DOCSLIB.ORG

Rtcaptcha: a Real-Time Captcha Based Liveness Detection System Erkam Uzun, Simon Pak Ho Chung, Irfan Essa, Wenke Lee

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Rtcaptcha: a Real-Time Captcha Based Liveness Detection System Erkam Uzun, Simon Pak Ho Chung, Irfan Essa, Wenke Lee rtCaptcha: A Real-Time Captcha Based Liveness Detection System Erkam Uzun, Simon Pak Ho Chung, Irfan Essa, Wenke Lee SMILE, AND YOU ARE AUTHENTICATED ATTACK CHANNELS OF BIOMETRIC AUTHENTICATION ENDLESS ARMS RACE vs A MORE FUNDAMENTAL ACCURACY ANALYSIS Face Verification Cloud Services APPROACH? Accuracy (%) Accuracy (%) Response Time Challenge ◉ Microsoft Cognitive Services IDEA: Base our solution (1 trial) (2 trials) (seconds) on a known hard problem Plain-text 90.3 100 0.77 ◉ Amazon Rekognition ◉ Face++ Captcha 88.8 98.4 0.93 ◉ Kairos Human Analytics Smile/Blink 85.5 100 5.01 CHALLENGE: Prove you SECURITY ANALYSIS are the real user by 67897:: Users in ,-.-/0: Man-powered Captcha solving services. reading the answer to the our user study. ,-. : OCR-based Captcha decoding services. CAPTCHA in front of the 1.2 camera please. ,-.345-: State-of-the art Captcha breaking tool. Computer graphics will Captcha Captcha Recognition Accuracy (%) ADVERSARIAL MODELS vs DEFENSE SYSTEMS NOT help since you can Sample Scheme 67897: Atc>?@ AtcABC AtcDEF> NOT generate the right 24G90-.H9I7842J. 87.1 96.7 0 77.2 AND THAT IS ONLY THE BEGINNING… . 3D Face video without solving the Still Video Model, K39/I7842J. 94.1 100 0 58.8 3D Mask CAPTCHA. Image Replay DL- Attack L9I:4MI7842J. 87.7 96.7 0 2.2 Attack Attack Based OUR APPROACH: rtCAPTCHA 24G90-.H9 88.0 91.5 0 N/A Attacks Send randomized challenges as CAPTCHA 0H2954 Captcha Captcha Response Time (seconds) CHpa CHpa CHpa CHca Sample Scheme Auth. Send Captcha 67897: Atc>?@ AtcABC AtcDEF> Motion Request Challenges Extra 24G90-.H9I7842J. 0.90 22.11 2.98 10.27 Blink, consist., H/W,e.g., K39/ 0.73 12.33 2.79 5.98 Smile… Texture, ? If I7842J. IR, Depth -Display Detection Reflect. Captcha resp. L9I:4MI7842J. 0.89 15.05 3.30 15.50 Camera Captcha Analysis match. & -Get voice 24G90-.H90H2954 1.02 20.88 3.03 N/A ! ≤ ! & response "#$% '()*+ Face and voice COMPROMISING ATTACK EXAMPLE -Grab face verified CONCLUSIONS 3D Model Fitting - Fit face model on a Verified Image Credit: IBM Future of Identity Study A ◉ Smile/blink etc. detection is weak against spoofing. malicious Capture 3DMM. ◉ rtCaptcha: Audio/image analysis à CAPTCHA UNFORTUNATELY… CRAZYTALK HAPPENED… app, has enough raw - Synthesize facial texture. ◉ rtCaptcha: Very limited time to; access to material, e.g., - Transfer 3D face to a VR USER STUDY The free sample of the tool CrazyTalk can create cartoon cam., mic., victim’s face environment. * Break Captcha version of a person and defeat all tested systems…. etc. - Give real-time challenge Challenges * Synthesize voice/face of the victim. 100% impersonation against Face API (MS), Face++ response. ◉ ⦿ Plaintext – Numeric and Phrases (Alipay) ◉ Limitation: rtCaptcha needs audible response, which ⦿ Numeric Captchas – reCaptcha, Ebay, Yandex could NOT be usable in certain environments. ◉ 90% impersonation against Amazon Rekognition ⦿ Animated Phrase Captchas – reCaptcha Also defeats existing liveness detection THREAT MODEL ⦿ Blink/Smile ◉ You can make the cartoon smile, blink, nod, talk whenever you want Automated compromising attacks. ◉ Camera, microphone and device kernel are compromised. ◉ No form of attestation. ◉ Known client-server protocol. ◉ State-of-the art synthesizers and Captcha breaking tools. Authentication server is NOT compromised. Genuine Spoofed Genuine Spoofed ◉ MS Face API : 68% Similarity Smile: Smile: Amazon Rec : 74% Similarity 0.001 0.421 Face++ : 88% Similarity Kairos : 75% Similarity POSTER TEMPLATE BY: www.PosterPresentations.com.
