{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,3]],"date-time":"2026-05-03T11:00:22Z","timestamp":1777806022175,"version":"3.51.4"},"reference-count":42,"publisher":"SAGE Publications","issue":"3","license":[{"start":{"date-parts":[[2017,4,27]],"date-time":"2017-04-27T00:00:00Z","timestamp":1493251200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/journals.sagepub.com\/page\/policies\/text-and-data-mining-license"}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["Journal of Computer Security"],"published-print":{"date-parts":[[2017,5,29]]},"abstract":"<jats:p>Existing CAPTCHA solutions are a major source of user frustration on the Internet today, frequently forcing companies to lose customers and business. Game CAPTCHAs are a promising approach which may make CAPTCHA solving a fun activity for the user. One category of such CAPTCHAs\u00a0\u2013 called Dynamic Cognitive Game (DCG) CAPTCHA\u00a0\u2013 challenges the user to perform a game-like cognitive (or recognition) task interacting with a series of dynamic images. Specifically, it takes the form of many objects floating around within the images, and the user\u2019s task is to match the objects corresponding to specific target(s), and drag\/drop them to the target region(s).<\/jats:p>\n                  <jats:p>In this paper, we pursue a comprehensive analysis of DCG CAPTCHAs. We design and implement such CAPTCHAs, and dissect them across four broad but overlapping dimensions: (1) usability, (2) fully automated attacks, (3) human-solving relay attacks, and (4) hybrid attacks that combine the strengths of automated and relay attacks. Our study shows that DCG CAPTCHAs are highly usable, even on mobile devices and offer some resilience to relay attacks, but they are vulnerable to our proposed automated and hybrid attacks.<\/jats:p>","DOI":"10.3233\/jcs-16847","type":"journal-article","created":{"date-parts":[[2017,4,28]],"date-time":"2017-04-28T12:13:15Z","timestamp":1493381595000},"page":"205-230","update-policy":"https:\/\/doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":8,"title":["On the security and usability of dynamic cognitive game CAPTCHAs"],"prefix":"10.1177","volume":"25","author":[{"given":"Manar","family":"Mohamed","sequence":"first","affiliation":[{"name":"Department of Computer and Information Sciences, Temple University, Philadelphia, PA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Song","family":"Gao","sequence":"additional","affiliation":[{"name":"Google, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Niharika","family":"Sachdeva","sequence":"additional","affiliation":[{"name":"IIIT-Delhi, India"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Nitesh","family":"Saxena","sequence":"additional","affiliation":[{"name":"Department of Computer and Information Sciences, University of Alabama at Birmingham, Birmingham, AL, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Chengcui","family":"Zhang","sequence":"additional","affiliation":[{"name":"Department of Computer and Information Sciences, University of Alabama at Birmingham, Birmingham, AL, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ponnurangam","family":"Kumaraguru","sequence":"additional","affiliation":[{"name":"IIIT-Delhi, India"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Paul C.","family":"Van Oorschot","sequence":"additional","affiliation":[{"name":"School of Computer Science, Carleton University, Ottawa, ON, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","published-online":{"date-parts":[[2017,4,27]]},"reference":[{"key":"ref001","doi-asserted-by":"crossref","unstructured":"L.V.