Researchers using artificial intelligence have cracked CAPTCHA security systems designed to keep bots out of websites by detecting whether the user is human or not.
Using advanced machine learning methods, researchers from the University of ETH Zurich in Switzerland solved 100% of the same tests as human users, created by Google's popular reCAPTCHAv2 product.
The results, Published on September 13“Current AI technologies can use image-based captchas,” the authors write.
“This has been coming for a while,” said Matthew Green, an associate professor of computer science at the Johns Hopkins Information Security Institute. “The whole idea of captchas was that people are better at solving these puzzles than computers. We're learning that's not true.”
CAPTCHA stands for Fully Automated Public Turing Test designed to distinguish between computers and humans. Google's reCAPTCHA v2 system, used in the new study, is tested by asking users to select images containing images such as traffic lights and sidewalks.
While the process used by Swiss researchers to defeat reCAPTCHAv2 was not fully automated and required human intervention, a fully automated process for bypassing CAPTCHA systems may be just around the corner.
“I wouldn't be surprised if this came up in the near future,” said Philip Mack, director of the cybersecurity operations center for a large government agency and an assistant professor at New York University. Decrypt.
In response to bots' improved ability to solve captchas, companies like Google, which released its third-generation reCAPTCHA product in 2018, are steadily increasing the complexity of their products.
“The bots are constantly getting smarter,” said Sandy Carielli, principal analyst at Forrester. “What worked a few weeks ago may not work today.”
“The best players are constantly improving because they have to,” she said. “The evolution is not just to block bots, but to create the right responses to bots that are so expensive that they go elsewhere.”
However, introducing more difficult challenges for bots would add more complexity to the puzzles, making them more inconvenient for humans.
Average users “have to spend more and more time solving captchas and may eventually give up,” says Mack.
While the future of CAPTCHA as a security technology is uncertain, others — including Gene Tudyk, a professor of computer science at the University of California, Irvine — are more pessimistic.
“Only reCAPTCHA and its seeds should go,” Tudyk said. “There are other techniques that are still safe or at least better, but not significant. So it will still be an arms race.
If CAPTCHA fades, there could be dire consequences for many Internet stakeholders unless cybersecurity firms come up with new solutions, Green said.
“If 50% of their users don't know they're real, that's a big problem for advertisers and the people running the service,” Green said. “Cheating was a big problem when you had to hire people to do it, and now it's even worse when you can have AI do the cheating for you.”
Edited by Josh Quittner and Sebastian Sinclair
Generally intelligent newspaper
A weekly AI journey narrated by a generative AI model.