Load more

Recommended publications
  • Amazon.Com E-Tail Customer Fulfillment Networks Pioneer
    Customer Fulfillment in the Digital Economy Amazon.com E-tail Customer Fulfillment Networks Pioneer “The logistics of distribution Scorecard are the iceberg below the 1 waterline of online bookselling.” B-web type • Aggregation (e-tail) /Agora —Jeff Bezos, (auctions, Zshops) hybrid model founder and CEO, Amazon.com KEY PARTICIPANTS “Ten years from now, no one Customers • Consumers and business buyers will remember whether Context providers • Amazon.com and online Amazon.com spent an extra merchants (Amazon.com $100,000 upgrading shipping associates, Zshops, auctions) from the West Coast to the East Content providers • Amazon.com and small online merchants (Amazon.com Coast. All that will matter is associates, Zshops, auctions) whether electronic commerce • Suppliers and b-web partners gave people a good or bad (publishers; producers [OEM]; distributors e.g. Ingram Micro, experience.”2 Baker & Taylor Books, and others) —David Risher, senior vice president for Commerce services • Amazon.com and merchants merchandising, Amazon.com participating in auctions and Zshops “This [the Amazon.com • Third party shippers (UPS & USPS) distribution warehouses and Infrastructure providers • Amazon.com Drop shippers such as Ingram CFN] is the fastest expansion of • • Technology providers such as distribution capacity in Oracle, Net Perceptions, and i2 peacetime history.”3 Technologies Third party shippers (UPS, USPS) —Jeff Bezos, • founder and CEO, Amazon.com Offering • The largest online e-tailer of books, music, videos, toys, and gifts • Recently expanded service offering to include auctions (March 1999) and Zshops (September 1999)—an aggregation of merchants on its Web site • Aspires to become a one-stop shop for merchandise on the Web CFN value proposition • “Earth’s largest selection” of merchandise at competitive prices, 360 Adelaide Street W, 4th Floor a validated product assortment, Toronto, Ontario.
    [Show full text]
  • Rtcaptcha: a Real-Time CAPTCHA Based Liveness Detection System
    rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System Erkam Uzun, Simon Pak Ho Chung, Irfan Essa and Wenke Lee Department of Computer Science Georgia Institute of Technology, USA Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System 1 Face Authentication Systems Background rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 2 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Deep Learning Outperforms rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 3 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Deployed by Major Companies Face Verification Cloud Services ◉ Microsoft Cognitive Services [3] ◉ Amazon Rekognition [4] ◉ Face++ [5] ◉ Kairos Human Analytics [6] rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 4 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Attack Channels of Biometric Authentication rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 5 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Adversarial Models vs Defense Systems 3D Face Still Video 3D Mask Model, Image Replay Attack DL-Based Attack Attack Attacks CHpa CHpa CHpa CHca Motion Extra Blink, consist., H/W, e.g., Smile… Texture, ? IR, Depth Reflect.
