DEEN

Captcha bypass

How are CAPTCHAs being circumvented today?

On the one hand, there is a whole range of applications to solve or circumvent CAPTCHAs. Malicious interests are not always behind this. Some users want to protect their own privacy by using VPNs or preventing tracking attempts. There are also repositories that aim to highlight the weaknesses of CAPTCHAs.

On the other hand, there are CAPTCHA solution services that offer their services in a very targeted manner. There are two main forms of these providers, also known as CAPTCHA farms:

  • Human-based CAPTCHA solving services - Here, people solve the CAPTCHAs on behalf of companies and send the solution back to the client
  • System-based CAPTCHA solving services - In this method, the CAPTCHA is solved automatically using various technologies such as OCR (Optical Character Recognition)

There is increasing criticism that the most popular CAPTCHA solutions, which mainly operate in silos as a first line of defense, do not provide sufficient protection against CAPTCHA farms, advanced bots or automation by malicious actors. In view of the price tables of captcha solution services, it can be assumed that this criticism is justified.

Browser extensions such as Buster show just how low-threshold the offer is. This Chrome extension uses speech recognition to help solve reCAPTCHA tasks. The developers state the following as their motivation for providing the browser extension: 

reCAPTCHA-Herausforderungen stellen nach wie vor eine erhebliche Belastung für das Internet dar, da sie den Zugang zu Diensten und Informationen je nach unseren physischen und kognitiven Fähigkeiten, unserem sozialen und kulturellen Hintergrund und den Geräten oder Netzen, von denen aus wir eine Verbindung herstellen, verzögern und häufig blockieren.

Die Schwierigkeit von Captchas kann so unausgewogen sein, dass sie manchmal für Bots freundlicher erscheinen als für Menschen.

Das Ziel dieses Projekts ist es, unsere Erfahrungen mit Captchas zu verbessern, indem wir einfachen Zugang zu Lösungen erhalten, die bereits von automatisierten Systemen verwendet werden.

Armin Sebastian, Entwickler von Buster