Jonathon Knight's Blog

11th March

jonathonknight — Thu, 11 Mar 2010 03:24:43 +0000

The whole process is going really well at the moment, ive created some extra parts to the system I didn’t think I was going to do. ive made the system a full log in system now. The only major function that I need to finish off is the actual connecting of the CAPTCHA to the registration form. It has been causing me a bit of a problem but I am sooo close to getting it working. The problem I was having with it was using sessions and cookies in order to get the variables for if the captcha had been passed or not. The problem was that I was getting the variables from the sessions and cookies in the php each time a page loaded. This caused a problem because there was no chance in updating the variable after the first load. A way round this is to get the captcha to be presented to the user first and then redirecting them to the registration page after and have the registration receive the new session variables then. This could cause a security risk as it would allow bots/users to try and go straight to ur registration page without filling out the captcha. To prevent this I have implemented javascript that checks to see if the session variable is true and if it is, that means they have done the captcha and they can register. This session will be deleted once the user has gone through the registration page and has proceeded to send the form from the registration page to the php page that sends the variables to a database.

10th March

jonathonknight — Wed, 10 Mar 2010 11:36:55 +0000

Fixed the problem I was having for sending variables to PHP and also have got the Javascript to detect Flash for the user and have got this to pick between both of the CAPTCHAs.

Jobs left to do are

Implement and finish the text based CAPTCHA

Get both CAPTCHA’s working using with the form using IF statements and the “die” function if the CAPTCHA has not been completed

Refresh button

Change CAPTCHA button

Also finish off the different draggable CAPTCHA models

Think thats it for the major stuff

Also maybe creating Audio CAPTCHA, not totally sure about this yet I am going to have to look into details for this

All the major parts that I need to build now shouldn’t be too hard or take too long to do as I pretty much know what I am doing for them. One problem that I think might occur will be a way of having both CAPTCHA’s working in one page, meaning that once one of the CAPTCHA’s has been completed the user can progress to submitting the form without getting a message about the user not filling out the other CAPTCHA.

More decisions about text based CAPTCHA. Ive started creating the text based CAPTCHA but think im gonna go back and change the way that I am making it. I started by making some images stored to file but I think Im gonna change this. I am thinking that I will go about creating the CATPCHA pictures completly random and within the script. Meaning that the script will create a new image each time the CAPTCHA is run.

9th March

jonathonknight — Tue, 09 Mar 2010 16:35:10 +0000

Another Problem has been encountered today

This problem was encountered by me trying to code Javascript in order to choose between the text and flash CAPTCHA. This was because the problems I had with sending variables from javascript to flash which is seemisly impossible becauase of one being client and one being server. I tried several different ways for geting this to work but none of them seemed appropriate. I was trying to get the Javascript to send a variable to the PHP file dependant on whether the user had flash or not. The way I got round this seemed quite simple but just took some thinking about to get to it. This solution involved creating an iframe within the registration php file and within the iframe was a page running javascript and selected which of 2 pages to display to the user the flash or no flash version. I still havent gotten around to fixing that problem I had yesterday but will do that soon, this problem just seemed a lot more of a problem compared to the other one.

I have also planned out how im going to create the text based captcha and I think the way I will choose may allow me to also put in audio to go with it. I was thinking of having say a list of images with the text on them (distorted to a level that wouldn’t be allowed by code, distorted using a image tool) all custom made and checked through to make sure they are all easily readable. I will then put them all into a database and have the php pick one out at random and the text box that the user enters in what the image says will be compared to the actual id in the database. This may also allow me to create audio captchas by using pretty much the same method in doing so.

8th March

jonathonknight — Tue, 09 Mar 2010 01:01:52 +0000

Today I encountered my first problem, it wasn’t anything major but it will cause problems so I will need to fix this.
The sendvars function that I had been using to send the variables to PHP opens a new window once the Flash is intergrated. This causes major issues as the variables are being sent to a new window and new php file not the one that currently has the flash file within it. I have found another function to stop it opening a new window as apparently there is no way of stopping this from happening. The new function that I found is called SendandLoad which pretty much uses the same method but doesn’t require a new window being opened. I will be working on this to try and fix this problem ASAP.

Apart from this problem I encountered, I managed to pretty much implement the flash into the PHP so that a random Flash file is displayed each time the page is loaded. This allows for my variety of different flash CAPTCHA’s to be displayed each time the flash page is loaded. I also decided to make the flash file so that only certain options will be displayed when you right click on it. I wanted to do this so that it gets rid of the “play” and “pause” buttons so that no bot can mess around with these in order to try and break the CAPTCHA.

I will be working on fixing the SendVar problem tomorrow and will also be working on some other parts of the CAPTCHA and more on implementing it within the Registration system.

