Breaking a 3D-based CAPTCHA scheme

Abstract

CAPTCHA is a standard defence mechanism against bots, or automated programs, that attempt to use web-based services meant for human users. While there are many different types of CAPTCHA schemes that have emerged over the years, to date, the most widely used type is 2D text-based CAPTCHAs. Unfortunately, a large number of 2D CAPTCHA schemes have been successfully broken. Thus, 3D-based CAPTCHAs are seen as an alternative paradigm which has been explored by a number of CAPTCHA designers. 3D CAPTCHAs are meant to overcome the limitations of 2D CAPTCHAs and are supposed to be more robust and secure against automated attacks. To investigate the robustness of 3D text-based CAPTCHAs, this paper presents an approach to breaking a representative 3D CAPTCHA scheme called Teabag 3D. In particular, this paper describes the techniques that were used to break this CAPTCHA, and as such highlights various security issues that have to be considered in order to design better 3D CAPTCHA schemes. © 2012 Springer-Verlag.