An analysis of the strength of captcha used by some Turkish universities to protect student information

With increasing Internet usage worldwide, the need to protect websites from attackers is paramount. As so many people perform tasks such as shopping and banking, developers must pay close attention to the security of their sites. A significant vulnerability can exist during the client service registration process where users register for a free Internet service such as an email account. During enrollment, a few interlopers or aggressors may carry out malicious attacks by enlisting bots to create fake accounts and drain or waste site resources. Security analysts have created various systems to protect web assets from these bots. To differentiate a human user from a bot, CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a commonly employed strategy. This study focuses on the use of such a strategy in the field of web security to mitigate attacks. Different text, image, audio and video-based CAPTCHAs are investigated including those that are based on puzzles. This thesis sheds light on the type of CAPTCHA used by some Turkish universities to protect students' specific information pages. It is a mixture of two types of CAPTCHA: text and image. After examining this type of CAPTCHA, it is broken and recognised. This is achieved taking into consideration some weak points in its structure, which are discussed in the results section. The process of breaking and recognising is done via an add-on and a program in Java language. Then, by using OCR technique, the weakness of this CAPTCHA can be proven. In 53 CAPTCHA cases, 92.45% can be broken and recognised.