Can a CSRF CAPTCHA be defeated?
Is it to possible break captcha? If yes, how? If no, why websites use difficult captcha systems?
This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.
Yes. CAPTCHA is broken and I have actually used software that breaks it.
I forget the toolkit. Its on my laptop and I'm at work right now but I just googled and found this one http://code.google.com/p/captcha-breaker/
There have been some successful attacks against reCAPTCHA as well but I think they have been mitigated.
Yes. The most foolproof method is using humans for low wages, who will break ~1000 CAPTCHAs for ~$2. Certain CAPTCHAs have been broken at various times (though they often get upgraded to become more difficult), but still present a difficult barrier for spammers (who often will go to easier targets instead).