1

I am implementing a website that included my own text Captcha (I do not use any Captcha service - like reCaptcha). the Captcha code serves each challenge (i.e. image) only once for both display and verification process. Can anybody please tell me about the possible scenarios that may be used by an attacker to relay a Captcha image to a human solver (e.g. low-cost human labor); and what’s the defense ways against them, if any?

Please note that the image is removed from the server immediately after first retrieving by the user - so there is no way to retrieve it (i.e. redirect the image link) again by anyone.

2

When you are sending the URL of the captcha image to the client, the client will download that image. This is how viewing images on websites works.

The client now has the image in memory. They can do with that data whatever it wants, including sending it to a captcha solving sweat shop. The sweat shop doesn't receive the original URL, just the raw image data. When they solved it, they send back the response and your client can forward that response to you.

From the perspective of your application, the client is a completely black box. Sorry, but there is no way to tell if they solved the captcha themselves or outsourced it to a different party.


But if you are a low-value target for spammers and bots, then there is an alternative solution with which I achieved quite good results in the past: A simple context-based text question. I once administrated a forum about a video game. The forum was really adored by spam bots. We tried different captchas, but none worked. Then I added a simple question to the registration form: "Enter the name of the game this forum is about". Then the spam was gone. The question of course accepted a large variety of possible misspellings and conceivable abbreviations and shorthands to make sure that no legitimate human user was blocked by it.

Note that some spam bots (or their human captcha solvers) have evolved to be able to answer very trivial questions. What's 2 + 4 or Enter ''I am not a spam bot'' here don't work anymore. But if you ask for some domain-knowledge which every legitimate user should know but which is unclear for someone (or something) which looks only at the login form, then it's a useful deterrent.

But this of course only applies to low-value targets. When you are a target which is valuable enough to spend an hour or two on to figure out how to automatize account creation, they will figure out the answer to your question and hardcode it.

1

Can anybody please tell me about the possible scenarios that may be used by an attacker to relay a Captcha image to a human solver (e.g. low-cost human labor); and what’s the defense ways against them, if any?

Lowest-tech attack to is for the cheap laborer to be given a VNC with Firefox, and asked to solve the Captcha, whereupon the access cookie can be dumped and reused in, e.g., a scraper.

The only thing you can do is ban an IP after a given number of Captcha solves, even if the Captcha is solved correctly.

But note that it isn't very difficult for an attacker to get different IPs and completely simulate many users.

  • My thought was as follows: because the Captcha image is used only once, there are two possible scenarios: 1) an attacker redirects the requested image directly - using its link - (is this possible? if yes! how?) to Human third-party (e.g. sweatshops in India) to decipher CAPTCHA code in exchange for small money. – alg Feb 6 '17 at 0:55
  • OR 2) downloading the Captcha image in his/her browser using a script (scraper) and then takes a screenshot/reading the image's pixels (here I do not know how! is this possible? please, if yes - let me know how?) , and then uploads it to the C&C server in order to forward it to the human solver. – alg Feb 6 '17 at 0:56
  • About using the IP, in addition to the issue you mentioned, another problem is also when using proxies (e.g. companies that have thousands of users with the same IP address) – so I think the IP is not reliable and guaranteed , but I am not sure whether the user-agent can be used for this purpose or not? – alg Feb 6 '17 at 0:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.