\u00a0Ahn, M.\u00a0Blum, N.J.\u00a0Hopper and J.\u00a0Langford, CAPTCHA: Using hard AI problems for security, in: EUROCRYPT, 2003.","DOI":"10.1007\/3-540-39200-9_18"},{"key":"ref002","unstructured":"Are you a human, http:\/\/areyouahuman.com\/."},{"key":"ref003","unstructured":"H.S.\u00a0Baird and J.L.\u00a0Bentley, Implicit captchas, in: Electronic Imaging, 2005."},{"key":"ref004","doi-asserted-by":"crossref","unstructured":"A.\u00a0Basso and F.\u00a0Bergadano, Anti-bot strategies based on human interactive proofs, in: Handbook of Information and Communication Security 2010, pp.\u00a0273\u2013291.","DOI":"10.1007\/978-3-642-04117-4_15"},{"key":"ref005","unstructured":"J.\u00a0Brooke, SUS-a quick and dirty usability scale, in: Usability Evaluation in Industry, 1996, pp.\u00a0189\u2013194."},{"key":"ref006","doi-asserted-by":"crossref","unstructured":"E.\u00a0Bursztein, S.\u00a0Bethard, C.\u00a0Fabry, J.\u00a0Mitchell and D.\u00a0Jurafsky, How good are humans at solving CAPTCHAs? A large scale evaluation, in: IEEE Symposium on Security and Privacy, 2010.","DOI":"10.1109\/SP.2010.31"},{"key":"ref007","doi-asserted-by":"crossref","unstructured":"C.C.\u00a0Chang and C.J.\u00a0Lin, LIBSVM: A library for support vector machines, ACM Transactions on Intelligent Systems and Technology 2(3) (2011).","DOI":"10.1145\/1961189.1961199"},{"key":"ref008","doi-asserted-by":"crossref","unstructured":"K.\u00a0Chellapilla, K.\u00a0Larson, P.\u00a0Simard and M.\u00a0Czerwinski, Designing human friendly human interaction proofs (HIPs), in: ACM CHI, 2005.","DOI":"10.1145\/1054972.1055070"},{"key":"ref009","doi-asserted-by":"crossref","unstructured":"S.\u00a0Chen, M.\u00a0Shyu, C.\u00a0Zhang and R.L.\u00a0Kashyap, Identifying overlapped objects for video indexing and modeling in multimedia database systems, International Journal on Artificial Intelligence Tools (2001).","DOI":"10.1142\/S0218213001000738"},{"key":"ref010","unstructured":"M.\u00a0Chew and H.S.\u00a0Baird, Baffletext: A human interactive proof, in: Electronic Imaging, 2003."},{"key":"ref011","unstructured":"Cracking the AreYouAHuman Captcha, http:\/\/spamtech.co.uk\/software\/bots\/cracking-the-areyouhuman-captcha\/."},{"key":"ref012","unstructured":"D.\u00a0Danchev, Inside India\u2019s CAPTCHA solving economy, available at: http:\/\/blogs.zdnet.com\/security\/?p=1835."},{"key":"ref013","unstructured":"C.\u00a0Doctorow, Solving and creating CAPTCHAs with free porn, in:\n                      Boing Boing\n                      , 2004, available at: http:\/\/www.boingboing.net\/2004\/01\/27\/solving_and_creating.html."},{"key":"ref014","doi-asserted-by":"crossref","unstructured":"M.\u00a0Egele, L.\u00a0Bilge, E.\u00a0Kirda and C.\u00a0Kruegel, CAPTCHA smuggling: Hijacking web browsing sessions to create CAPTCHA farms, in: ACM Symposium on Applied Computing, 2010.","DOI":"10.1145\/1774088.1774483"},{"key":"ref015","unstructured":"J.\u00a0Elson, J.R.\u00a0Douceur, J.\u00a0Howell and J.\u00a0Saul, Asirra: A CAPTCHA that exploits interest-aligned manual image categorization, in: ACM CCS, 2007."},{"key":"ref016","doi-asserted-by":"crossref","unstructured":"J.H.\u00a0Friedman, J.L.\u00a0Bentley and R.A.\u00a0Finkel, An algorithm for finding best matches in logarithmic expected time, ACM Transactions on Mathematical Software (TOMS) 3(3) (1977).","DOI":"10.1145\/355744.355745"},{"key":"ref017","doi-asserted-by":"crossref","unstructured":"S.\u00a0Gao, M.\u00a0Mohamed, N.