    [Show full text]
  • The Essential Guide to Telecommunications, Sixth Edition
    PRAISE FOR THE ESSENTIAL GUIDE TO TELECOMMUNICATIONS, SIXTH EDITION “Dodd’s The Essential Guide to Telecommunications provides the history and context that make a fundamental underpinning of modern business more accessible to technologists and businesspeople alike. This new edition of her primer is an essential reference in the continuously evolving communica- tions landscape.” —Tom Hopcroft, President and CEO, Mass Technology Leadership Council “Annabel Dodd’s book is a clear guide and big-picture view of technologies and industries. It is an up-to-date guide for anyone who wants to be familiar with important innovations and key technologies. This is truly an industry bible for mobile, Internet, and networking services.” —Hiawatha Bray, Technology Reporter, The Boston Globe “Ms. Dodd’s aptly titled The Essential Guide to Telecommunications has been my bible for all things telecom since my days as an AT&T transmission network engineer nearly twenty years ago. Exhaus- tively and meticulously researched, concisely written for lay folks and techs/engineers alike, this book aids me in my current role as an IT Support Technician II when discussing new technology with our telecommunications department. Thank you to Ms. Dodd for keeping us all current!” —Todd Garbarini, IT Support Technician II Commvault Systems, Inc. “The Essential Guide to Telecommunications is probably one of the most useful and well-written books on our telecom bookshelf. Annabel Z. Dodd does a great job of capturing a snapshot of the current telecom industry. Even those with little or no technical training should be able to understand the text. This is the perfect book for salespeople who want to learn more about the products and services they are selling, or for those who just want to keep up to date on the latest in telecom technology.” —William Van Hefner, President, Vantek Communications, Inc.
    [Show full text]
  • Interactive Attendee Guide for Oil & Gas Professionals
    oil & gas Interactive attendee guide for Oil & Gas Professionals Hello, On behalf of the entire AWS Worldwide Oil & Gas team, welcome to re:Invent 2018! This year’s conference is going to be our Welcome. biggest yet, with 50,000+ attendees and more than 2,000 technical sessions. To get the most out of re:Invent, we encourage you to take advantage of the resources outlined in this document, including our “How to re:Invent” video series. Keep in mind that reserved seating goes live on October 11. You can start planning your schedule at any time by logging into your account, visiting the session catalog, and marking sessions of interest. Although re:Invent is a big conference, the strength of the Oil & Gas community makes it feel much smaller. We look forward to seeing you in Vegas! Arno van den Haak Business Development, AWS Worldwide Oil & Gas © 2018 | Amazon Web Services. All rights reserved. Table of contents What to expect in 2018 » Let’s get started. re:Invent agenda » Oil & Gas sessions » This guide is designed to help attendees of AWS re:Invent 2018 plan their experience and identify breakout sessions and events of interest. It is intended to complement the re:Invent app, Other recommended sessions » which will help attendees navigate the conference on-site. Networking opportunities » Click on the links to navigate this guide. Executive Summit overview » Event venues and logistics » AWS Oil & Gas contacts » © 2018 | Amazon Web Services. All rights reserved. What to expect Networking re:Invent Agenda Oil & Gas Other Recommended Executive Summit Event Venue AWS Oil & Gas in 2018 Sessions Sessions Opportunities Overview and Logistics Expert Contacts What Where AWS re:Invent is a learning conference hosted by Amazon Web We are taking over Las Vegas--with events at the ARIA, Vdara, Services (AWS) for the global cloud computing community.
