Blog

CAPTCHAs are everywhere — blogs, ticket websites, shopping portals. The traffic lights you need to spot in a block of images to access a website — these are CAPTCHAs, too. The CAPTCHA was introduced to help sites distinguish between human users and bots. Bots are often part of automated hacking tools. So, CAPTCHAs keep your websites safe by keeping bots at bay.

reCAPTCHA is a CAPTCHA technology introduced by Google. It works on a more advanced risk analysis engine to protect your websites from bots. It can detect and respond to adaptive behaviour by malicious players seeking to hack your website. It is also friendlier to hearing and visually impaired users through its support for audio and images.   

But little did its creators know that someday reCAPTCHA domain hacks would occur, and cybercriminals would leverage this technology to bypass automated detection and hack your system. Wondering how attackers can use reCAPTCHA to hack your system? Here is how:

reCAPTCHA Domain Hacks

Cybercriminals can use reCAPTCHAs to attack your websites without leaving any trace for you to detect the breach. The typical method is to lure the users to a malicious website displaying a fake reCAPTCHA. The user’s inputs in response to the prompts on the fake reCAPTCHA trigger a download of malware onto the user’s device.

Magecart, a cybercrime syndicate, engages in such attacks frequently. In one of their attacks, a system was infected for almost two years – a malicious server was registered as early as July 2019. The server started serving malicious JavaScript as soon as users mistakenly clicked on a fake reCAPTCHA after being lured to a malicious site. The URL of the fake site closely resembled that of Google’s reCAPTCHA site.

How did the Hackers Stage the successful Attack?

So, how did the daring hackers hoodwink users into using a fake reCAPTCHA on a malicious website? First, they created a sense of false anxiety and urgency. They used an email format similar to that of the compromised customers’ bank emails and asked them to confirm a fictitious financial transaction they entered into recently. Agitated customers clicked on a malicious link in the email, which took them to the hackers’ website with a fake reCAPTCHA.

Most customers failed to read the fake URL of the malicious website, which vaguely resembled that of the Google reCAPTCHA website. In their anxiety to resolve the fictitious transaction, customers blindly followed the prompts on the fake reCAPTCHA. Their actions downloaded malicious JavaScript onto their devices that hackers used to steal their personal and financial information.

Such reCAPTCHA domain hacks can compromise customers’ payment details and personally identifiable information (PII). They can also expose the site owners to fines for breach of data protection laws, such as GDPR, CCPA or NYPA.

In addition, solver services like Solvere Captcha offer bots to beat reCAPTCHA. These techniques render reCAPTCHAs ineffective and can simulate real users to bypass the security barrier reCAPTCHAs put up. While hackers may not use these services, they may use similar techniques to bypass reCAPTCHAs by mimicking human behaviour.

There is more. Researchers at Columbia University discovered security loopholes in Google reCAPTCHAs. Through moderate effort, they could solve 70% of the image challenges reCAPTCHAs presented.

Another technique to compromise reCAPTCHAs has been deployed with 97% accuracy. The technique involves exploiting the speech-to-text feature reCAPTCHA offers the visually impaired. Here, hackers access the MP3 files of the reCAPTCHA and submit it back to Google’s speech-to-text API. This simple technique works with a high level of consistency for the hackers.

A compromised reCAPTCHA is a matter of great concern for any business owner because it can negatively impact customer confidence and brand reputation. 

Endnote

All reCAPTCHA domain hacks present a diversion to human eyes. That is why at first glance, the malicious _https://recaptcha.tech/client/js/api.js_ can be confused for the innocuous https://www.google.com/recaptcha/api.js.

With cybercriminals gaining an edge every day, businesses must be ready to protect themselves. At Packetlabs, we help you safeguard your organization, its data, and its brand image through our cybersecurity services that will keep you safe from a wide range of cyberattacks. Contact us today to enhance your awareness and avoid information theft.