Thursday, December 4, 2014

The No CAPTCHA problem

When I read about No CAPTCHA for the first time I was really excited. Did we finally find a better solution? Hashcash? Or what?

Finally it's available and the blog post disappointed me a bit. Here's Wordpress registration page successfully using No CAPTCHA.


Now let's open it in incognito tab... Wait, annoying CAPTCHA again? But i'm a human!



So what Google is trying to sell us as a comprehensive bot detecting algorithm is simply a whitelist based on your previous online behavior, CAPTCHAs you solved. Essentially - your cookies. Under the hood they replaced challenge/response pairs with token "g-recaptcha-response". Good guys get it "for free", bad guys still have to solve a challenge.

Does it make bot's job harder? No at all. The legacy flow is still available and old OCR bots can keep recognizing.

But what about new "find a similar image" challenges? Bots can't do that!
As long as $1 per hour is ok for many people in 3rd world, bots won't need to solve new challenges. No matter how complex they are, bots simply need to get the JS code of challenge, show it to another human being (working for cheap or just a visitor on popular websites) and use the answer that human provided.

The thing is No CAPTCHA actually introduces a new weakness!

Abusing clickjacking we can make the user (a good guy) generate g-recaptcha-response for us - make a click (demo bot for wordpress). Then we can use this g-recaptcha-response to make a valid request to the victim (from our server or from user's browser).


It's pretty much a serious weakness of new reCAPTCHA - instead of making everyone recognize those images we can make a bunch of good "trustworthy" users generate g-recaptcha-response-s for us. Bot's job just got easier!

You're probably surprised, how can we use 3rd party data-sitekey on our website?
Don't be - the Referrer-based protection was pretty easy to bypass with <meta name="referrer" content="never">.

P.S. Many developers still think you need to wait a while to get a new challenge.
In fact you can prepare as many challenges as you want and then start spaming later. It's another reCAPTCHA weakness that will never be fixed.
Author: on

13 comments:

  1. PascalDecember 4, 2014 at 4:08 AM

    Getting
    "ERROR: Invalid domain for site key"

    on http://homakov.github.io/nocaptcha.html

    ReplyDelete
    Replies
    1. homakovDecember 4, 2014 at 4:12 AM

      you're using an outdated browser? Read the last paragraph - we need referrer=never to bypass their "protection"

      Delete
    2. AnonymousDecember 4, 2014 at 4:16 AM

      I got that error too and I'm using Firefox.

      http://imgur.com/S3hU64u

      Delete
    3. homakovDecember 4, 2014 at 4:41 AM

      hmm maybe because i don't use proper markup. Anyway it *is* solvable, there's always a way to kill referer, we can use data:text/html after all. For demonstration please use chrome :)

      Delete
    4. PascalDecember 4, 2014 at 6:46 AM

      yep, works in chrome. Used FireFox 33.1 before.

      Delete
  2. BenDecember 4, 2014 at 9:26 AM

    Why don't they require referrer headers to be present and to match the domain, rather than only checking for a mismatch if they are present -- too many addons/proxies that strip them?

    ReplyDelete
  3. AnonymousDecember 4, 2014 at 1:31 PM

    They don't do image likeness ones because generating those data sets is very complex and that cat one, while cute, probably took a day to create, and would take a spammer like 2 minutes to be able to handle that particular question if it comes up in the future.

    ReplyDelete
  4. AnonymousDecember 9, 2014 at 7:36 AM

    This might interest you:

    https://github.com/ReCaptchaReverser/InsideReCaptcha

    ReplyDelete
  5. AnonymousDecember 18, 2014 at 4:02 AM

    How i can activate it on blogger.com?

    ReplyDelete
  6. AnonymousDecember 28, 2014 at 9:45 AM

    According to my tests this works fine for like 3/4 consecutive times a given "good-guy" user solves a captcha. Then it seems to show me a captcha always. If this is the case, this technique is almost worthless for me.. Need too many good guy users to do any decent spam

    ReplyDelete
  7. AnonymousJuly 8, 2015 at 12:16 AM

    Hello, I have problem with "Invalid domain" on Chrome 43.0.2357.130 m

    ReplyDelete
  8. ZigJuly 9, 2015 at 10:46 PM

    This "Invalid domain" bypass doesn't seem to work anymore.

    ReplyDelete

Subscribe to: Post Comments (Atom)