Breaking ‘Click the Crosswalks’ reCAPTCHA: A Technological and Economic Analysis

Overview

Millions of websites depend on Google’s reCAPTCHA v2 security software for protection from high-scale digital attacks like credential stuffing and data mining. However, as reCAPTCHA v2, which is built upon image detection and segmentation tasks (“click the crosswalks”), has aged, computer vision technology has dramatically improved, threatening reCAPTCHA v2’s security. I aimed to measure reCAPTCHA’s security by building and testing a bot that bypasses reCAPTCHA cheaply and quickly. My bot used computer vision to answer reCAPTCHA’s image tasks; specifically, I custom-trained a YOLOv5 model for detection and a Mask- RCNN model for segmentation. My aggressive active-learning system significantly improved the accuracy of both models. I achieved a 98.77% classification accuracy on reCAPTCHA v2’s most difficult, distorted images, which previous literature has not achieved on easy, let alone difficult, tasks. I also manipulated reCAPTCHA’s risk analysis system and user interface to bypass reCAPTCHA efficiently. The average time-per-solve of my bot was 35.8 seconds; its cost-per-solve was $24 per million solves. This bot is 85x less expensive than all human- based reCAPTCHA bypasses, and 25x less expensive than all automation-based reCAPTCHA bypasses sold on the market. I cannot compare this price to previous literature, since my research is the first to investigate “security-by-economics.” reCAPTCHA provides security by imposing high costs on bots; thus, my $24 per million result suggests that reCAPTCHA v2 is insecure. I also make several suggestions to improve reCAPTCHA v2’s security, including networking security improvements and suggestions to retire/introduce several types of image challenges.

Competition history

• JSHS 2022 Category not listed

Resources

• National JSHS abstract book ↗

Related projects

Closest projects by meaning, across every fair and year in the corpus.