5th March

jonathonknight — Fri, 05 Mar 2010 16:38:30 +0000

Today I am looking into some ways to record the CAPTCHA time process for recording the data from various users.

I found a way that I can implement a script into PHP in order to record this. The way I found for doing this will record a certain part of the PHP code and anything within it. I was thinking of making it start as soon as the user clicks onto the CAPTCHA. There are various ways I could do this, I could have the Flash send the PHP a variable for when the user starts or I could just have the PHP code start when the user uses the CAPTCHA. Another way of recording comparison times could be that I record the whole of the process for registering including the CAPTCHA and compare these times. The problem with this is that after the user has filled out the first registration form they will know what to expect for the next one and will be able to type faster as they have read it already. Thus making it an unfair test. So I think I will stick with the recording time for the actual CAPTCHA to get used.

The PHP recording process involves using a function called $msec compared to mktime() as we want to record closer to a micro second rather than a second as this could actually make a difference for some of the CAPTCHA’s comparisons. Using this function will give me a lot more accurate time meaning a lot better results to compare even if its only by millerseconds.

4th March

jonathonknight — Thu, 04 Mar 2010 11:29:44 +0000

So far I have drawn up 5 different plans of the Draggable CAPTCHA which involve the objects being in different places and different scenarios. I will be working on actually making these into actual CAPTCHA’s and making sure they all work as expected.

I have been looking at the PHP for making a random CAPTCHA appear each time a page is loaded, there is various ways to do this. The best way I found for this was to put all of the various Flash CAPTCHA’s into a folder and write the PHP so it picks a random file each time. This will work by having the PHP file putting all of the Flash files that are into the folder into an array and then the PHP code will randomly pick a number in the array. The PHP will then display the corresponding Flash file that it is equal to in the array.

This may cause a problem as I am not sure if each of the Flash files will react the same compared to if there was just one flash file being called. Meaning that as they are being called diferently do the variables that are sent from the Flash to the php still work. The only way I can really find this out is trial and error. This could be fine but I may need to use an alternative method if I encounter a problem with it.

I have also been thinking of ways that I am going to calculate how to record the time of executions for my testing for different users. I have thought of various ways to implement this into my script whether it is in the PHP code or the Flash code, I will look into this more tomorrow.

March 3rd

jonathonknight — Wed, 03 Mar 2010 11:33:30 +0000

More research into the text based CAPTCHA I will be creating for users that don’t have Flash.

Here are some other considerations that I will have to overcome when building my text based CAPTCHA continued from yesterday.

Dictictionary based words

Dictionary words in CAPTCHA’s are not such a great idea this is because OCR can workout the majority of the letters and can compare them to a dictionary database in order to find out what the remaining characters are. This will occur a lot more depending if they are big or small words.

Use of a Known or Public Source of Puzzles

This can be bad in various ways, for an example having a CAPTCHA that is a sentance and the user has to put in the last word could be predicted by automated bots. There is software that can be used within a automated system in order to break these CAPTCHA’s e.g. Opencyc.

Success rates

Attackers will be happy with even 1 of every 100 CAPTCHA’s being broken as this can add up to a large amount of CAPTCHA’s being broken for example if the attacker was using a botnet to break the CAPTCHA’s. This means that the attacker won’t have to rebuild a set of solutions to break a lot more then the minimum rate. In the article Jonathan talks about a 10,000 machine botnet which can process 10 threads per machine at a 0.01% success rate which will be able to have 10 successes every second and will provide the attacker with 864,000 broken CAPTCHA’s in a day to use at their desire.

Accessible CAPTCHA

Accessible CAPTCHA’s are basically other ways that vision impaired users can use CAPTCHA’s and these are often audio CAPTCHA’s. These wont always work as some people have multiple impairments and they are a lot easier to break because speech recognition used to breach CAPTCHA is easier then image segmentation.

Randomness

This is the last technique that is used to stop attackers breaching CAPTCHA’s. Randomness needs to be taken to thought as some random functions are a lot weaker than others like the rand() function. It is important to make sure that a technique to make random numbers is something that will make sure they aren’t predictable.

March 2nd

jonathonknight — Tue, 02 Mar 2010 22:13:22 +0000

I will be looking at the type of distortion that I will be using for the PHP text based CAPTCHA.

I did some research on this topic before I am just going to go into a bit more detail on it. I found an article called “Strong CAPTCHA Guidelines v1.2″ by Jonathan Wilkins, in this article Jonathan talks about various distortion techniques and talks about which ones are best to use and why.
Out of all the techniques there are various ones that are a lot better than others. I will be picking out the best ones that prevent OCR breaching.

