Stiltwalker is a proof of concept tool that defeats Google’s reCAPTCHA with an insanely high (99%) accuracy rate. All the research, code and tools have since been released for the public as an open source project. This was accomplished with a combination of neural networks, machine learning, hashing methods, keyspace reduction tactics, and taking advantage of an overall limited number of captchas.

Specifically, it goes head to head, sometimes using brute force against reCAPTCHA’S audio captcha system and defeats almost all of it’s challenges. We know that the reCAPTCHA system is used by Google to minimize spam. CAPTCHA stands for Completely Automated Public Turing Test to Tell Computers and Humans Apart.

With Stiltwalker, you can even crack audio reCAPTCHA’s! A custom phonetic based word mashing is used to do this. If that does not work, plain old brute force is used. It was discovered that reCAPTCHA used only 58 words and that sound frequencies could be exploited to isolate them. Once this was known to Google, they got about and increased the number.

Though Stiltwalker was developed using Ubuntu 10.04, Ubuntu 11.04, and Debian 6, it should work on any Linux distribution without too much effort as long as SoX v14.3.0 or v14.3.1 is installed. Looks like SoX v14.3.2 does not work as it should. So you should avoid it. If you do not have an Ubuntu installation, see to it that you have octave, python2.7, curl, sox, libsox-fmt-all, libphash0-dev, libphash0 and cimg-dev. Python 2.6 will also work, however, you will also need python-argparse and python-imaging as these libraries aren’t included by default until 2.7.

Subscribe Top Hacker Stories via email