Breaking e-banking CAPTCHAs

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn , Issue , 2010, Pages 171-180

  Li, Shujun ^a   Shah, S Amier Haider ^b   Khan, M Asad Usman ^b   Khayam, Syed Ali ^b   Sadeghi, Ahmad Reza ^c   Schmitz, Roland ^d  

^a UNIVERSITY OF KONSTANZ   (Germany)

^b NATIONAL UNIVERSITY OF SCIENCES AND TECHNOLOGY   (Pakistan)

^c RUHR UNIVERSITY BOCHUM   (Germany)

^d STUTTGART MEDIA UNIVERSITY   (Germany)

Author keywords

CAPTCHA; e banking; electronic commerce; malware; man in the middle attack

Indexed keywords

ELECTRONIC COMMERCE; ELECTRONIC MAIL FILTERS; FINANCE; IMAGE PROCESSING; MALWARE; PATTERN RECOGNITION;

AUTOMATED ATTACKS; BREAKINGS; CAPTCHAS; E-BANKING; FINANCIAL INSTITUTION; FINANCIAL RISKS; IMAGES PROCESSING; MALWARES; MAN IN THE MIDDLE; MAN-IN-THE-MIDDLE ATTACK;

NETWORK SECURITY;

EID: 78751535325     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1920261.1920288     Document Type: Conference Paper

References (42)

