Hands-On Machine Learning for Cybersecurity

Breaking a CAPTCHA

Cyber criminals break CAPTCHAs for account takeover (ATO) purposes. ATO is a method of credential theft where the malicious agent takes over the account/profile of the victim leading to unauthorized activities.

Credential stuffing is one way to carry over an ATO; here, passwords collected from different places or previous attacks are used to break into many sites. This form of ATO may or may not require CAPTCHA. Here, fraudsters use the propensity that the victim may reuse a password.

For the preceding case, if there are CAPTCHAs that need to be cracked, then one of the following methods are adopted:

• Use of human labor to crack the CAPTCHA: Malicious agents often use cheap human labor to decode CAPTCHA. Human agents are ...