unCAPTCHA Breaks 450 ReCAPTCHAs in Under 6 Seconds

itman · Oct 30, 2017

unCAPTCHA is the name of a new automated system designed by a team of four computer science experts from the University of Maryland (UM) that can break Google's reCAPTCHA challenges with an accuracy of 85%.

The system doesn't target reCAPTCHA's image-based challenges, but the audio version that Google added so people with disabilities can solve its puzzle.

unCAPTCHA works by downloading this audio puzzle and feeding it to six text-to-speech (TTS) systems, aggregating the results, and feeding most probable answer back to Google's servers.
Click to expand...

https://www.bleepingcomputer.com/news/technology/uncaptcha-breaks-450-recaptchas-in-under-6-seconds/

guest · Jan 2, 2019

unCaptcha2
Automated System Bypasses Google reCAPTCHA Again
January 2, 2019
https://www.securityweek.com/automated-system-bypasses-google-recaptcha-again

“Thanks to the changes to the audio challenge, passing ReCaptcha is easier than ever before. The code now only needs to make a single request to a free, publicly available speech to text API to achieve around 90% accuracy over all captchas,” the security experts behind the system explain.

The reCAPTCHA team was informed on the discovery in June 2018 and a formal issue was opened on June 27, 2018. The experts decided to wait for six months before making their findings public, to give Google enough time to address the underlying architectural issues.
“The Recaptcha team is aware of this attack vector, and have confirmed they are okay with us releasing this code, despite its current success rate. This attack vector was deemed out of scope for the bug bounty program,” the experts also note.
Click to expand...

guest · Jan 5, 2021

unCAPTCHA3
Researcher Breaks reCAPTCHA With Google’s Speech-to-Text API
Researcher uses an old unCAPTCHA trick against latest the audio version of reCAPTCHA, with a 97 percent success rate
January 4, 2021
https://threatpost.com/researcher-breaks-recaptcha-speech-to-text-api/162734/

An old attack method dating back to 2017 that uses voice-to-text to bypass CAPTCHA protections turns out to still work on Google’s latest reCAPTCHA v3.
That’s according to researcher Nikolai Tschacher, who posted a video proof-of-concept (PoC) of the attack on Jan. 2.

“The idea of the attack is very simple: You grab the MP3 file of the audio reCAPTCHA and you submit it to Google’s own speech-to-text API,” Tschacher wrote. “Google will return the correct answer in over 97 percent of all cases.”
Tschacher pointed out that his bot wouldn’t be easy to exploit at scale for three specific reasons: Google rate-limits audio CAPTCHA access; Google is likely tracking bot metrics; and, it creates a fingerprint of each browsing device to stop bots.
Click to expand...

CAPTCHA, ReCAPTCHA, UnCAPTCHA
The idea of using speech-to-text against CAPTCHA protections was first introduced in 2017 by researchers at the University of Maryland, who then reported they “achieved 85 percent accuracy” with the tech they dubbed “UnCAPTCHA.”

The report added that the reCAPTCHA bug was reported to Google in June 2018, and they okayed the release of the unCAPTCHA2 code.
Now Tschacher appears to have come up with what could be called unCAPTCHA3, except now he said he can achieve a 97 percent success rate, instead of the original 85 percent reported in 2017.
Click to expand...

Log in or Sign up

unCAPTCHA Breaks 450 ReCAPTCHAs in Under 6 Seconds

itman Registered Member

guest Guest

guest Guest

Log in or Sign up

unCAPTCHA Breaks 450 ReCAPTCHAs in Under 6 Seconds

itman Registered Member

guest Guest

guest Guest

Useful Searches