Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This seems like an easy question, but I've failed to find an answer.

One of the uses of CAPTCHA is to cope mitigate Denial of Service attacks. Suppose an adversary performs excessive login attempts, leaving other users unable to log in; the service can require solving a CAPTCHA before logging in. But why, in this case, does the CAPTCHA service continue to run while the login service fails under the same traffic load? Why does it work?

share|improve this question
1  
@Henning Thanks for editing, the text is much better now. –  overrider Oct 22 '12 at 8:39

5 Answers 5

up vote 6 down vote accepted

It is easier/faster to check if a CAPTCHA is correct than to lookup a user in the database (this may include new connections, hashing and more). A server first check the CAPTCHA, if it is correct then process the rest of the login, if not return an error.

It is important to note that making of a CAPTCHA image requires some processing, but this can be done quite effective pre rendered images or even outsourcing to other services (like reCAPTCHA).

share|improve this answer
    
I’m going to accept your answer, because you made both important points: 1) CAPTCHA is an effective protection when checking it requires less CPU/memory than login, 2) in particular, it is effective when outsourced to reCAPTCHA; and you seem to be the first who mentioned that. –  overrider Oct 22 '12 at 8:36
1  
@overrider both points are backwards. 1) Processing CAPTCHAs, if done right, would take more processing than logins; 2) outsourcing to reCAPTCHA, while saving on CPU power, will instead block over network access, which is orders of magnitude slower than CPU. –  AviD Oct 22 '12 at 9:54

A captcha prevents an attacker from performing more database-intensive operations that may cause a DoS via CPU or memory exhaustion. However, this is only the case when the CPU and memory consumption caused by generating the captcha image must be less than that of the normal page request. One way to ensure this is to use an off-site captcha service, such as reCAPTCHA.

Ordinarily, the DoS prevention aspect of the captcha is a by-product of using it as a login security measure, to prevent automated login attempts.

share|improve this answer

BY THE MAGICK POWER OF UNICORNS!!!

Snark aside, CAPTCHA is a very poor solution for D/DoS protection. While it does have some effect, this is minimal, and easily compensated for by the attackers.

CAPTCHA solves the wrong problem for this, and solves it badly.
CAPTCHA does not try to rate-limit the connections; it is not intended to protect the login mechanism from attacks; it is not possible for CAPTCHA to differentiate between attackers and legitimate users.

The only thing it does do - and not very well, at that - is, not surprisingly: Tell Computers and Humans Apart. This might in fact be useful to you, if you were in a Matrix-like reality, where all Computers are the enemy, and all Humans are allies.
In our reality, that is a pointless differentiation. Ostensibly, this might help with preventing scripted attacks - but even if this were true (it's not), there are plenty of ways to bypass that requirement - e.g. CAPTCHA proxies (where you need to solve a CAPTCHA before we show you dem pr0n) and CAPTCHA farms (where you hire some fareasterners to "solve" CAPTCHA for you, at 4$ per 1000 pops).
Moreover, in the case of DDoS - often this attack is mounted by "political movement" - i.e. large masses of humans decide to bring down a certain site. So yeah, CAPTCHA would be irrelevant here.

Besides all that, state-of-the-art CAPTCHA is far behind state-of-the-art OCR. If you want your users to easily decipher those squiggly images - the computer can do this too, pretty well. The best CAPTCHAs were measured at 20% OCR success rate - which effectively means that for every successful request, the attacker would simply need to send 5 requests. Not quite the order of magnitude that would make a substantial difference, to an attacker that is already planning on mounting a DDoS.


Some of my other posts here and on SO regarding this:


TL;DR:
The question is based on a faulty assumption:

How does CAPTCHA defend from DDoS attacks?

It doesn't.
At most it might require a bit more effort from the attacker, but not much.

share|improve this answer
1  
+1 for unicorns, which (rather amusingly) seem to be on the other side of the fence. –  Polynomial Oct 22 '12 at 11:01

I don't think that captchas could help against a Denial Of Service attack. I think they could even pose a thread of DoSing the site if the captcha algorithm is CPU intensive.

In order to execute a successful DoS attack on a server the costs of the attacker should be lower than the cost of the attacked server. The server has high costs even if he uses captchas. The server needs to generate the captchas and transmit the whole page to the clients.

Edit: In short: A Captcha can be contraproductive if the generation of the captcha costs too much.

share|improve this answer
1  
This is why CAPTCHA is often run from an external service. –  bobince Oct 21 '12 at 20:14

It doesn't, although you sometimes see claims to that effect. CAPTCHAs are intended to prevent automated submission of data on a website. DDoS attacks are almost always at the network level, well before data is submitted over HTTP. If an HTML form is vulnerable to DoS (not DDoS) attacks, a CAPTCHA would make exploitation difficult, but the proper solution is to fix the form, not slap a band-aid (CAPTCHA) on it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.