    [Show full text]
  • Amazon Officials Pitched Their Facial Recognition Software to ICE 24 October 2018, by Matt Day, the Seattle Times
    Amazon officials pitched their facial recognition software to ICE 24 October 2018, by Matt Day, The Seattle Times Amazon officials earlier this year pitched the employee sent to someone at ICE containing a link company's controversial facial recognition software to an Amazon blog post questioning the ACLU's to the U.S. Immigration and Customs Enforcement methodology in its experiment on members of agency, according to documents uncovered by the Congress and sticking up for Rekognition's utility. Project on Government Oversight. The link "may be of interest given your ongoing efforts," the sales employee wrote. The disclosure comes as Amazon's product and similar tools built by other companies come under The second email, also from an AWS sales scrutiny from civil-liberties groups, legislators and employee, referred to an apparent meeting in June even some of their own employees because of the between AWS employees and a representative of technology's potential for misuse. ICE's Homeland Security Investigations team at the Redwood City, Calif., offices of consulting giant The relationship between high-tech firms and ICE McKinsey & Co. Included on a list of follow-up has also been a flashpoint since the outcry over items was a bullet point about Rekognition's the agency's enforcement of a Trump capabilities. "Thanks again for your interest in AWS administration policy of separating migrant parents to support ICE and the HSI mission," the email and children arriving at the U.S. border. Employee concluded. groups at Microsoft, Google and Amazon have all raised concerns about their companies' Matthew Bourke, a spokesman for ICE, said in an relationship with ICE or Defense Department emailed statement that the agency doesn't have a projects.
    [Show full text]
  • Machine Learning and AI: the Next Frontier Of
    Machine Learning and AI: The Next Frontier of Federal Technology By FedScoop Staff The next generation of space explorers won’t be limited just to many federal agencies are tentative of a move toward this astronauts. No, NASA and its Jet Propulsion Lab (JPL) believe evolving intelligence paradigm, early adopters have realized that with the power of the cloud, Machine Learning and artificial that their growing mountain of data that’s often sitting intelligence, the ability to voyage through space will be open to around unused can be put to good use. all people—whether they’re standing on the surface of Mars or in the comfort of their homes. Agencies, for instance, are leveraging Amazon Rekognition, an image-detection service. The service leverages deep “The idea with this is we’re all going to be the future explorers,” neural network models to detect and label thousands said JPL’s IT Chief Technology and Innovation Officer, Tom of objects and scenes in images, new labels and facial Soderstrom, at a recent conference. “Your children are the ones recognition features continually added to the service. who are one day going to walk on Mars, whether it is virtually through augmented reality or physically as astronauts.” Powered by Amazon Web Services’s automatic speech Machine Learning vs Artificial Intelligence recognition (ASR) and natural language understanding (NRU) Artificial Intelligence: the simulation of human service Lex—the same deep-learning technologies that drive intelligence processes by machines, especially the Amazon’s Alexa—JPL developed NASA Mars, an app computer systems. These processes include learning that allows humans to ask questions about Mars and engage (the acquisition of information and rules for using them with the agencies’ missions.
    [Show full text]
  • Architecting for HIPAA Security and Compliance Whitepaper
    Architecting for HIPAA Security and Compliance on Amazon Web Services AWS Whitepaper Architecting for HIPAA Security and Compliance on Amazon Web Services AWS Whitepaper Architecting for HIPAA Security and Compliance on Amazon Web Services: AWS Whitepaper Copyright © Amazon Web Services, Inc. and/or its affiliates. All rights reserved. Amazon's trademarks and trade dress may not be used in connection with any product or service that is not Amazon's, in any manner that is likely to cause confusion among customers, or in any manner that disparages or discredits Amazon. All other trademarks not owned by Amazon are the property of their respective owners, who may or may not be affiliated with, connected to, or sponsored by Amazon. Architecting for HIPAA Security and Compliance on Amazon Web Services AWS Whitepaper Table of Contents Abstract ............................................................................................................................................ 1 Introduction ...................................................................................................................................... 2 Encryption and protection of PHI in AWS .............................................................................................. 3 Alexa for Business ...................................................................................................................... 6 Amazon API Gateway ................................................................................................................. 6 Amazon AppFlow
