Tell Me About Yourself: The Malicious CAPTCHA Attack

摘要: We present the malicious CAPTCHA attack, allowing a rogue website to trick users into unknowingly disclosing their private information. The site displays information user in obfuscated manner, as if it is challenge; unaware that solving CAPTCHA, results This circumvents Same Origin Policy (SOP), whose goal prevent access by sites information, exploiting fact many websites allow display of (to user), upon requests from any (even rogue) website. Information so disclosed includes name, phone number, email and physical addresses, search history, preferences, partial credit card numbers, more. vulnerability common attack works for popular sites, including nine out ten most websites. evaluated using IRB-approved, ethical experiments.