1

Apparently, Yii web application framework generates some kind of hash value from captcha codes it generates and sends it to the client side so it can be used for client side validation of the captcha codes (without the need to contact the server side for validation every time). client side hash value is indeed generated by a very week homemade hash function (or better to say, some checksum algorithm). It is just the sum of ascii codes of all characters of the captcha code! so several captcha codes may indeed easily create the same checksum. so if an attacker uses it for brute-force attack, it gets an non-deterministic result every time (several character combinations exists that generate the same checksum). Can u please analyze the security of this scheme somewhat more professionally and precisely? Probably some math calculation is needed. can this method be a sane thing? can it be used for severely breaking the security of the captcha system?

yii.validatin.js line 246 (client side javascript captcha validation function):

captcha: function (value, messages, options) {
            if (options.skipOnEmpty && pub.isEmpty(value)) {
                return;
            }

            // CAPTCHA may be updated via AJAX and the updated hash is stored in body data
            var hash = $('body').data(options.hashKey);
            if (hash == null) {
                hash = options.hash;
            } else {
                hash = hash[options.caseSensitive ? 0 : 1];
            }
            var v = options.caseSensitive ? value : value.toLowerCase();
            for (var i = v.length - 1, h = 0; i >= 0; --i) {
                h += v.charCodeAt(i);
            }
            if (h != hash) {
                pub.addMessage(messages, options.message, value);
            }
        },

server side checksum generation function:

/**
     * Generates a hash code that can be used for client side validation.
     * @param string $code the CAPTCHA code
     * @return string a hash code generated from the CAPTCHA code
     */
    public function generateValidationHash($code)
    {
        for ($h = 0, $i = strlen($code) - 1; $i >= 0; --$i) {
            $h += ord($code[$i]);
        }

        return $h;
    }
1

Server-side validation collates submitted value with a text representation of the captcha image, not the ascii sum or etc.

Let's take a look at standard 5 a-z chars captcha example:

  • Quantity of all combinations from aaaaa to zzzzz is 26^5 = 11881376 combinations.
  • Quantity of all ascii sums of our captcha is 610-485+1 = 126

So, if we have an ascii sum of captcha, we're refine our possible combinations area to 11881376 / 126 = 94296 combinations.

Even though our area is narrowed down by 99.2%, the risk mitigates by captcha regenerating after server-side validation fail, which leaves us only one try for combination, whereas we need to bruteforce about 94000 values for one captcha.

Surely, client-side validation increases possibility for captcha bypassing, but far not enough yet to really bypass it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.