Employing Response Time Constraints to Mitigate CAPTCHA Relay Attacks

Existing CAPTCHA systems are majorly single challenge-response systems that makes it easy for automated scripts such as bots and zombies to answer the test. A Multiple CAPTCHA Challenge-Response Systems (M-CRs) was introduced in [10] as a means of overcoming the inadequacies of the single challenge-response system. Unfortunately, attackers now use unsuspecting humans rather than automated script to solve CAPTCHAs at a price. This scenario, reffered to as CAPTCHA relay attack, has therefore emerged as a new challenge to authentication in online transactions. In this paper, we employ response time constraints as a measure to mitigate CAPTCHA relay attacks. The mechanism utilize time between responses as a way of differentiating humans from automated scripts. A genuine user is granted access to system resources when the CAPTCHAs are solved within specified time limits. Lack of response to solving multiple CAPTCHAs are taken as emanating from automated scripts. By so doing, attacker using relay tactics end up having incomplete solution for the challenge and thus a denial of service response to protected online resources