'While online web services can block abusers' originating IPs, the rise of proxyware adoption renders this method as toothless as CAPTCHAs.' 'CAPTCHAs are common tools used to prevent spam and bot abuse, but the increasing use of CAPTCHA-breaking services has made CAPTCHAs less effective,' Costoya said. In one instance of a CAPTCHA-breaking service targeting popular social commerce marketplace Poshmark, the task requests emanating from a bot are routed via a proxyware network.

Proxyware, although marketed as a utility to share a user's unused internet bandwidth with other parties in return for a 'passive income,' essentially turns the devices running them into residential proxies.

Threat actors have been observed purchasing CAPTCHA-breaking services and combining them with proxyware offerings to obscure the originating IP address and evade antibot barriers. 'And because actual humans are solving CAPTCHAs, the purpose of filtering out automated bot traffic through these tests are rendered ineffective.' 'This makes it easy for the customers of CAPTCHA-breaking services to develop automated tools against online web services,' security researcher Joey Costoya said. What's more, the entire workflow is rendered accessible to the bot operators by making it possible to transmit the CAPTCHA in real-time via API calls to the service provider, which then programmatically sends the answers.

The illicit CAPTCHA-solving services work by funneling requests sent by customers and delegating them to their human solvers, who work out the solution and submit the results back to the users. While CAPTCHA mechanisms can be a disruptive user experience, they are seen as an effective means to counter attacks from bot-originating web traffic. 'These CAPTCHA-solving services don't use techniques or advanced machine learning methods instead, they break CAPTCHAs by farming out CAPTCHA-breaking tasks to actual human solvers.'ĬAPTCHA – short for Completely Automated Public Turing test to tell Computers and Humans Apart – is a tool for differentiating real human users from automated users with the goal of combating spam and restricting fake account creation. 'Because cybercriminals are keen on breaking CAPTCHAs accurately, several services that are primarily geared toward this market demand have been created,' Trend Micro said in a report published last week. Cybersecurity researchers are warning about CAPTCHA-breaking services that are being offered for sale to bypass systems designed to distinguish legitimate users from bot traffic.

Captcha solving bot