Rotation and warping of individual characters

This technique provides the best security to stop CAPTCHA’s being breached by OCR, the best way to get this technique working would be to create each character and their decoy lines one at a time onto a transparent background and then warping them and copositing them to gain the best distortion results. This technique would involve the breacher having to segmentate the CAPTCHA first before they can go about inverting it in order to breach it.

Character Set

For each CAPTCHA the character set will have to be looked into, in order to make it as difficult as possible to prevent breaching by OCR. Various CAPTCHA’s that have been created before don’t always use the whole alphabet as they take out vowels for example to eliminate rude words that could sometimes appear and some others eliminate characters that could be confused with other characters or numbers like 0 (zero) and o. It is better to as mentioned in the article to include a written guideline which basically tells the user that the CAPTCHA is case sensitive for example. This however can make CAPTCHA’s easier to break by automated attackers as they can look at the guidelines through observation.

Here is the recommended character set from the article

’l’, ’1’, ’I’ These are too similar to one another
’W’, ’w’ It is easy to mistake with v or vv depending on warping and overlap
’O’, ’0’, ’Q’ Too similar, especially with noise
’g’, ’9’ Too similar, especially after displacement
’3’, ’8’ Too similar to B
’4’ Too similar to A
’5’ Too similar to S
’a’, ’Q’ Too distinctive in most fonts
’7’, ’J’, ’f ’, ’i’, ’j’, ’v’, ’t’, ’Y’, y’, ’v’ Confusing w/ overlap (Gets lost in M, V, etc)
’h’, ’p’ Warping can make h look like n and p look like o, especially with overlap
’L’ With rotation, can look like V
’r’ Confused with n in lots of cases
’d’, ’b’ Gets warped and easy to confuse with a, o
This still leaves a 1/656 billion chance for random guesses. Image selection challenges (eg. identify the
pictures that have a cow in them) are happy with 1/4096 for a 12 image puzzle.

Font selection

This also has to be taken into consideration as different fonts will have different effects on the OCR tools used to break the CAPTHCA. There are different flaws for different font types an example is the serifs (extra feature on the end of some characters) can cause the identification of a character to be better dertermined while some fonts that don’t feature serifs will be harder to read. For Capthcas this article recommened sans-serif fonts be used.

March 1st

jonathonknight — Mon, 01 Mar 2010 16:37:37 +0000

I started the PHP register system today, I will be using 2 different php files in order to do this. One will be used to show the register text boxes etc. which will then send data to another php file. The other PHP file will be connected to a MYSQL database and will send the data that the first PHP file recieves from the user. The CAPTCHA will be on the first PHP file and will need to be processed before any of the data can be submitted to the other PHP file and the MYSQL database. If the user trys to process the first PHP file without doing the CAPTCHA a message will be displayed to the user instructing them to fill out the CAPTCHA. Im currently working on creating a form in the first PHP file that will be used to submit all the data at once, once the submit button is pushed.

After this is complete I will be implementing the captcha into the PHP script. I will then go about creating another CAPTCHA for people that don’t have FLASH. This will be built in PHP and will be part of the script, I will also have to implement some Javascript into the PHP. The Javascript will be able to tell if the user has Flash or not and if not it will load up the PHP based CAPTCHA for the user. There will also be a button to click on that will allow for the user to switch between the CAPTCHA versions which will be for anyone that is having trouble with Flash.

26th February

jonathonknight — Mon, 01 Mar 2010 03:55:00 +0000

Today I added another feature to the CAPTCHA.

Some bots use a method where they click all over the CAPTCHA in order to try and break it. I thought of a way to prevent this by making the CAPTCHA have a feature where if it gets clicked on 5 times it will stop the user going to the next phase. I used the number 5 as people won’t be clicking on the CAPTCHA 5 times where as a bot will. When it gets to 5 the CAPTCHA will display the user with a message and the user will have a button where they can retry the CAPTCHA. I did this by making the background a clickable button and having the on press setting change the keyframe when it gets to 5. I also had to find a way to change the cursor to the default icon as it changed the icon to the hand which didn’t seem applicable. I also setup a variable being sent to the PHP just like the other 2 I set up in the IF statements. This is so that the PHP knows not to let the user progress or this could be used so that a message is displayed to the user.

Next week I will do some more to the draggable CAPTCHA and then I will start creating the text based CAPTCHA which will be the alternate to the draggable CAPTCHA for people that don’t have flash player. This will be done by using Javascript to tell if the user has flash or not. I will also start to write a PHP registration website where users can register there name and password wwhich will then get stored into a MYSQL database and which will prove to be the perfect simulation for where the CAPTCHA can be tested.