\u00a0Saxena and C.\u00a0Zhang, Gaming the game: Defeating a game CAPTCHA with efficient and robust hybrid attacks, in: IEEE International Conference on Multimedia and Expo (ICME), IEEE, 2014.","DOI":"10.1109\/ICME.2014.6890287"},{"key":"ref018","doi-asserted-by":"crossref","unstructured":"C.\u00a0Gentry, Z.\u00a0Ramzan and S.\u00a0Stubblebine, Secure distributed human computation, in: ACM Conference on Electronic Commerce, EUROCRYPT, 2005.","DOI":"10.1145\/1064009.1064026"},{"key":"ref019","unstructured":"J.N.\u00a0Gross, CAPTCHA using challenges optimized for distinguishing between humans and machines, 2009, US Patent App. 12\/484,800."},{"key":"ref020","doi-asserted-by":"crossref","unstructured":"J.M.G.\u00a0Hidalgo and G.\u00a0Alvarez, CAPTCHAs: An artificial intelligence application to web security, Advances in Computers 83 (2011).","DOI":"10.1016\/B978-0-12-385510-7.00003-5"},{"key":"ref021","unstructured":"G.\u00a0Keizer, Spammers\u2019 bot cracks Microsoft\u2019s CAPTCHA, in: Computer World, 2008, available at: http:\/\/www.computerworld.com\/s\/article\/9061558\/Spammers_bot_cracks_Microsoft_s_CAPTCHA_."},{"key":"ref022","unstructured":"K.\u00a0Kluever, Breaking the PayPal.com CAPTCHA, 2008, available at: http:\/\/www.kloover.com\/2008\/05\/12\/breaking-the-paypalcom-captcha\/."},{"key":"ref023","doi-asserted-by":"crossref","unstructured":"K.A.\u00a0Kluever and R.\u00a0Zanibbi, Balancing usability and security in a video CAPTCHA, in: Symposium on Usable Privacy and Security, 2009.","DOI":"10.1145\/1572532.1572551"},{"key":"ref024","doi-asserted-by":"crossref","unstructured":"J.\u00a0Lewis and J.\u00a0Sauro, The factor structure of the system usability scale, in: Human Computer Interaction International Conference (HCII), 2009.","DOI":"10.1007\/978-3-642-02806-9_12"},{"key":"ref025","doi-asserted-by":"crossref","unstructured":"M.\u00a0Mohamed, S.\u00a0Gao, N.\u00a0Saxena and C.\u00a0Zhang, Dynamic cognitive game CAPTCHA usability and detection of streaming-based farming, in:\n                      The Workshop on Usable Security (USEC), co-located with NDSS\n                      , 2014.","DOI":"10.14722\/usec.2014.23021"},{"key":"ref026","doi-asserted-by":"crossref","unstructured":"M.\u00a0Mohamed, N.\u00a0Sachdeva, M.\u00a0Georgescu, S.\u00a0Gao, N.\u00a0Saxena, C.\u00a0Zhang, P.\u00a0Kumaraguru, P.C.\u00a0van Oorschot and W.B.\u00a0Chen, A three-way investigation of a game-CAPTCHA: Automated attacks, relay attacks and usability, in: ACM Symposium on Information, Computer and Communications Security, ACM, 2014.","DOI":"10.1145\/2590296.2590298"},{"key":"ref027","unstructured":"M.\u00a0Motoyama, K.\u00a0Levchenko, C.\u00a0Kanich, D.\u00a0McCoy, G.M.\u00a0Voelker and S.\u00a0Savage, Re: CAPTCHAs-understanding CAPTCHA-solving services in an economic context, in: USENIX Security, 2010, pp.\u00a0435\u2013462."},{"key":"ref028","unstructured":"S.\u00a0Prasad, Google\u2019s CAPTCHA busted in recent spammer tactics, 2008, available at: http:\/\/securitylabs.websense.com\/content\/Blogs\/2919.aspx."},{"key":"ref029","unstructured":"G.\u00a0Reynaga, The usability of Captchas on mobile devices, PhD thesis, Carleton University Ottawa, 2015."},{"key":"ref030","unstructured":"A.\u00a0Rusu and V.\u00a0Govindaraju, Handwritten CAPTCHA: Using the difference in the abilities of humans and machines in reading handwritten words, in: Frontiers in Handwriting Recognition, 2004."},{"key":"ref031","unstructured":"G.\u00a0Sauer, H.\u00a0Hochheiser, J.\u00a0Feng and J.\u00a0Lazar, Towards a universally usable CAPTCHA, in: SOUPS, 2008."