How strong is visualCaptcha?

Question

I like the user interaction of visualCaptcha, but I'm questioning the amount of protection it gives:

Since there are only 5 images (by default), isn't is simply a matter of 1 in 5 to get the right image?

Also, the whole process is initiated by sending a start/X request, where X is the number of options to generate. As far as I can tell, a bot might initiate with X = 2 instead of 5 and get 50% of the tries right.

Answer 1

There are two considerable weaknesses in the live demo which make it quite trivial to break:

1. There are only 5 possible answers to the captcha question, so a bot has a 20% chance to solve the captcha by picking a random symbol. The demo didn't ban me after picking a wrong answer over 20 times in a row, so there is no reason why a bot can't just keep guessing until it got a correct answer by chance.
2. There is only a very limited set of images which are in no way altered. They appear under different URLs, but always look the same, so a bot can identify them by loading and decoding the images. Also, the system refers to each image with the same word every time. That would allow to simply tell the bot which word means which image.

Some ideas to make the captcha stronger:

• Ask the user to mark multiple objects and only let them pass when they marked these and only these objects. That would make random guessing much less efficient.
• Ban IP addresses for a few minutes after many wrong answers in a row
• Use a much larger set of images
• Use an even larger dictionary of strings to refer to them
• Use image altering algorithms with randomized parameters to alienate the images a bit so it gets harder to recognize them automatically

Keep in mind that no captcha is truly unbreakable. All you can hope for is to increase the effort an attacker needs to invest to break it. But that can be all you need. Captchas are one of the few areas where security through obscurity can pay off. Spammers look for low-hanging fruits. When you use an obscure home-brewed captcha solution and aren't a particularly valuable target, many spammers will just be too lazy to figure it out. When you are a particularly valuable target, they will just hire a bunch of people from a 3rd world country to solve your captchas. And you can not defend against this without also making your website unusable for regular users.

Answer 2

To try it out, I've written a small bot that tries to post the the visual captcha demo.

If first initiates the captcha session, telling is only wants 2 options using http://demo.visualcaptcha.net/start/2. Than it picks one of the two possible results and posts to http://demo.visualcaptcha.net/try.

Result:

✓☓☓✓✓✓☓☓☓☓☓☓☓✓✓☓☓☓☓☓✓☓✓✓☓✓✓☓✓✓☓✓✓✓✓✓☓✓☓✓✓✓☓✓☓✓☓✓✓✓
☓✓✓☓✓☓✓✓☓☓✓☓✓✓☓☓✓☓✓✓✓☓✓☓☓✓✓☓✓☓✓☓☓☓☓☓✓✓☓☓✓☓☓✓☓✓☓☓☓✓
✓☓☓✓✓✓☓✓☓☓✓☓☓✓☓☓☓☓☓☓✓✓✓☓✓☓✓☓☓☓✓✓☓✓☓☓✓✓☓☓☓✓✓☓✓☓☓✓✓✓
☓✓☓✓✓☓☓✓✓☓☓☓✓☓☓✓☓✓☓✓✓☓☓☓✓✓☓✓☓✓✓✓✓✓✓✓✓✓☓☓✓☓☓☓✓✓☓✓✓☓
☓✓☓☓✓✓✓✓☓✓✓✓☓✓✓☓☓✓☓✓✓✓✓☓☓✓✓✓☓☓✓☓✓☓✓✓✓☓✓✓☓☓✓☓✓☓☓☓☓☓
Of the 250 tries, I succeeded 127 times and failed 123 times.

VisualCaptcha is clearly very unsafe.

Using a fixed number of images (eg 5), instead of letting the client pick the number of images, would help to reduce the successful tries to 1 in 5. Though I recon that's not sufficient for most use cases.

---

<?php

/**
 * Try posting to the visualCaptcha demo
 * @return boolean  true if posted successfully
 */
function tryVisualCaptcha()
{
    $curl = curl_init();
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($curl, CURLOPT_COOKIEJAR, "/tmp/visualcaptcha-cookies.txt");
    curl_setopt($curl, CURLOPT_COOKIEFILE, "/tmp/visualcaptcha-cookies.txt");

    curl_setopt($curl, CURLOPT_URL, "http://demo.visualcaptcha.net/start/2");
    $ret = curl_exec($curl);
    $result = json_decode($ret);

    $post = [$result->imageFieldName => $result->values[0]];

    curl_setopt($curl, CURLOPT_URL, "http://demo.visualcaptcha.net/try");
    curl_setopt($curl, CURLOPT_POST, true);
    curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($post));
    curl_exec($curl);

    $info = curl_getinfo($curl);
    return strpos($info['redirect_url'], 'validImage') !== false;
}

// Main
$results = [0 => 0, 1 => 0];

for ($i = 1; $i <= 250; $i++) {
    $success = tryVisualCaptcha();
    $results[(int)$success]++;

    echo $success ? "✓" : "☓", $i % 50 === 0 ? "\n" : "";
}

echo "Of the ", array_sum($results), " tries, I succeeded ", $results[1],
  " times and failed ", $results[0], " times.\n";

Answer 3

All one would need to do is split the captcha into individual images and perform a Google image search of each image and the target word. And simply pick whichever one has the most results .From that point I am fairly sure that one could get pretty damn high accuracy.

You can do a search for

"Type below the answer to what you hear" OBJECT

where OBJECT is the word of the picture.

Examples: Lamp, Car, Lock, Flag.

Answer 4

VisualCaptcha is an excellent solution for UX, but can be broken with 100% success rate.

As Proof-of-Concept, there is a little script to break 100% VisualCaptcha included in this blog post

There are several techniques to increase the security of VisualCaptcha. These techniques will not be integrated in the "core" of VC, but a developer can decide to implement them if needed, as discussed with Bruno Bernardino.

Answer 5

Full disclosure: I'm the "inventor" of visualCaptcha.

First of all, I love seeing so much people interested and using visualCaptcha. It's been getting a lot of attention and love in the past 6 months. It's amazing to see more and more people using it and interested in improving and "cracking it".

I do want everyone to understand the problem visualCaptcha solves is the User Experience of Captchas, while not being insecure (or as insecure as most visual captchas, when this one was created).

If you need a very secure captcha, there are plenty out there, like ReCaptcha, but your users will get a worst experience (Google's been working hard on that, though, good stuff).

Ultimately, it's up to you to decide what's most important for your use case.

Philip made a great point about it not being worth it for spammers to break your captcha. One of the great things about visualCaptcha is the customizability. You can easily switch around how it works (URLs, images, number of images, etc.) and so it'll always be harder for them to eventually bother to create something to crack it.

Also, many well-known government websites around the world use customized versions of visualCaptcha very successfully. There hasn't been one complaint about it being "broken" by a bot. And when that happens, we'll help through preventing that.

Some other URLs for reference: https://github.com/emotionLoop/visualCaptcha/issues/2 https://github.com/emotionLoop/visualCaptcha/issues/8