  Previous work showed that reCAPTCHA v2's image challenges could be solved by
automated programs armed with Deep Neural Network (DNN) image classifiers and
vision APIs provided by off-the-shelf image recognition services. In response
to emerging threats, Google has made significant updates to its image reCAPTCHA
v2 challenges that can render the prior approaches ineffective to a great
extent. In this paper, we investigate the robustness of the latest version of
reCAPTCHA v2 against advanced object detection based solvers. We propose a
fully automated object detection based system that breaks the most advanced
challenges of reCAPTCHA v2 with an online success rate of 83.25%, the highest
success rate to date, and it takes only 19.93 seconds (including network
delays) on average to crack a challenge. We also study the updated security
features of reCAPTCHA v2, such as anti-recognition mechanisms, improved
anti-bot detection techniques, and adjustable security preferences. Our
extensive experiments show that while these security features can provide some
resistance against automated attacks, adversaries can still bypass most of
them. Our experimental findings indicate that the recent advances in object
detection technologies pose a severe threat to the security of image captcha
designs relying on simple object detection as their underlying AI problem.
