Tick Tock Break the Clock: Breaking CAPTCHAs on the Darkweb

David Audran; Marcus Andersen; Mark Hansen; Mikkel Andersen; Thomas Frederiksen; Kasper Hansen; Dimitrios Georgoulias; Emmanouil Vasilomanolakis

doi:10.5220/0011273300003283

Tick Tock Break the Clock: Breaking CAPTCHAs on the Darkweb

David Audran, Marcus Andersen, Mark Hansen, Mikkel Andersen, Thomas Frederiksen, Kasper Hansen, Dimitrios Georgoulias, Emmanouil Vasilomanolakis

Research output: Contribution to book/anthology/report/conference proceeding › Article in proceeding › Research › peer-review

1 Citation (Scopus)

46 Downloads (Pure)

Abstract

Nowadays, almost all major websites employ CAPTCHAs. This prevents website scraping, fake account creation as well as DDoS or bruteforce attacks. For anonymity reasons, mainstream CAPTCHAs such as Google’s reCAPTCHA cannot be used on the darkweb. Due to the evolution of machine learning and computer vision, the CAPTCHA challenges used there, such as the clock CAPTCHA, are usually more arduous than those found on the clearweb. This paper presents an automated system that uses machine learning to break clock CAPTCHA challenges with a high success rate. We evaluate our system in a real world setting against 725 clock challenges from live darkweb marketplaces. Our results show an accuracy of 96.83% while maintaining low time requirements while analyzing, predicting and submitting the CAPTCHA solution.

Original language	English
Title of host publication	Proceedings of the 19th International Conference on Security and Cryptography
Editors	Sabrina De Capitani di Vimercati , Pierangela Samarati
Volume	1
Publisher	SCITEPRESS Digital Library
Publication date	2022
Pages	357-365
ISBN (Electronic)	978-989-758-590-6
DOIs	https://doi.org/10.5220/0011273300003283
Publication status	Published - 2022
Event	19th International Conference on Security and Cryptography (SECRYPT 2022) - Lisbon, Portugal Duration: 11 Jul 2022 → 13 Jul 2022 Conference number: 19 https://secrypt.scitevents.org/

Conference

Conference	19th International Conference on Security and Cryptography (SECRYPT 2022)
Number	19
Country/Territory	Portugal
City	Lisbon
Period	11/07/2022 → 13/07/2022
Internet address	https://secrypt.scitevents.org/

Series	International Conference on Security and Cryptography - SECRYPT - Proceedings
ISSN	2184-7711

Access to Document

10.5220/0011273300003283Licence: CC BY-NC-ND 4.0

Open Access articleFinal published version, 604 KBLicence: CC BY-NC-ND 4.0

AUB Link

Search for the material in Aalborg University Library's search engine

Cite this

Audran, D., Andersen, M., Hansen, M., Andersen, M., Frederiksen, T., Hansen, K., Georgoulias, D., & Vasilomanolakis, E. (2022). Tick Tock Break the Clock: Breaking CAPTCHAs on the Darkweb. In S. De Capitani di Vimercati , & P. Samarati (Eds.), Proceedings of the 19th International Conference on Security and Cryptography (Vol. 1, pp. 357-365). SCITEPRESS Digital Library. https://doi.org/10.5220/0011273300003283

Audran, David ; Andersen, Marcus ; Hansen, Mark et al. / Tick Tock Break the Clock: Breaking CAPTCHAs on the Darkweb. Proceedings of the 19th International Conference on Security and Cryptography. editor / Sabrina De Capitani di Vimercati ; Pierangela Samarati. Vol. 1 SCITEPRESS Digital Library, 2022. pp. 357-365 (International Conference on Security and Cryptography - SECRYPT - Proceedings).

@inproceedings{798960d0216b4f99ac334ae5fdc78f42,

title = "Tick Tock Break the Clock: Breaking CAPTCHAs on the Darkweb",

abstract = "Nowadays, almost all major websites employ CAPTCHAs. This prevents website scraping, fake account creation as well as DDoS or bruteforce attacks. For anonymity reasons, mainstream CAPTCHAs such as Google{\textquoteright}s reCAPTCHA cannot be used on the darkweb. Due to the evolution of machine learning and computer vision, the CAPTCHA challenges used there, such as the clock CAPTCHA, are usually more arduous than those found on the clearweb. This paper presents an automated system that uses machine learning to break clock CAPTCHA challenges with a high success rate. We evaluate our system in a real world setting against 725 clock challenges from live darkweb marketplaces. Our results show an accuracy of 96.83% while maintaining low time requirements while analyzing, predicting and submitting the CAPTCHA solution.",

author = "David Audran and Marcus Andersen and Mark Hansen and Mikkel Andersen and Thomas Frederiksen and Kasper Hansen and Dimitrios Georgoulias and Emmanouil Vasilomanolakis",

