I'm Not a Human: Breaking the Google Recaptcha
summary
Describes a working attack that combines browser cookie reuse and image-semantic solvers: creating Google cookies (valid ~9 days) and harvesting 63,000 cookies from one machine lets an attacker request many checkbox responses and obtain about 55,000 “no‑captcha” passes per day from one IP; when image challenges appear, the pipeline uses Clarifai/Google reverse image search, off‑the‑shelf CNNs and word2vec to match hints, reaching 70.78% accuracy with 19s per challenge (offline ~40%, Facebook captcha 83.5%), and a +5% lift from word2vec.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:07Traditional CAPTCHA limits
- 2:33Google reCAPTCHA v2
- 4:41Risk analysis engine
- 6:48Browser fingerprinting
- 8:37Exploiting Google cookies
- 10:03Cookie attack scalability
- 12:30Deep learning on images
- 15:42Reverse image search
- 18:53Tag classifier for CAPTCHAs
- 20:58Attack accuracy vs humans
- 23:26Testing on Facebook CAPTCHA
- 24:29Countermeasures proposed
- 26:33Conclusion
- 27:33Q&A
related talks
01mCAPTCHA defeat
41mThe State Of Credential Stuffing And The Future Of Account Takeovers
40mYou have a security problem - your users
41m📙 The Great Credential Caper: How to Perform and then Defend Against the (Nearly Impossible) to Defend 🏗️
11mLet The Right One In: Attestation as a Usable CAPTCHA Alternative
05mSenCAPTCHA: A Mobile-First CAPTCHA Using Orientation Sensors
10mDualCheck: Exploiting Human Verification Tasks for Opportunistic Online Safety...
34mFakeCaptcha Is So Yesterday