    [Show full text]
  • NOTICE of 2019 ANNUAL MEETING of SHAREHOLDERS to Be Held on Wednesday, May 22, 2019
    NOTICE OF 2019 ANNUAL MEETING OF SHAREHOLDERS To Be Held on Wednesday, May 22, 2019 The 2019 Annual Meeting of Shareholders of Amazon.com, Inc. (the “Annual Meeting”) will be held at 9:00 a.m., Pacific Time, on Wednesday, May 22, 2019, at Fremont Studios, 155 N. 35th Street, Seattle, Washington 98103, for the following purposes: 1. To elect the ten directors named in the Proxy Statement to serve until the next Annual Meeting of Shareholders or until their respective successors are elected and qualified; 2. To ratify the appointment of Ernst & Young LLP as our independent auditors for the fiscal year ending December 31, 2019; 3. To conduct an advisory vote to approve our executive compensation; 4. To consider and act upon the shareholder proposals described in the Proxy Statement, if properly presented at the Annual Meeting; and 5. To transact such other business as may properly come before the meeting or any adjournment or postponement thereof. Our Board of Directors recommends you vote: (i) “FOR” the election of each of the nominees to the Board; (ii) “FOR” the ratification of the appointment of Ernst & Young LLP as independent auditors; (iii) “FOR” approval, on an advisory basis, of our executive compensation as described in the Proxy Statement; and (iv) “AGAINST” each of the shareholder proposals. The Board of Directors has fixed March 28, 2019 as the record date for determining shareholders entitled to receive notice of, and to vote at, the Annual Meeting or any adjournment or postponement thereof. Only shareholders of record at the close of business on that date will be entitled to notice of, and to vote at, the Annual Meeting.
    [Show full text]
  • Library Services Library Services Young Adult
    THE OFFICIAL JOURNAL OF THE YOUNG ADULT LIBRARY SERVICES ASSOCIATION young adult 2012 library library services services VOLUME 11 | NUMBER 3 SPRING 2013 ISSN 1541-4302 $17.50 INSIDE: THE BIG PICTURE OF YA SERVICES LISTENING WITH OUR EARS E-BOOKS: WHAT’S AWARDS THE BIG DEAL ISSUE AND MORE . The #1 eBook service for libraries is now #1 for schools. OverDrive helps get more students reading with a digital lending service offering the books you need with technology that works. Largest selection of top quality content to meet curriculum & instruction goals, especially Common Core (CCSS) Compatible with all major computers and devices, ® ® ® including iPad , Nook & Kindle (US only) Flexible and affordable, with required reading volume discounts Contact us: [email protected] (216) 573-6886 www.overdrive.com/school The leading eBook service with a growing network of 22,000 libraries & schools worldwide © 2013 OverDrive, Inc. The official journal of The Young adulT librarY ServiceS aSSociaTion young adult library services VOLUME 11 | NUMBER 3 SPRING 2013 ISSN 1541-4302 The View from ALA Plus: 4 E-Books? 2 From the Editor So What’s the Big Deal? Linda W. Braun By Chanitra Bishop and Marijke Visser 3 From the President Jack Martin YALSA Perspectives 36 Guidelines for Authors 9 What YALSA’s Members Have to Say 36 Index to Advertisers By Robin Fogle Kurz 38 The YALSA Update 11 Top Ten Reasons Not to Run for YALSA Board and Why You Might Be Wrong About Them By Sarah Flowers Best Practices 13 The Big Picture of YA Services Analyzing the Results of the 2012 PLA PLDS Survey About This Cover By Denise E.
    [Show full text]
  • The Price of Prime—Consumer Privacy in the Age of Amazon
    Mitchell Hamline Law Journal of Public Policy and Practice Volume 42 Issue 1 Article 4 2021 The Price of Prime—Consumer Privacy in the Age of Amazon Ariana Aboulafia Greg Fritzius Tessa Mears Macy Nix Follow this and additional works at: https://open.mitchellhamline.edu/policypractice Part of the Antitrust and Trade Regulation Commons, Consumer Protection Law Commons, and the Privacy Law Commons Recommended Citation Aboulafia, Ariana; ritzius,F Greg; Mears, Tessa; and Nix, Macy (2021) "The Price of Prime—Consumer Privacy in the Age of Amazon," Mitchell Hamline Law Journal of Public Policy and Practice: Vol. 42 : Iss. 1 , Article 4. Available at: https://open.mitchellhamline.edu/policypractice/vol42/iss1/4 This Article is brought to you for free and open access by the Law Reviews and Journals at Mitchell Hamline Open Access. It has been accepted for inclusion in Mitchell Hamline Law Journal of Public Policy and Practice by an authorized administrator of Mitchell Hamline Open Access. For more information, please contact [email protected]. © Mitchell Hamline School of Law Aboulafia et al.: The Price of Prime THE PRICE OF PRIME—CONSUMER PRIVACY IN THE AGE OF AMAZON Ariana Aboulafia, Greg Fritzius, Tessa Mears & Macy Nix TABLE OF CONTENTS I. INTRODUCTION ................................................................................................................ 139 II. THE TROUBLESOME TRIFECTA ......................................................................................... 141 A. Amazon Alexa.............................................................................................................
