Slashdot Mirror
Researchers Fool ReCAPTCHA With Google's Own Speech-To-Text Service (vice.com)
Researchers at the University of Maryland have managed to trick Google's reCaptcha system by using Google's own speech-to-text service. "[The researchers] claim that their CAPTCHA-fooling method, unCaptcha, can fool Google's reCaptcha, one of the most popular CAPTCHA systems currently used by hundreds of thousands of websites, with a 90 percent success rate," reports Motherboard. From the report: The researchers originally developed UnCaptcha in 2017, which uses Google's own free speech-to-text service to trick the system into thinking a robot is a human. It's an oroborus of bots: According to their paper, UnCaptcha downloads the audio captcha, segments the audio into individual digit audio clips, uploads the segments to multiple other speech-to-text services (including Google's), then converts these services' responses to digits. After a little homophone guesswork, it then decides which speech-to-text output is closest to accurate, and uploads the answer to the CAPTCHA field. This old method returned an 85% success rate.
After the release of that version of unCaptcha, Google fixed some of the loopholes that made it work, including better browser automation detection and switching to spoken phrases, rather than digits. The researchers claim that their new method, updated in June, gets around these improvements and is even more accurate than before, at 90 percent. "We have been in contact with the ReCaptcha team for over six months and they are fully aware of this attack," the researchers write. "The team has allowed us to release the code, despite its current success."
After the release of that version of unCaptcha, Google fixed some of the loopholes that made it work, including better browser automation detection and switching to spoken phrases, rather than digits. The researchers claim that their new method, updated in June, gets around these improvements and is even more accurate than before, at 90 percent. "We have been in contact with the ReCaptcha team for over six months and they are fully aware of this attack," the researchers write. "The team has allowed us to release the code, despite its current success."
If it wasnt for the Russian hackers we wouldnt have to try to do things like this, security would be literally 1000-2000% easier. Russians and romanians, but mostly Russians because they hack into our politics.
"Yes. Number of players: zero"
Suspenseful music begins
Hire a Linux system administrator, systems engineer,
People who sit at a keyboard all day learn the internet has backdoors. No sympathy from others who work hard for a living.
https://www.cnet.com/g00/news/google-the-word-idiot-get-pics-of-donald-trump/
Mongo upset at neo-trogs with keyboards, how make fire? Mystery anger! Must smash cave-diploma, but cannot find! Mongo know, will whine online somehow anyway. Cave irony... Mongo no sympathy, Mongo sad about Mongo.
Sad cave.
the "gore spammer" from 4chan's /mu/ used this trick for years
https://xkcd.com/810/
Digital technology will turn out to be Fermi's Great Filter. Wait for it.
nt
I thiink ReCAPTCHA's success rate of 90 percent is better than mine on some CAPTCHAs.
Soon prove that your human challenges will be so effective that only the best trained AI bots will be able to pass them. Challenge AI will adapt to only accept AI bots and humans will be left high and dry and won't be able to waste their lives away on social media and cat videos. Progress on the interwebs, at last!
This is just proof people don't have shit to do.
Aren't they a bit late in this hack? Just a few months ago we had this story about how google is redesigning the recaptcha to not even require user interaction anymore:
https://tech.slashdot.org/stor...
So it sounds like they are hacking an old version that is already in the process of being retired.
It's unfortunate that many services on the web requires google-based captcha when you sign on, even though those services have absolutely NOTHING to do with google, with no business whatsoever for google to know where you're logging in.
So if you block google at a router/dns/hosts level, you'd need to temporarily unblock it.
I'm sure it's all by design.
Google's way too invasive and businesses need to stop using them.
I'd say the same with businesses hosting company sensitive documents in google docs.
WHY!???!?
The real issue is that audio of a CAPTCHA (for blind accessibility) defeats the CAPTCHA. The second part is speech-to-text (for deaf accessibility) brings it full circle. What they really need is a true audio version of CAPTCHA that speech-to-text is likely to flub.
Anons need not reply. Questions end with a question mark.
Can Google design a CAPTCHA that's too difficult for their text-to-speech to read?
Any sufficiently unpopular but cohesive argument is indistinguishable from trolling.
...I think I need a computer to help me decipher all of the extremly distorted, very ambiguous typeface text....which is meant to thwart computers.
And I have near perfect vision! OK, they often have the audio part but imagine being deaf and not being able to see sharply the text that even sighted people have a very hard time deciphering....ooops.
I guess because-fuck the ADA?
I think it's time to give robots the same rights as humans, then they can bill each other for watching advertisements and we can return to living at peace.