Captcha smuggling: Hijacking web browsing sessions to create captcha farms

CAPTCHAs protect online resources and services from automated access. From an attacker’s point of view, they are typically per-ceived as an annoyance that prevents the mass creation of accounts or the automated posting of messages. Hence, miscreants strive to effectively bypass these protection mechanisms, using techniques such as optical character recognition or machine learning. How-ever, as CAPTCHA systems evolve, they become more resilient against automated analysis approaches. In this paper, we introduce and evaluate an attack that we de-note as CAPTCHA smuggling. To perform CAPTCHA smuggling, the attacker slips CAPTCHA challenges into the web browsing ses-sions of unsuspecting victims, misusing their ability to solve these challenges. A key point of our attack is that the CAPTCHAs are surreptitiously injected into interactions with benign web applica-tions (such as web mail or social networking sites). As a result, they are perceived as a normal part of the application and raise no sus-picion. Our evaluation, based on realistic user experiments, shows that CAPTCHA smuggling attacks are feasible in practice. Categories and Subject Descriptor