Google's new gesture reCAPTCHA defeated by a single static JPG
Google wanted us to wave at our webcams like idiots to prove we are human. Turns out, their state-of-the-art AI "liveness" tracking can be completely fooled by a frozen picture. Yes, a literal screenshot of a hand is smarter than their multi-billion dollar neural network.
The developers at RTF Labs Studio found a glaring hole in the new reCAPTCHA Hand Gesture Verification. This system was designed to make users flash hand gestures like fists or thumbs-up to their webcams. Instead of analyzing actual human motion, the AI apparently just looks for a matching shape and calls it a day.
To pull off this high-tech heist, the researchers didn't need a supercomputer. They just used a basic Python script. By utilizing the pyvirtualcam library and OpenCV, they fed the system a completely static JPG or PNG image of the requested gesture.
The script broadcasts this single frozen frame in an infinite loop with a fixed frame rate. When the security system scans the virtual camera, it detects the perfectly still hand, immediately flags it as "PASSED", and grants access. The high-tech verification engine completely ignores the total lack of micro-tremors, pulse, or skin texture. It simply trusts a dead, unmoving picture more than a dog trusts its owner.
The team behind the bypass openly mocked the security feature, stating that tricking this futuristic biometric scanner was actually much easier than solving an old-school text CAPTCHA.
Once again, the tech industry has replaced a working, albeit annoying, security measure with an over-engineered AI gimmick that collapses at the sight of a basic static file. It seems the future of cybersecurity is just a glorified game of show-and-tell where the AI is easily pleased by a printed photo.
Comments
Help shape the next version: Add context or suggest a correction. AI review can add points toward a rewrite. Reviews and updates may take time; a full meter does not guarantee a new version.