Researcher Breaks reCAPTCHA

A researcher has discovered what he calls a "logic vulnerability" that allowed him to create a Python script that is fully capable of bypassing Google's reCAPTCHA fields using another Google service, the Speech Recognition API.

The proof-of-concept code the researcher released allows attackers to automate the process of bypassing reCAPTCHA fields, currently used on millions of sites to keep out spam bots.

The attack is incredibly simple and works by downloading a version of the reCAPTCHA audio challenge, feeding it into Google's Speech Recognition API, getting the text-version of the audio challenge, and feeding it back into the reCAPTCHA field

Proof of concept code:
https://github.com/eastee/rebreakcaptcha

heh thats funny

Simply genius. The ball is in Google's court now.

Genius

Thats what happens when you think outside the box.

Heisenb0rg said:

Thats what happens when you think outside the box.

Click to expand...

Make me think outside the box

But then we have the cat in the box.

Read the comment in author's blog, its not working as thought.

terrycody said:

Read the comment in author's blog, its not working as thought.

Click to expand...

It is proof of concept. POC code does not always work the way people think it will, but it does work. Rather than rinse and repeat when it does not work, the people complaining that it does not work should modify the code.

Google hold this L for allowing people to use your own service to bypass another service of your own ahahaha