I am developing a web application. I am planning to skip CAPTCHAs for the initial signup by an IP so as to improve user experience. I was wondering if I am inviting any security risks by doing this. Is it possible for a malicious user to make many signups by using a new IP for each request? Also, How difficult is it for an attacker to achieve this?
Yes it can be done. It's trivial.
There are many ways for a user or an attacker to have multiple IP addresses - or to share IP addresses. Here's a list, off the top of my head.
This list is how one IP address may be used by multiple systems.
- Multi-user host. Many hosts are used by multiple people. by definition, they will all use the same interfaces to connect to your server, and therefore share IP addresses.
- DHCP. DHCP works by creating a pool of IP addresses, from which the client (the system that will eventually connect to you) is assigned one of the addresses. The IP address used by this system is eventually returned to the pool. At this point, someone else can pick up the IP address. If both systems connect to your system, they could each connect at a time when they possess the IP address.
- Manual IP configuration. Anyone can configure their network interface to use any IP address they want. A system could be intentionally configured to use an IP address in use by another system.
- NAT. There are networks that use Network Address Translation to show a very small number of re-used IP addresses to the internet, while using entirely different addresses within the network. This is extremely common. WHen clients connect to your server through NAT servers, they will all appear to come from the same IP address.
This list is how a single host can appear to have multiple IP addresses.
- DHCP. As described in the first list, the IP address is eventually released by the system using it and returned to the pool. When the system connects back to the network, it will be granted a new address, which is not guaranteed to be the same as the old address.
- Manual IP configuration. Anyone can configure their network interface to use any IP address they want. A system could be intentionally configured to use one IP address, then five minutes later use another address.
- NAT. NAT isn't required to use the same address the every time for the same client. A single client could connect to your server through NAT and be given a different IP address every time.
- Laptop roaming across networks. When a system disconnects from one network and connects to another network, it gets a new IP address from the new network. While there is a low probability of a getting a reserved locally routable address from the new network that exactly matches the reserved locally routable address from the old network, this is far from guaranteed. More likely, the address will be different. The NATted address is "guaranteed" to be different.
- Multi-homed machines. A multi-homed machine is connected to the network via multiple network cards, or to multiple networks with multiple interfaces. This machine, by definition, has multiple IP addresses - one for each interface. If traffic comes to you through one network one time, then the other network another time, the same host will connect using multiple addresses. This is unlikely, but can occur given the right network structure.
- Botnet. Attackers can rent or build a botnet. The botnet will, by definition, be constructed of multiple systems, each of which will have a different IP address. The attacker will have multiple IPs at his/her disposal.
It's less of a matter of if the attacker can change their IP and more of a matter of good practice. If you don't have a captcha on your page, even initally, it allows for automated form submission which you definitely do not want. For example, an attacker that controls a botnet can target you, and then all IPs on the botnet would be different. The attacker doesn't have to change any IPs if they control so many. If I were you, I'd play it safe and implement a captcha regardless. Better safe than sorry.
First thing that would come to my mind: a simple list of proxy servers that an attacker can use to make many signup or any other action, pretending he's many different users.
Typically, this could be used to bypass security for online votations, contests etc. and from an attacker point of view, this is probably the easiest way to go (script to automate signup through a dynamic proxy servers list would be around 20 lines in perl/python).