0

Presume I'm a bad actor and want to do a naughty thing on a site protected by some 3rd party CAPTCHA solution. For instance, perhaps I'm a spammer who wants some way to script sign-ups to Hotmail.

For the target site to use CAPTCHA, it presumably must load a javascript file from the CAPTCHA provider's server. Since I'm in control of the browser (and DNS etc) what's to stop me substituting my own javascript instead? And if I can swap in my own script, what's to stop me "short-circuiting" the CAPTCHA to be immediately solved?

Out of curiosity, I did some Googling. I found that there are indeed some providers who claim they can defeat CAPTCHAs, but interestingly these providers all seem to use humans to do the solving. (Basing this on the fact that they all offer a sign-up option for workers as well as clients.)

What is the defence mechanism against the sort of attack I've described?

Improve this question
17
  • This would work if your computer is telling the remote server that you solved the captcha, but it isn't. Google is telling the remote server that you solved the captcha (maybe through your computer via a token, but it's a token that your computer can't forge).
    – user
    Oct 21, 2020 at 14:20
  • Ah that's interesting. So the communication is going from the browser, to Google, to the service provider's server?
    – Tom Wright
    Oct 21, 2020 at 14:23
  • Not entirely sure about how Google's captcha system works, but ultimately the web server will receive a token that was generated by Google (either directly from Google, or bundled with the data that the client sends) that signifies that the client completed the captcha.
    – user
    Oct 21, 2020 at 14:25
  • 1
    According to this it looks like the web client will get the token and add it into the form when it uploads to the web server.
    – user
    Oct 21, 2020 at 14:27
  • @user That would seem to still be vulnerable to a substitution attack then, if a bad actor controlled the web client?
    – Tom Wright
    Oct 21, 2020 at 14:29

2 Answers 2

Reset to default
2

The solution is to never trust clients to execute code. If everything is done server-side, there is no possibility of a MITM attack, since you can just cryptographically sign the token that says "Yes, User X did complete the CAPTCHA at this time". As soon as you add in authentication, MITM becomes incredibly difficult.

You can substitute your own JS, but the website you are trying to spam won't let you finish the signup process because it expects a signed token from the CAPTCHA server. Without access to the private key, a client cannot create these tokens.

Improve this answer
0

@Expectator has the right of it, but I wanted to elaborate a little bit on how third party CAPTCHA servers work and why your plan to bypass them would fail.

In your plan, you say that you are "in control of the browser" ... but this is making an assumption that the only communication is between your client and the target server. This is a bad assumption as there is actually a 3 way communication happening:

  • client <---> target server
  • client <---> CAPTCHA server
  • target server <---> CAPTCHA server

The connection between the target server and the CAPTCHA server could be a direct connection or it could be done via a shared secret using your browser as a proxy between them ... in either case, your not going to be able to bypass it simply be changing the javascript presented by the 3rd party CAPTCHA provider.

Improve this answer
2
  • Actually, it was my realisation that (at least) ReCAPTCHA v3 doesn't use direct target server<--->CAPTCHA server communication that sparked this question. See their installation guide: developers.google.com/recaptcha/docs/v3
    – Tom Wright
    Oct 23, 2020 at 7:23
  • As I stated, it can go direct target server<--->CAPTCHA or it can go via a shared secret using your browser as a proxy both are possible. Even if its via a shared secret ... client side wont know what that shared secret is ... which means your still not going to get around it.
    – CaffeineAddiction
    Oct 23, 2020 at 19:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .