Computer-assisted tools and crowd sourcing can easily bypass traditional anti-spam solutions, forcing CAPTCHAs to evolve to address these techniques, according to Imperva.


A CAPTCHA, or a Completely Automated Public Turing test to tell Computers and Humans Apart, is a common security measure used to distinguish human users from automated browsing applications, helping to prevent automated tools from abusing online services. Hackers have developed numerous methods to bypass CAPTCHAs, such as computer-assisted tools and crowd sourcing, forcing CAPTCHA providers to constantly monitor and innovate their services.

“CAPTCHA security, like many other security segments, is a battle of innovation between hackers and security professionals,” said Amichai Shulman, CTO, Imperva. “CAPTCHA security must be balanced against a positive user experience, but can readily be improved by deploying anti-automation solutions to help prevent hackers from employing anti-CAPTCHA tools.”

“A CAPTCHA in the Rye” report provides contextual analysis and real-world case studies focused on CAPTCHA solutions, including:

Methods for bypassing CAPTCHA – Imperva highlights two main approaches hackers take to solve CAPTCHAs: Computer-assisted tools based on Optical Character Recognition or Machine Learning technologies and crowdsourcing CAPTCHA solving to third-party agents.

Emerging CAPTCHA technology – Novel approaches to CAPTCHA implementation include delivering more difficult CAPTCHAs to suspicious users, integrating simple riddles and contextual semantics, all of which are more difficult for automated tools to solve.

Lessons learned from real world deployments – Imperva analyzed a series of case studies focused on bypassing CAPTCHAs to identify common trends, such as incomplete browser headers and high rate requests per minute.

Imperva advises anti-automation solutions to bolster CAPTCHA defenses with traffic-based automation detection, behavioral analysis, content analysis and blacklists.