Can a CSRF CAPTCHA be defeated?

Question

One defense that developers use to protect against a CSRF attack is to implement a CAPTCHA in critical steps. A CAPTCHA ensures that a human is at the keyboard approving the activity. But I've heard that CAPTCHAs have been broken. Sure, I can see how the CAPTCHA-defeating software could be used by bots to post spam to forums and such. But I don't see any techniques that could be used in a CSRF attack.

Can anyone explain exactly how an attacker can defeat a CAPTCHA in a CSRF exploit?

To clarify ... I understand how CSRF works and the various methods of protecting against them. What I want to know is how the CAPTCHA protection can be defeated.

Answer 1

A CAPTCHA would not be defeatable as an XSRF mitigation except by brute force, or another type of attack (eg clickjacking to frame the target site's UI in a redressing context). Image analysis could not be applied because an attacker from another site doesn't have read access to the content in the CAPTCHA.

However!

One defense that developers use to protect against a CSRF attack is to implement a CAPTCHA in critical steps.

I don't know the developers you're talking about, they don't sound very sane.

You get the same benefit without the cost in degraded user experience by simply sending a token to the client and having the same token checked when it comes back to the server. (You can also get much more entropy in such a token than a user could comfortably type in a CAPTCHA, making it brute-proof.)

Per-session synchronizer token pattern

Answer 2

Using a CAPTCHA can be an effective method of mitigating risk of a successful CSRF attack. There are ways of defeating CAPTCHAs in general, but if you pick a solid implementation then they are effective. However, they do result in a fairly negative user experience (every time you're going to do anything sensitive, you need to enter a CAPTCHA = lots of very unhappy users).

A better idea is the use of validation tokens, as they are transparent to the user. This is generally regarded as the preferred-method of CSRF mitigation. You can also combine this with a weak-referrer-check if you'd like multiple countermeasures in place (see here: Should I use HTTP referrer validation or token verification to prevent CSRF attacks?).

Answer 3

CAPTCHA can be broken by using image/audio analysis.

In it’s most basic form Optical Character Recognition (OCR) a technology that has been around years. OCR reads an image and looks for characters it understands and translates that to text… Bingo, a method for breaking image CAPTCHA.

Likewise speech analysis, we have it on phones, gaming consoles etc. Again the technology has been around for years.

Image verification CAPTCHA often uses noise in the image to make it harder but filtering out the noise is not that hard. Really it only takes a bit more processing.

CAPTCHA is still a good deterrent because it adds complexity and is generally well accepted by users, but it is not a silver bullet.

Also another way CAPTCHA can be broken is by humans. A few years back I believe there was a few large botnets that were collecting the answers to CAPTCHA codes by serving them up to infected machines.

To protect your CAPTCHA or any manual verification system, limiting the time the codes are valid for is a first defence.

Hope that helps.

Answer 4

As always: it depends. In this case it depends on the actual Captcha implementation. Because if the Captcha can be solved by also forging the response or it can be tricked with replay attack, it’s won’t protect you against CSRF either.

But let’s assume you use a secure Captcha. Then to solve a Captcha an attacker either needs to be able to read it somehow and solve it or they brute force it.

Reading the challenge is not possible due to the Same-Origin Policy. So general Captcha solving methods like OCR or human solving doesn’t work here. Then the last viable attack is brute forcing.

If that’s all not possible, using a Captcha can prevent CSRF attacks. But as already said, there are also other, less annoying solutions to mitigate CSRF attacks.