The idea of the attack is very simple: You grab the mp3 file of the audio reCAPTCHA and you submit it to Google’s own Speech to Text API. In a blog post, the researcher stated that: Talking about how he did it, in his own words, the audio that is given by Google for the captcha challenge is taken in Mp3 form and then submitted to “Google’s own Speech to Text API” which translates it into text with a 97% accuracy. See: Apple, Google to ban X-Mode’s location tracking apps from stores

Some may think that with the release of reCaptcha V3, this is irrelevant but that would be untrue since a large number of websites still use the former version. Now, coming to 2021, we have news that another researcher named Nikolai Tschacher has changed the code for UnCaptcha 2 which makes it work against Google’s current reCaptcha V2. This was rendered ineffective as well after a while since the researchers did not continue to update their exploit. It was called Uncaptcha, and Google shortly afterward patched it.īut then again in 2019, editing the original exploit and dubbed as uncaptcha 2, it was up and running again with a proof-of-concept showcasing exactly how. The exploit used a speech to text mechanism in order to override any audio challenges (for visually impaired people) that the ReCaptcha threw at it making it possible for automated scripts to bypass such barriers. In the latest, we have a story concerning a Google reCaptcha exploit which was found over 3 years ago in 2017 by researchers belonging to the University of Maryland. According to researchers, the idea of the attack is to grab the MP3 file of the audio reCAPTCHA and submit it to Google’s own Speech to Text API.Įxploit and patch – a neverending story in the cybersecurity world, sometimes with exactly the same flaws.

Protect against google recaptcha bypass