    [Show full text]
  • Amazon.Com, Inc. Incoming Letter Dated March 29, 2019
    UNITED STATES SECURITIES AND EXCHANGE COMMISSION WASHINGTON , D.C. 20549 DIVISION OF CORPORATION FINANCE April 3, 2019 Ronald O. Mueller Gibson, Dunn & Crutcher LLP [email protected] Re: Amazon.com, Inc. Incoming letter dated March 29, 2019 Dear Mr. Mueller: This letter is in response to your correspondence dated March 29, 2019 concerning the shareholder proposals (the “Proposals”) submitted to Amazon.com, Inc. (the “Company”) by the Sisters of St. Joseph of Brentwood et al. and John C. Harrington (the “Proponents”). We also have received correspondence on the Proponents’ behalf dated April 2, 2019. On March 28, 2019, we issued a no-action response expressing our informal view that the Company could not exclude the Proposals from its proxy materials for its upcoming annual meeting. You have asked us to reconsider our position. After reviewing the information contained in your correspondence, we find no basis to reconsider our position. Under Part 202.1(d) of Section 17 of the Code of the Federal Regulations, the Division may present a request for Commission review of a Division no-action response relating to Rule 14a-8 under the Exchange Act if it concludes that the request involves “matters of substantial importance and where the issues are novel or highly complex.” We have applied this standard to your request and determined not to present your request to the Commission. Copies of all of the correspondence on which this response is based will be made available on our website at http://www.sec.gov/divisions/corpfin/cf-noaction/14a-8.shtml. For your reference, a brief discussion of the Division’s informal procedures regarding shareholder proposals is also available at the same website address.
    [Show full text]
  • For the Love of Reading DANIEL T
    VOL. 39, NO. 1 | SPRING 2015 www.aft.org /ae For the Love of Reading DANIEL T. WILLINGHAM EXPLAINS HOW TO ENGAGE STUDENTS IN A LIFELONG PURSUIT PAGE 4 14 18 24 32 38 Philosophy PISA Results Getting Group for High School and Opportunity Work Right Students to Learn WHERE WE STAND Whether you are a general educator or a specialist in teaching English language learners, Colorín Colorado is for YOU! ColorinColorado.org, the nation’s leading ELL website for educators and parents, is your one-stop shop for FREE research-based information on how to help ELLs read and succeed! For the past 10 years, the American Federation of Teachers and PBS station WETA have collaborated to bring you the best, most comprehensive information, including: • Strategies and articles • Classroom videos • Interviews with researchers, educators, and authors • Reading tip sheets • Multicultural book lists • Information on the Common Core and ELLs • Much, much more on what works with ELLs We invite you to join the millions of preK–12 educators of ELLs who have discovered thousands of resources on Colorín Colorado. Start using them now! ColorinColorado.org And on this 10th anniversary, we are proud to have the National Education Association working with us to support Colorín Colorado! WHERE WE STAND Reading: A Lifelong Love RANDI WEINGARTEN, AFT President I CAN’T IMAGINE my life without books. However, our partnership with First children also need to see themselves, their My father was an electrical engineer, and Book is about more than just giving books experiences, and their cultures reected in my mother was a public school teacher; to students in need.
    [Show full text]