  Completely Automated Public Turing Test To Tell Computers and Humans Apart
(CAPTCHA) has been implemented on many websites to identify between harmful
automated bots and legitimate users. However, the revenue generated by the bots
has turned circumventing CAPTCHAs into a lucrative business. Although earlier
studies provided information about text-based CAPTCHAs and the associated
CAPTCHA-solving services, a lot has changed in the past decade regarding
content, suppliers, and solvers of CAPTCHA. We have conducted a comprehensive
investigation of the latest third-party CAPTCHA providers and CAPTCHA-solving
services' attacks. We dug into the details of CAPTCHA-As-a-Service and the
latest CAPTCHA-solving services and carried out adversarial experiments on
CAPTCHAs and CAPTCHA solvers. The experiment results show a worrying fact: most
latest CAPTCHAs are vulnerable to both human solvers and automated solvers. New
CAPTCHAs based on hard AI problems and behavior analysis are needed to stop
CAPTCHA solvers.
