Narges Roshanbin
Total Page:16
File Type:pdf, Size:1020Kb
Interweaving Unicode, Color, and Human Interactions to Enhance CAPTCHA Security by Narges Roshanbin A thesis submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Software Engineering and Intelligent Systems Department of Electrical and Computer Engineering University of Alberta © Narges Roshanbin, 2014 Abstract Web security has become a critical issue due to the rising reliance of people on diverse types of online transactions. A CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a security mechanism that is widely used to maintain the security of web services by preventing malicious programs from accessing these resources automatically. Despite the existence of several types of CAPTCHAs, many of them have been compromised due to their inherent vulnerabilities and the development of strong artificial intelligence and image recognition algorithms. The vulnerabilities of existing CAPTCHAs coupled with the trend of heavier dependence on the Internet calls for the development of a new generation of CAPTCHAs that are substantially more complex for machines, and yet easy to understand and solve by human users. In this thesis, we propose, implement and test a new CAPTCHA, which shows resistance against various forms of segmentation and recognition attacks. The multi-layered security approach employed in this CAPTCHA mainly comes from its use of Unicode as an input space, a virtual keyboard as the input device, the use of homoglyphs, the correlated usage of color in the foreground and background, and solution submission through intelligent human interaction. Furthermore, several forms of randomization are employed within different elements of the CAPTCHA which minimize the formation of detectable patterns that can be exploited by machines and make the attacks computationally complex for attackers. Our analyses provide evidence for substantial resistance of the proposed CAPTCHA against major attack types. Our CAPTCHA’s game-like solution procedure is enjoyable and intuitive for human users despite its relatively longer solution time compared to existing CAPTCHAs which comes as the ii price for the higher level of security it affords. Our user studies indicate that the CAPTCHA’s solving accuracy is comparable to major CAPTCHAs in use today. The complexity of this CAPTCHA can be further modified based on the security requirements of the resource being protected. Additional security- and usability-enhancing modifications are proposed and tested, which can further improve the CAPTCHA’s security or usability as needed. iii Preface This research project received research ethics approval from the University of Alberta Research Ethics Board, Project Name “An investigation to improve CAPTCHAs used for distinguishing humans from machines on the Internet”, ID. Pro00028168, Feb. 2012. Chapter 1 of this dissertation has been published as N. Roshanbin and J. Miller, “A survey and analysis of current CAPTCHA approaches,” J. Web Engineering, vol. 12, no. 1, pp. 1-40, 2013. Sections 2.5 and 2.6 have been published as N. Roshanbin and J. Miller, “Finding Homoglyphs - A Step towards Detecting Unicode-Based Visual Spoofing Attacks,” in Web Information System Engineering - WISE, 2011, pp. 1-14. The majority of Chapter 2 is derived from an article submitted for publication as N. Roshanbin and J. Miller, “ADAMAS: Interweaving Unicode and Color to Enhance CAPTCHA Security,” J. Future Generation Computer Systems. Chapter 3 and the appendix of this thesis have been submitted for publication as N. Roshanbin and J. Miller, “Enhancing CAPTCHA security using interactivity, dynamism, and mouse movement patterns,” International Journal of Information Security. An article has been submitted for publication which uses material from Chapter 5 (N. Roshanbin and J. Miller, “A comparative study of the performance of local feature-based pattern recognition algorithms,” J. Pattern Recognition). iv Dedication This dissertation is dedicated to my family without whom I would not be here: To my husband, Moein, who has been a source of love, encouragement and inspiration to me. Thank you for all the joy you have brought to my life and for patiently bearing with me during the completion of this work and encouraging me in challenging situations. To my parents, Fatemeh and Mehdi, for their unconditional love and support throughout my life, for teaching me the value of hard work, and for instilling in me the will to pursue my dreams. Thank you for your gifts of life and love. To my sisters, Asieh and Razieh, whose love, sincerity, intimacy and empathy have always been a source of peace and happiness for me. v Acknowledgements I would like to express my sincere gratitude to Professor James Miller, for his continuous support and guidance during my years in the PhD program and throughout the completion of this dissertation. Having professor Miller as my supervisor has been a true blessing. I would also like to thank my committee members Dr. Bruce Cockburn, Dr. John Aycock, Dr. Eleni Stroulia and Dr. John Salmon for their thoughtful and constructive comments and feedback. In addition, I am thankful to the institutions that granted me scholarships and financial assistance during this research: Alberta Innovates – Technology Futures for iCORE scholarship and University of Alberta for Queen Elizabeth II scholarship. vi Contents INTRODUCTION ....................................................................................................................................... 1 CHAPTER 1 AN OVERVIEW OF EXISTING CAPTCHA SYSTEMS .......................................... 6 1.1 INTRODUCTION ................................................................................................................................................. 6 1.2 CURRENT CAPTCHAS ....................................................................................................................................... 7 1.2.1 Text-based CAPTCHAs .............................................................................................................................. 9 1.2.2 Image-based CAPTCHAs ......................................................................................................................... 17 1.2.3 Audio-based CAPTCHAs ......................................................................................................................... 22 1.2.4 Motion-based CAPTCHAs ....................................................................................................................... 23 1.2.5 Hybrid CAPTCHAs ................................................................................................................................... 24 1.3 BREAKING CAPTCHAS .................................................................................................................................... 27 1.3.1 Algorithmic approaches to break CAPTCHAs ......................................................................................... 27 1.3.2 Random guessing attacks ...................................................................................................................... 41 1.3.3 Using social engineering to break CAPTCHAs ........................................................................................ 41 1.4 ROBUSTNESS OF CAPTCHAS ............................................................................................................................ 42 1.4.1 Segmentation resistance........................................................................................................................ 43 1.4.2 Recognition resistance ........................................................................................................................... 46 1.4.3 Random guessing resistance .................................................................................................................. 47 1.4.4 Security against third party human solver attacks ................................................................................ 48 1.4.5 Other security measures ........................................................................................................................ 48 1.5 USABILITY OF CAPTCHAS ................................................................................................................................ 49 1.5.1 Distortion ............................................................................................................................................... 49 1.5.2 Content .................................................................................................................................................. 50 1.5.3 Presentation ........................................................................................................................................... 51 1.6 CONCLUSION .................................................................................................................................................. 52 CHAPTER 2 THE PROPOSED CAPTCHA ..................................................................................... 58 2.1 INTRODUCTION ............................................................................................................................................... 58 2.2 INTERACTIVE CAPTCHAS ................................................................................................................................. 60 2.3 OVERVIEW OF OUR APPROACH ..........................................................................................................................