การวจยเชงคณภาพ เปนเครองมอสำคญอยางหนงสำหรบทำความเขาใจสงคมและพฤตกรรมมนษย การวจยแบบการสรางทฤษฎจากขอมล กเปนหนงในหลายระเบยบวธการวจยเชงคณภาพทกำลงไดรบความสนใจ และเปนทนยมเพมสงขนเรอยๆ จากนกวชาการ และนกวจยในสาขาสงคมศาสตร และศาสตรอนๆ เชน พฤตกรรมศาสตร สงคมวทยา สาธารณสขศาสตร พยาบาลศาสตร จตวทยาสงคม ศกษาศาสตร รฐศาสตร และสารสนเทศศกษา ดงนน หนงสอเรอง “ConstructingGrounded Theory: A Practical Guide through Qualitative Analysis” หรอ “การสรางทฤษฎจากขอมล:แนวทางการปฏบตผานการวเคราะหเชงคณภาพ” จะชวยใหผอานมความรความเขาใจถงพฒนาการของปฏบตการวจยแบบสรางทฤษฎจากขอมล ตลอดจนแนวทาง และกระบวนการปฏบตการวจยอยางเปนระบบ จงเปนหนงสอทควรคาแกการอานโดยเฉพาะนกวจยรนใหม เพอเปนแนวทางในการนำความรความเขาใจไประยกตในงานวจยของตน อกทงนกวจยผเชยวชาญสามารถอานเพอขยายมโนทศนดานวจยใหกวางขวางขน

Constructing Grounded Theory: A Practical Guide through Qualitative Analysis

Black-box web application vulnerability scanners are automated tools that probe web applications for security vulnerabilities In order to assess the current state of the art, we obtained access to eight leading tools and carried out a study of: (i) the class of vulnerabilities tested by these scanners, (ii) their effectiveness against target vulnerabilities, and (iii) the relevance of the target vulnerabilities to vulnerabilities found in the wild To conduct our study we used a custom web application vulnerable to known and projected vulnerabilities, and previous versions of widely used web applications containing known vulnerabilities Our results show the promise and effectiveness of automated tools, as a group, and also some limitations In particular, "stored" forms of Cross Site Scripting (XSS) and SQL Injection (SQLI) vulnerabilities are not currently found by many tools Because our goal is to assess the potential of future research, not to evaluate specific vendors, we do not report comparative data or make any recommendations about purchase of specific tools

/pdf/state-of-the-art-automated-black-box-web-application-2o7akal2al.pdf

State of the art automated black-box web application vulnerability testing

High-level vision: Object recognition and visual cognition, Shimon Ullman. MIT Press, Bradford (1996), ISBN 0 262 21013 4

Recent advances in deep learning (DL) allow for solving complex AI problems that used to be considered very hard. While this progress has advanced many fields, it is considered to be bad news for Completely Automated Public Turing tests to tell Computers and Humans Apart (CAPTCHAs), the security of which rests on the hardness of some learning problems. In this paper, we introduce DeepCAPTCHA, a new and secure CAPTCHA scheme based on adversarial examples , an inherit limitation of the current DL networks. These adversarial examples are constructed inputs, either synthesized from scratch or computed by adding a small and specific perturbation called adversarial noise to correctly classified items, causing the targeted DL network to misclassify them. We show that plain adversarial noise is insufficient to achieve secure CAPTCHA schemes, which leads us to introduce immutable adversarial noise —an adversarial noise that is resistant to removal attempts. In this paper, we implement a proof of concept system, and its analysis shows that the scheme offers high security and good usability compared with the best previously existing CAPTCHAs.

/pdf/no-bot-expects-the-deepcaptcha-introducing-immutable-1nlyst7cr5.pdf

No Bot Expects the DeepCAPTCHA! Introducing Immutable Adversarial Examples, With Applications to CAPTCHA Generation

Over the last decade, it has become well-established that a captcha's ability to withstand automated solving lies in the difficulty of segmenting the image into individual characters. The standard approach to solving captchas automatically has been a sequential process wherein a segmentation algorithm splits the image into segments that contain individual characters, followed by a character recognition step that uses machine learning. While this approach has been effective against particular captcha schemes, its generality is limited by the segmentation step, which is hand-crafted to defeat the distortion at hand. No general algorithm is known for the character collapsing anti-segmentation technique used by most prominent real world captcha schemes.

This paper introduces a novel approach to solving captchas in a single step that uses machine learning to attack the segmentation and the recognition problems simultaneously. Performing both operations jointly allows our algorithm to exploit information and context that is not available when they are done sequentially. At the same time, it removes the need for any hand-crafted component, making our approach generalize to new captcha schemes where the previous approach can not. We were able to solve all the real world captcha schemes we evaluated accurately enough to consider the scheme insecure in practice, including Yahoo (5.33%) and ReCaptcha (33.34%), without any adjustments to the algorithm or its parameters. Our success against the Baidu (38.68%) and CNN (51.09%) schemes that use occluding lines as well as character collapsing leads us to believe that our approach is able to defeat occluding lines in an equally general manner. The effectiveness and universality of our results suggests that combining segmentation and recognition is the next evolution of catpcha solving, and that it supersedes the sequential approach used in earlier works. More generally, our approach raises questions about how to develop sufficiently secure captchas in the future.

