5

I am developing a web application. I am planning to skip CAPTCHAs for the initial signup by an IP so as to improve user experience. I was wondering if I am inviting any security risks by doing this. Is it possible for a malicious user to make many signups by using a new IP for each request? Also, How difficult is it for an attacker to achieve this?

Improve this question
6
  • 2
    An obvious problem is many different users sharing the same IP.
    – Deer Hunter
    Commented Feb 27, 2014 at 15:48
  • 1
    also, removing captcha will again allow automated form submission. In short: don't.
    – Wim Ombelets
    Commented Feb 27, 2014 at 15:50
  • @WimOmbelets Captcha will came in effect after a form is already submitted by the IP
    – user32902
    Commented Feb 27, 2014 at 15:51
  • the captcha before the form submission also serves as a way to avoid form submission flood
    – Wim Ombelets
    Commented Feb 27, 2014 at 15:55
  • 1
    @WimOmbelets I meant if an IP tries to submit form again after first attempt, it have to pass the captcha.
    – user32902
    Commented Feb 27, 2014 at 16:03

3 Answers 3

Reset to default
7

Yes it can be done. It's trivial.

There are many ways for a user or an attacker to have multiple IP addresses - or to share IP addresses. Here's a list, off the top of my head.

These all assume that the IP address of the target system is exposed to your server. Either you're running some code (like JavaScript) to detect the IP address, or the client allows connections directly from systems without any interruption.

Shared Addresses

This list is how one IP address may be used by multiple systems.

  • Multi-user host. Many hosts are used by multiple people. by definition, they will all use the same interfaces to connect to your server, and therefore share IP addresses.
  • DHCP. DHCP works by creating a pool of IP addresses, from which the client (the system that will eventually connect to you) is assigned one of the addresses. The IP address used by this system is eventually returned to the pool. At this point, someone else can pick up the IP address. If both systems connect to your system, they could each connect at a time when they possess the IP address.
  • Manual IP configuration. Anyone can configure their network interface to use any IP address they want. A system could be intentionally configured to use an IP address in use by another system.
  • False Information. If you are detecting the IP address by running code on the client, the client can feed your code false information. For example, a Greasemonkey script can modify your javascript and cause it to return any IP address the attacker wants.
  • NAT. There are networks that use Network Address Translation to show a very small number of re-used IP addresses to the internet, while using entirely different addresses within the network. This is extremely common. WHen clients connect to your server through NAT servers, they will all appear to come from the same IP address.
  • Reserved IP Addresses. It is very common to pair NAT with reserved IP addresses. Reserved IP addresses, such as 192.168.*.*, are re-used by many organizations. These addresses are only routable within the local network, so NAT servers present other networks with remotely routable addresses. If you use something like JavaScript code to detect the IP address of the client, there will be many clients that reuse these addresses.

Multiple Addresses

This list is how a single host can appear to have multiple IP addresses.

  • DHCP. As described in the first list, the IP address is eventually released by the system using it and returned to the pool. When the system connects back to the network, it will be granted a new address, which is not guaranteed to be the same as the old address.
  • Manual IP configuration. Anyone can configure their network interface to use any IP address they want. A system could be intentionally configured to use one IP address, then five minutes later use another address.
  • False Information. If you are detecting the IP address by running code on the client, the client can feed your code false information. For example, a Greasemonkey script can modify your javascript and cause it to return any IP address the attacker wants.
  • NAT. NAT isn't required to use the same address the every time for the same client. A single client could connect to your server through NAT and be given a different IP address every time.
  • Laptop roaming across networks. When a system disconnects from one network and connects to another network, it gets a new IP address from the new network. While there is a low probability of a getting a reserved locally routable address from the new network that exactly matches the reserved locally routable address from the old network, this is far from guaranteed. More likely, the address will be different. The NATted address is "guaranteed" to be different.
  • Multi-homed machines. A multi-homed machine is connected to the network via multiple network cards, or to multiple networks with multiple interfaces. This machine, by definition, has multiple IP addresses - one for each interface. If traffic comes to you through one network one time, then the other network another time, the same host will connect using multiple addresses. This is unlikely, but can occur given the right network structure.
  • Botnet. Attackers can rent or build a botnet. The botnet will, by definition, be constructed of multiple systems, each of which will have a different IP address. The attacker will have multiple IPs at his/her disposal.
Improve this answer
2
  • the last 2 of shared addresses say the same thing (NAT shares addresses).
    – ratchet freak
    Commented Feb 27, 2014 at 23:41
  • @ratchetfreak, the last two are similar, but there are differences. You don't have to have NAT to have reserved IP addresses. The reserved addresses can be exposed if, as I originally wrote, code is running on the client to detect what the client thinks its IP address is. With NAT, there must be a NAT server between the client and the server that replaces the IP address. Similarly, NAT can be used without reserved addresses. The only reason that the reserved addresses mentions NAT is as a segue from one to the other.
    – atk
    Commented Feb 28, 2014 at 1:41
3

It's less of a matter of if the attacker can change their IP and more of a matter of good practice. If you don't have a captcha on your page, even initally, it allows for automated form submission which you definitely do not want. For example, an attacker that controls a botnet can target you, and then all IPs on the botnet would be different. The attacker doesn't have to change any IPs if they control so many. If I were you, I'd play it safe and implement a captcha regardless. Better safe than sorry.

Improve this answer
1
0

First thing that would come to my mind: a simple list of proxy servers that an attacker can use to make many signup or any other action, pretending he's many different users.

Typically, this could be used to bypass security for online votations, contests etc. and from an attacker point of view, this is probably the easiest way to go (script to automate signup through a dynamic proxy servers list would be around 20 lines in perl/python).

Improve this answer

You must log in to answer this question.