year = "2022",

doi = "10.5220/0011273300003283",

language = "English",

volume = "1",

series = "International Conference on Security and Cryptography - SECRYPT - Proceedings",

publisher = "SCITEPRESS Digital Library",

pages = "357--365",

editor = "{De Capitani di Vimercati }, Sabrina and Pierangela Samarati",

booktitle = "Proceedings of the 19th International Conference on Security and Cryptography",

note = "19th International Conference on Security and Cryptography (SECRYPT 2022), SECRYPT ; Conference date: 11-07-2022 Through 13-07-2022",

url = "https://secrypt.scitevents.org/",

}

Audran, D, Andersen, M, Hansen, M, Andersen, M, Frederiksen, T, Hansen, K, Georgoulias, D & Vasilomanolakis, E 2022, Tick Tock Break the Clock: Breaking CAPTCHAs on the Darkweb. in S De Capitani di Vimercati & P Samarati (eds), Proceedings of the 19th International Conference on Security and Cryptography. vol. 1, SCITEPRESS Digital Library, International Conference on Security and Cryptography - SECRYPT - Proceedings, pp. 357-365, 19th International Conference on Security and Cryptography (SECRYPT 2022), Lisbon, Portugal, 11/07/2022. https://doi.org/10.5220/0011273300003283

Tick Tock Break the Clock: Breaking CAPTCHAs on the Darkweb. / Audran, David; Andersen, Marcus; Hansen, Mark et al.
Proceedings of the 19th International Conference on Security and Cryptography. ed. / Sabrina De Capitani di Vimercati ; Pierangela Samarati. Vol. 1 SCITEPRESS Digital Library, 2022. p. 357-365 (International Conference on Security and Cryptography - SECRYPT - Proceedings).

Research output: Contribution to book/anthology/report/conference proceeding › Article in proceeding › Research › peer-review

TY - GEN

T1 - Tick Tock Break the Clock: Breaking CAPTCHAs on the Darkweb

AU - Audran, David

AU - Andersen, Marcus

AU - Hansen, Mark

AU - Andersen, Mikkel

AU - Frederiksen, Thomas

AU - Hansen, Kasper

AU - Georgoulias, Dimitrios

AU - Vasilomanolakis, Emmanouil

N1 - Conference code: 19

PY - 2022

Y1 - 2022

N2 - Nowadays, almost all major websites employ CAPTCHAs. This prevents website scraping, fake account creation as well as DDoS or bruteforce attacks. For anonymity reasons, mainstream CAPTCHAs such as Google’s reCAPTCHA cannot be used on the darkweb. Due to the evolution of machine learning and computer vision, the CAPTCHA challenges used there, such as the clock CAPTCHA, are usually more arduous than those found on the clearweb. This paper presents an automated system that uses machine learning to break clock CAPTCHA challenges with a high success rate. We evaluate our system in a real world setting against 725 clock challenges from live darkweb marketplaces. Our results show an accuracy of 96.83% while maintaining low time requirements while analyzing, predicting and submitting the CAPTCHA solution.

AB - Nowadays, almost all major websites employ CAPTCHAs. This prevents website scraping, fake account creation as well as DDoS or bruteforce attacks. For anonymity reasons, mainstream CAPTCHAs such as Google’s reCAPTCHA cannot be used on the darkweb. Due to the evolution of machine learning and computer vision, the CAPTCHA challenges used there, such as the clock CAPTCHA, are usually more arduous than those found on the clearweb. This paper presents an automated system that uses machine learning to break clock CAPTCHA challenges with a high success rate. We evaluate our system in a real world setting against 725 clock challenges from live darkweb marketplaces. Our results show an accuracy of 96.83% while maintaining low time requirements while analyzing, predicting and submitting the CAPTCHA solution.

U2 - 10.5220/0011273300003283

DO - 10.5220/0011273300003283

M3 - Article in proceeding

VL - 1

T3 - International Conference on Security and Cryptography - SECRYPT - Proceedings

SP - 357

EP - 365

BT - Proceedings of the 19th International Conference on Security and Cryptography

A2 - De Capitani di Vimercati , Sabrina

A2 - Samarati, Pierangela

PB - SCITEPRESS Digital Library

T2 - 19th International Conference on Security and Cryptography (SECRYPT 2022)

Y2 - 11 July 2022 through 13 July 2022

ER -

Audran D, Andersen M, Hansen M, Andersen M, Frederiksen T, Hansen K et al. Tick Tock Break the Clock: Breaking CAPTCHAs on the Darkweb. In De Capitani di Vimercati S, Samarati P, editors, Proceedings of the 19th International Conference on Security and Cryptography. Vol. 1. SCITEPRESS Digital Library. 2022. p. 357-365. (International Conference on Security and Cryptography - SECRYPT - Proceedings). doi: 10.5220/0011273300003283

Tick Tock Break the Clock: Breaking CAPTCHAs on the Darkweb

Abstract

Conference

Access to Document

AUB Link

Fingerprint

Cite this