1. American Bankers Association. Consumers prefer online banking. http://www.aba.com/Press+Room/092109ConsumerSurveyPBM.htm, 2009.
2. Bank Austria. mobileTAN information. http://www.bankaustria.at/de/19741. html, 2007.
3. Cronto Limited. Cronto's visual cryptogram. http://www.cronto.com/visual- cryptogram.htm, 2008.
4. Volksbank Rhein-Ruhr eG. Bankgeschäfte online abwickeln: Mit Sm@rtTAN optic bequem und sicher im Netz. http://www.voba-rhein-ruhr.de/ privatkunden/ebank/SMTop.html, 2009.
5. T. Weigold, T. Kramp, R. Hermann, F. Höring, P. Buhler, and M. Baentsch. The Zurich Trusted Information Channel - an efficient defence against man-in-the-middle and malicious software attacks. In TRUST'2008, pages 75-91.
6. G. A. F. Seber. Multivariate Observations. John Wiley & Sons, Inc., 2004.
7. M. Bertalmio, G. Sapiro, V. Caselles, and C. Ballester. Image inpainting. In SIGGRAPH'2000, pages 417-424.
8. M. M. Oliveira, B. Bowen, R. McKenna, and Y.-S. Chang. Fast digital image inpainting. In IASTED VII'2001, pages 261-266.
9. F. Y. Shin. Image Processing and Mathematical Morphology. CRC, 2009.
10. S. J. Orfanidis. Optimum Signal Processing. 2 edition, 2007. http://www.ece.rutgers.edu/~orfanidi/osp2e.
11. Z. Wang and E. P. Simoncelli. Translation insensitive image similarity in complex wavelet domain. In ICASSP'2005, pages 573-576.
12. L. von Ahn, M. Blum, N. J. Hopper, and J. Langford. CAPTCHA: Using hard AI problems for security. In EUROCRYPT'2003, pages 294-311.
13. J. Elson, J. R. Douceur, J. Howell, and J. Saul. Asirra: A CAPTCHA that exploits interest-aligned manual image categorization. In CCS'2007, pages 366-374.
14. A. Basso and F. Bergadano. Anti-bot strategies based on human interactive proofs. In Handbook of Information and Communication Security, chapter 15, pages 273-291. Springer, 2010.
15. G. Mori and J. Malik. Recognizing objects in adversarial clutter: Breaking a visual CAPTCHA. In CVPR'2003, pages 134-141.
16. G. Moy, N. Jones, C. Harkless, and R. Potter. Distortion estimation techniques in solving visual CAPTCHAs. In CVPR'2004, pages 23-28.
17. K. Chellapilla and P. Y. Simard. Using machine learning to break visual Human Interaction Proofs (HIPs). In NIPS'2004, pages 265-272, 2005.
18. S. Hocevar. PWNtcha: Pretend we're not a Turing computer but a human antagonist. http://caca.zoy.org/wiki/PWNtcha, 2004.
19. K. Chellapilla, K. Larson, P. Simard, and M. Czerwinski. Computers beat humans at single character recognition in reading based human interaction proofs (HIPs). In CEAS'2005.
20. J. Yan and A. S. El Ahmad. Breaking visual CAPTCHAs with naïve pattern recognition algorithms. In ACSAC'2007, pages 279-291.
21. J. Yan and A. S. El Ahmad. A low-cost attack on a Microsoft CAPTCHA. In CCS'2008, pages 543-554.
22. P. Golle. Machine learning attacks against the Asirra CAPTCHA. In CCS'2008, pages 535-542.
23. J. Tam, J. Simsa, S. Hyde, and L. von Ahn. Breaking audio CAPTCHAs. In NIPS'2008, pages 1625-1632, 2009.
24. E. Bursztein and S. Bethard. Decaptcha: Breaking 75% of eBay audio CAPTCHAs. In WOOT'2009.
25. C. J. Hernandez-Castro and A. Ribagorda. Pitfalls in CAPTCHA design and implementation: The Math CAPTCHA, a case study. Computers & Security, 29(1):141-157, 2010.
26. A. Hindle, M. W. Godfrey, and R. C. Holt. Reverse engineering CAPTCHAs. In WCRE'2009, pages 59-68.
27. C. J. Hernandez-Castro and A. Ribagorda. Remotely telling humans and computers apart: An unsolved problem. In iNetSec'2009.
28. B. Pinkas and T. Sander. Securing passwords against dictionary attacks. In CCS'2002, pages 161-170.
29. C. J. Mitchell. Using human interactive proofs to secure human-machine interactions via untrusted intermediaries. In Security Protocols'2006, pages 164-170, 2009.
30. I. Fischer and T. Herfet. Visual CAPTCHAs for document authentication. In MMSP'2006, pages 471-474.
31. M. Szydlowski, C. Kruegel, and E. Kirda. Secure input for Web applications. In ACSAC'2007, pages 375-384.
32. D. J. Steeves and M. W. Snyder. Secure online transactions using a CAPTCHA image as a watermark. US Patent 2007/0005500.
33. W. Wieser. Captcha recognition via averaging. http://www.triplespark.net/ misc/captcha, 2007.
34. R. C. Gonzalez and R. E. Woods. Digital Image Processing. Prentice Hall, 2008.
35. A. Criminisi, P. Pérez, and K. Toyama. Object removal by exemplar-based inpainting. In CVPR'2003, pages 721-728.
36. P. Getreuer. tvreg: Variational imaging methods for denoising, deconvolution, inpainting, and segmentation. http://www.math.ucla.edu/~getreuer/ tvreg.html, 2009.
37. D. H. Ballard. Generalizing the Hough transform to detect arbitrary shapes. Pattern Recognition, 13(2):111-122, 1981.
38. J. Wilkins. Strong CAPTCHA guidelines: v1.2. http://bitland.net/captcha. pdf, December 2009.
39. J. Yan and A. S. El Ahmad. Usability of CAPTCHAs or usability issues in CAPTCHA design. In SOUPS'2008, pages 44-52.
40. M. Motoyama, K. Levchenko, C. Kanich, D. McCoy, G. M. Voelker, and S. Savage. Re: CAPTCHAs - Understanding CAPTCHA-solving services in an economic context. In USENIX Security'2010.
41. BBC News. PC stripper helps spam to spread. http://news.bbc.co.uk/2/hi/ technology/7067962.stm, 2007.
42. M. Jakobsson. CAPTCHA-free throttling. In AISec'2009, pages 15-21.