Rtcaptcha: a Real-Time CAPTCHA Based Liveness Detection System

rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System Erkam Uzun, Simon Pak Ho Chung, Irfan Essa and Wenke Lee Department of Computer Science Georgia Institute of Technology, USA Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System 1 Face Authentication Systems Background rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 2 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Deep Learning Outperforms rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 3 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Deployed by Major Companies Face Verification Cloud Services ◉ Microsoft Cognitive Services [3] ◉ Amazon Rekognition [4] ◉ Face++ [5] ◉ Kairos Human Analytics [6] rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 4 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Attack Channels of Biometric Authentication rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 5 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Adversarial Models vs Defense Systems 3D Face Still Video 3D Mask Model, Image Replay Attack DL-Based Attack Attack Attacks CHpa CHpa CHpa CHca Motion Extra Blink, consist., H/W, e.g., Smile… Texture, ? IR, Depth Reflect. Detection Camera Analysis rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 6 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Threat Model Automated compromising attacks. ◉ Camera, microphone and device kernel are compromised. ◉ No form of attestation. ◉ Known client-server protocol. ◉ State-of-the art synthesizers and Captcha breaking tools. ◉ Authentication server is NOT compromised. rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 7 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Compromising Attack: Example-1 3D Model Fitting [7] - Fit face model on a A malicious Capture 3DMM. app, has enough raW - Synthesize photorealistic access to material, facial texture. cam., mic., e.g., victim’s - Transfer 3D face to a etc. face VR environment. - AnsWer challenge at real-time. Applied by Xu et al. “VirtualU” (Usenix’16) rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 8 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Compromising Attack: Example-2 Victim Sharif et al. “Accessorize Victim to a Crime” (CCS’16) Fooled Face++ with 100% A malicious Capture Impersonation [8] app, has enough raW Create a perturber access to material, ≠ (e.g., eye glass) = cam., mic., e.g., victim’s Impersonate victim etc. face Known Face Rec. NN! Attacker Attacker rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 9 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Face Authentication Face Spoofing Methods Face Spoofing Results Challenge Spoofing Voice Authentication Voice Spoofing Methods Voice Spoofing Results Security of Industry 2 Leading Solutions (Face Authentication) Do We need sophisticated attacks? rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 10 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Face Authentication Face Spoofing Methods Face Spoofing Results Challenge Spoofing Voice Authentication Voice Spoofing Methods Voice Spoofing Results Security of Cloud Systems Face Verification Cloud Services Attack Vector ◉ Microsoft Cognitive Services ◉ Amazon Rekognition ◉ Face++ ◉ Kairos Human Analytics Database ◉ First 10 subjects of CASIA Face Anti- Spoofing Database [9]. ◉ Six attack images are generated for each subject. rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 11 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Face Authentication Face Spoofing Methods Face Spoofing Results Challenge Spoofing Voice Authentication Voice Spoofing Methods Voice Spoofing Results Security of Cloud Systems (cont’d) Cognitive Baseline/Conf. (%) Spoofed/Overall Confidence (%) Service TP TN �� MS Cognitive 100/78 100/65 100/70 100/75 100/70 100/82 100/84 100/86 Amazon 100/97 100/82 100/89 80/77 90/67 70/84 60/84 90/89 Face++ 100/87 100/83 100/86 100/71 100/72 90/77 70/80 70/75 Kairos 100/80 80/58 100/75 100/78 100/73 100/91 100/83 100/80 rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 12 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Face Authentication Face Spoofing Methods Face Spoofing Results Challenge Spoofing Voice Authentication Voice Spoofing Methods Voice Spoofing Results Security of Cloud Systems (cont’d) MS Cognitive Service rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 13 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Face Authentication Face Spoofing Methods Face Spoofing Results Challenge Spoofing Voice Authentication Voice Spoofing Methods Voice Spoofing Results Security of Industry 3 Leading Solutions (Speaker Authentication) Do they also vulnerable to spoof? rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 14 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Face Authentication Face Spoofing Methods Face Spoofing Results Challenge Spoofing Voice Authentication Voice Spoofing Methods Voice Spoofing Results Security of Cloud Systems (cont’d) Speaker Verification Cloud Services Methodology ◉ Microsoft Cognitive Services ◉ 30 seconds of genuine samples are enrolled for each subject. Hence, a group With 10 people in MS Cognitive Service is created. Database ◉ Randomly selected different samples for ./0 ◉ �,-- : Contain 7 different DL-based genuine and spoofed voices are tested. synthesized version of genuine samples from two subjects, both female and male [10]. .4 ◉ �123 to �123: Contain genuine samples and their voice converted (7) and synthesized (3) versions of randomly selected 8 subjects from ASV Spoofing Challenge database [11]. rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 15 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System Face Authentication Face Spoofing Methods Face Spoofing Results Challenge Spoofing Voice Authentication Voice Spoofing Methods Voice Spoofing Results Security of Cloud Systems (cont’d) Test Detected as Test Detected as Test Detected as Sample Original (%) Sample Original (%) Sample Original (%) � � Original 97.0 �� 60.0 �� 71.3 �/� � �� 100 �� 77.5 �� 91.3 � � �� 81.3 �� 77.5 � � �� 28.8 �� 50.0 � � �� 47.5 �� 33.8 rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 16 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System 2 Proposed System Fundamental Problem of Existing Schemes Real-Time Captcha (rtCaptcha) ◉ Predictable challenges. ◉ Randomized challenges. ◉ Security relies on audio/face analysis, Which has ◉ Security relies on an existing liveness detection endless improvement in adversarial settings. mechanism. ◉ Captcha provides tWo types of randomness: 1) Challenge semantic, 2) Captcha scheme rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 17 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System System Overview -Display If Send Captcha Captcha resp. match. Authent. Captcha -Get voice � ≤ � Verified Request AB2C DEF1- Challenge response Face and voice -Grab face verified rtCaptcha: A Real-Time CAPTCHA Based Liveness Detection System, NDSS 2018 18 Defense Threat Threat Sec. of Current Proposed User Sec. of Proposed Background Cloud Services Attacks Conclusion Methods Model Example Systems System Study System User Study Challenges ⦿ Plaintext – Numeric and Phrases ⦿ Numeric Captchas – reCaptcha, Ebay, Yandex ⦿ Animated Phrase Captchas – reCaptcha ⦿ Blink/Smile Accuracy (%) Accuracy (%) Response Time Challenge (1 trial) (2 trials) (seconds) Plain-text

Load more