AI Can Now Solve CAPTCHA Tests All The Time

With the rise in online bots, cybersecurity companies and experts developed a wide range of tools, techniques and technologies to help distinguish between a human user and a robot.

One such technology includes “Completely Automated Public Turing Test to Tell Computers and Humans Apart” better known by its acronym – CAPTCHA.

CAPTCHA tests commonly present one or multiple images divided into boxes, requiring users to select those containing one or several instances of specific objects, such as fire hydrants, cars or boats. Another type distorts letters and numbers mixed with random shapes, which users must correctly identify and input.

The idea was to tell the difference between human users and computer bots through such tests – a method that may not be effective anymore, thanks to the work done by researchers from ETH Zurich.

So, what did the researchers reveal about their work? Let’s explore!

What Was ETH Zurich’s Research On CAPTCHA About?

 

• Through a paper published by researchers from ETH Zurich, Switzerland, revealed that they developed an AI model that can consistently bypass CAPTCHA puzzles.

• The model was built on the YOLO (You Only Look Once) system, which is an AI model used for processing pictures.

• The researchers fine-tuned YOLO to focus on Google's reCAPTCHAv2, which relies on object recognition puzzles involving images like cars, bicycles, and traffic lights.

• The scientists trained their model on 14,000 labeled photos of streets as used in reCAPTCHAv2.

• Furthermore, the AI model was able to overcome additional sophisticated factors such as mouse movement and browser history, to keep its success rate intact.

• Essentially, they trained the model to solve such puzzles as well as humans do.

• In some cases, if the AI model made a mistake, it would make up for it in another puzzle.

What Did The Researchers Say?

 

• Through the paper, the researchers said, “Our work examines the efficacy of employing advanced machine learning methods to solve captchas from Google's reCAPTCHAv2 system.”

• “We evaluate the effectiveness of automated systems in solving captchas by utilizing advanced YOLO models for image segmentation and classification.”

• “Our main result is that we can solve 100% of the captchas, while previous work only solved 68-71%.”

• “Furthermore, our findings suggest that there is no significant difference in the number of challenges humans and bots must solve to pass the captchas in reCAPTCHAv2. This implies that current AI technologies can exploit advanced image-based captchas.”

• “We also look under the hood of reCAPTCHAv2 and find evidence that reCAPTCHAv2 is heavily based on cookie and browser history data when evaluating whether a user is human or not. The code is provided alongside this paper.”

What Alternatives Can Be Used In Place Of CAPTCHA?

 

• The YOLO AI model’s ability to solve CAPTCHA puzzles 100% of the time has raised some serious concerns for the cybersecurity industry.

• CAPTCHA helps prevent bots from deploying distributed denial-of-service (DDoS) attacks, spamming others, creating fake accounts and engaging in other harmful online activities.

• Here, cybersecurity platforms can consider using behavioral analysis, tracking user interaction patterns, biometric verification systems, facial recognition, multi-step authentication and others.

• Alternatively, they can consider using a combination of testing methods.

• Interestingly, two of the researchers from this team were also part of another paper aimed at creating stronger images for CAPTCHAs.

• Titled “Seeing Through the Mask: Rethinking Adversarial Examples for CAPTCHAs”, the paper included Andreas Plesner and Roger Wattenhofer from ETH Zurich, who were joined by Turlan Kuzhagaliyev also from ETH Zurich and lead researcher Yahya Jabary from TU Wein (Vienna University of Technology).

• The researchers found that they could hoodwink many state-of-the-art models by generating some well-hidden "random" noise and adding it to the image or hiding objects in the image.

• This technique could help in dropping accuracy levels by 50%-points for all models and 80%-points for “supposedly robust models such as vision transformers”.

Do you think cybersecurity experts need to come up with stronger CAPTCHA systems? Do you think it should be replaced with current systems?

Let us know in the comments below!