0

Presume I'm a bad actor and want to do a naughty thing on a site protected by some 3rd party CAPTCHA solution. For instance, perhaps I'm a spammer who wants some way to script sign-ups to Hotmail.

For the target site to use CAPTCHA, it presumably must load a javascript file from the CAPTCHA provider's server. Since I'm in control of the browser (and DNS etc) what's to stop me substituting my own javascript instead? And if I can swap in my own script, what's to stop me "short-circuiting" the CAPTCHA to be immediately solved?

Out of curiosity, I did some Googling. I found that there are indeed some providers who claim they can defeat CAPTCHAs, but interestingly these providers all seem to use humans to do the solving. (Basing this on the fact that they all offer a sign-up option for workers as well as clients.)

What is the defence mechanism against the sort of attack I've described?

17
  • This would work if your computer is telling the remote server that you solved the captcha, but it isn't. Google is telling the remote server that you solved the captcha (maybe through your computer via a token, but it's a token that your computer can't forge). – user Oct 21 '20 at 14:20
  • Ah that's interesting. So the communication is going from the browser, to Google, to the service provider's server? – Tom Wright Oct 21 '20 at 14:23
  • Not entirely sure about how Google's captcha system works, but ultimately the web server will receive a token that was generated by Google (either directly from Google, or bundled with the data that the client sends) that signifies that the client completed the captcha. – user Oct 21 '20 at 14:25
  • 1
    According to this it looks like the web client will get the token and add it into the form when it uploads to the web server. – user Oct 21 '20 at 14:27
  • @user That would seem to still be vulnerable to a substitution attack then, if a bad actor controlled the web client? – Tom Wright Oct 21 '20 at 14:29
2

The solution is to never trust clients to execute code. If everything is done server-side, there is no possibility of a MITM attack, since you can just cryptographically sign the token that says "Yes, User X did complete the CAPTCHA at this time". As soon as you add in authentication, MITM becomes incredibly difficult.

You can substitute your own JS, but the website you are trying to spam won't let you finish the signup process because it expects a signed token from the CAPTCHA server. Without access to the private key, a client cannot create these tokens.

0

@Expectator has the right of it, but I wanted to elaborate a little bit on how third party CAPTCHA servers work and why your plan to bypass them would fail.

In your plan, you say that you are "in control of the browser" ... but this is making an assumption that the only communication is between your client and the target server. This is a bad assumption as there is actually a 3 way communication happening:

  • client <---> target server
  • client <---> CAPTCHA server
  • target server <---> CAPTCHA server

The connection between the target server and the CAPTCHA server could be a direct connection or it could be done via a shared secret using your browser as a proxy between them ... in either case, your not going to be able to bypass it simply be changing the javascript presented by the 3rd party CAPTCHA provider.

2
  • Actually, it was my realisation that (at least) ReCAPTCHA v3 doesn't use direct target server<--->CAPTCHA server communication that sparked this question. See their installation guide: developers.google.com/recaptcha/docs/v3 – Tom Wright Oct 23 '20 at 7:23
  • As I stated, it can go direct target server<--->CAPTCHA or it can go via a shared secret using your browser as a proxy both are possible. Even if its via a shared secret ... client side wont know what that shared secret is ... which means your still not going to get around it. – CaffeineAddiction Oct 23 '20 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.