},{"key":"ref032","doi-asserted-by":"crossref","unstructured":"M.\u00a0Shirali-Shahreza and S.\u00a0Shirali-Shahreza, Collage captcha, in: Signal Processing and Its Applications, 2007.","DOI":"10.1109\/WIAMIS.2007.63"},{"key":"ref033","doi-asserted-by":"crossref","unstructured":"D.\u00a0Stefan and D.\u00a0Yao, Keystroke-dynamics authentication against synthetic forgeries, in: CollaborateCom, 2010.","DOI":"10.4108\/icst.collaboratecom.2010.16"},{"key":"ref034","doi-asserted-by":"crossref","unstructured":"M.J.\u00a0Swain and D.H.\u00a0Ballard, Indexing via color histograms, in: Active Perception and Robot Vision, 1992.","DOI":"10.1007\/978-3-642-77225-2_13"},{"key":"ref035","unstructured":"SWF encrypt: Encrypt, obfuscate & protect your flash SWF ActionScript & resources from decompilers. http:\/\/www.amayeta.com\/software\/swfencrypt\/."},{"key":"ref036","doi-asserted-by":"crossref","unstructured":"L.\u00a0Von Ahn and L.\u00a0Dabbish, Labeling images with a computer game, in: SIGCHI Conference on Human Factors in Computing Systems, 2004.","DOI":"10.1145\/985692.985733"},{"key":"ref037","doi-asserted-by":"crossref","unstructured":"L.\u00a0Von Ahn, B.\u00a0Maurer, C.\u00a0McMillen, D.\u00a0Abraham and M.\u00a0Blum, reCAPTCHA: Human-based character recognition via web security measures, Science 321(5895) (2008).","DOI":"10.1126\/science.1160379"},{"key":"ref038","unstructured":"Y.\u00a0Xu, G.\u00a0Reynaga, S.\u00a0Chiasson, J.M.\u00a0Frahm, F.\u00a0Monrose and P.C.\u00a0van Oorschot, Security and usability challenges of moving-object CAPTCHAs: Decoding codewords in motion, in: USENIX Security, 2012."},{"key":"ref039","doi-asserted-by":"crossref","unstructured":"J.\u00a0Yan and A.S.\u00a0El Ahmad, Usability of CAPTCHAs or usability issues in CAPTCHA design, in: SOUPS, 2008.","DOI":"10.1145\/1408664.1408671"},{"key":"ref040","doi-asserted-by":"crossref","unstructured":"J.\u00a0Yan and A.S.\u00a0El Ahmad, A low-cost attack on a Microsoft CAPTCHA, in: ACM Conference on Computer and Communications Security, 2008.","DOI":"10.1145\/1455770.1455839"},{"key":"ref041","doi-asserted-by":"crossref","unstructured":"C.\u00a0Zhang, W.B.\u00a0Chen, X.\u00a0Chen, R.\u00a0Tiwari, L.\u00a0Yang and G.\u00a0Warner, A multimodal data mining framework for revealing common sources of spam images, Journal of Multimedia (2009).","DOI":"10.4304\/jmm.4.5.313-320"},{"key":"ref042","doi-asserted-by":"crossref","unstructured":"B.B.\u00a0Zhu, J.\u00a0Yan, Q.\u00a0Li, C.\u00a0Yang, J.\u00a0Liu, N.\u00a0Xu, M.\u00a0Yi and K.\u00a0Cai, Attacks and design of image recognition CAPTCHAs, in: ACM CCS, 2010.","DOI":"10.1145\/1866307.1866329"}],"container-title":["Journal of Computer Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.3233\/JCS-16847","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/full-xml\/10.3233\/JCS-16847","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.3233\/JCS-16847","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T20:45:03Z","timestamp":1777495503000},"score":1,"resource":{"primary":{"URL":"https:\/\/journals.sagepub.com\/doi\/10.3233\/JCS-16847"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,4,27]]},"references-count":42,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2017,5,29]]}},"alternative-id":["10.3233\/JCS-16847"],"URL":"https:\/\/doi.org\/10.3233\/jcs-16847","relation":{},"ISSN":["0926-227X","1875-8924"],"issn-type":[{"value":"0926-227X","type":"print"},{"value":"1875-8924","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,4,27]]}}}