed a formation procedure for a nanographene adlayer, a layer that chemically interacts with the underlying substance, by just mixing the molecular containers and nanographene together in water. The method is expected to be useful for the fabrication and analysis of next-generation functional nanomaterials. Graphene is a single layer of carbon atoms arranged in sheet form. It is lighter than metal wit...
Post a Comment
Read more