/pdf/the-end-is-nigh-generic-solving-of-text-based-captchas-3w55ws65ax.pdf

The end is nigh: generic solving of text-based CAPTCHAs

We explore the robustness and usability of moving-image object recognition (video) captchas, designing and implementing automated attacks based on computer vision techniques. Our approach is suitable for broad classes of moving-image captchas involving rigid objects. We first present an attack that defeats instances of such a captcha (NuCaptcha) representing the state-of-the-art, involving dynamic text strings called codewords. We then consider design modifications to mitigate the attacks (e.g., overlapping characters more closely). We implement the modified captchas and test if designs modified for greater robustness maintain usability. Our lab-based studies show that the modified captchas fail to offer viable usability, even when the captcha strength is reduced below acceptable targets--signaling that the modified designs are not viable. We also implement and test another variant of moving text strings using the known emerging images idea. This variant is resilient to our attacks and also offers similar usability to commercially available approaches. We explain why fundamental elements of the emerging images concept resist our current attack where others fails.

/pdf/security-and-usability-challenges-of-moving-object-captchas-17ffqydhns.pdf

Security and usability challenges of moving-object CAPTCHAs: decoding codewords in motion

We explore the robustness and usability of moving-image object recognition (video) captchas, designing and implementing automated attacks based on computer vision techniques. Our approach is suitable for broad classes of moving-image captchas involving rigid objects. We first present an attack that defeats instances of such a captcha (NuCaptcha) representing the state-of-the-art, involving dynamic text strings called codewords. We then consider design modifications to mitigate the attacks (e.g., overlapping characters more closely, randomly changing the font of individual characters, or even randomly varying the number of characters in the codeword). We implement the modified captchas and test if designs modified for greater robustness maintain usability. Our lab-based studies show that the modified captchas fail to offer viable usability, even when the captcha strength is reduced below acceptable targets. Worse yet, our GPU-based implementation shows that our automated approach can decode these captchas faster than humans can, and we can do so at a relatively low cost of roughly 50 cents per 1,000 captchas solved based on Amazon EC2 rates circa 2012. To further demonstrate the challenges in designing usable captchas, we also implement and test another variant of moving text strings using the known emerging images concept. This variant is resilient to our attacks and also offers similar usability to commercially available approaches. We explain why fundamental elements of the emerging images idea resist our current attack where others fail.

/pdf/security-analysis-and-related-usability-of-motion-based-2q95lgynde.pdf

Security Analysis and Related Usability of Motion-Based CAPTCHAs: Decoding Codewords in Motion

Completely Automated Public Turing tests to tell Computers and Humans Apart (CAPTCHA) are challenge-response tests used on the web to distinguish human users from automated bots (von Ahn et al, 2004) In this paper, we present an exploratory analysis of the results obtained from a user study and a heuristic evaluation of captchas on smartphones; we aimed to identify opportunities and guide improvements for captchas on smartphones Results showed that existing captcha schemes face effectiveness and user satisfaction problems Among the more severe problems found were the need to often zoom and pan, and too small control buttons Based on our results, we present deployment and design guidelines for captchas on smartphones

/pdf/the-usability-of-captchas-on-smartphones-2k9unxs02u.pdf

The usability of CAPTCHAs on smartphones

Completely Automated Public Turing tests to tell Computers and Humans Apart (captchas) are challenge-response tests used as a security mechanism on the web to distinguish human users from automated programs. While captchas are often necessary to stop abuse of resources, most existing schemes are intended for traditional desktop computing environments rather than for mobile device usage. In this paper we present a comparative user study of nine captcha schemes on smartphones to assess whether alternative input mechanisms help improve the usability of captchas in smartphones, and to evaluate the usability of modified schemes intended to be more suitable for smartphones. The results show that although participants find virtual keyboards on smartphones prone to errors they prefer them as input mechanism over other alternatives. We also found that the content of the challenge is highly relevant in users’ perceptions when it comes to captchas on smartphones. Based on our experiences, we offer a set of ten specific recommendations for the implementation of captchas on smartphones.

Exploring the Usability of CAPTCHAS on Smartphones: Comparisons and Recommendations

Captchas are used as a security mechanism on the web to distinguish human users from automated programs. However, existing captchas are not well-adapted to mobile devices and may lead users to abandon tasks. Although Web developers have many available captchas, they lack the tools to evaluate if these captchas are suitable for their mobile site. In this paper, we present domain specific usability heuristics for evaluating captchas on smartphones. To assess effectiveness, we compared our proposed heuristics against Nielsen's during evaluations of four captcha schemes on smartphones. The custom heuristics revealed more major problems and more detailed feedback on the problems than Nielsen's.

/pdf/heuristics-for-the-evaluation-of-captchas-on-smartphones-2npl5jzt43.pdf

Gerardo Reynaga

Papers

Security and usability challenges of moving-object CAPTCHAs: decoding codewords in motion

Security Analysis and Related Usability of Motion-Based CAPTCHAs: Decoding Codewords in Motion

The usability of CAPTCHAs on smartphones

Exploring the Usability of CAPTCHAS on Smartphones: Comparisons and Recommendations

Heuristics for the evaluation of captchas on smartphones