A CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a test designed to tell apart real people from computer programs. Many CAPTCHAs can be tricked because of problems in how they are made or used. Attackers take advantage of these problems to automatically fill out forms, make fake accounts, or do many things at once without being stopped by the CAPTCHA.
These tricks often work because of simple mistakes, like CAPTCHA codes that are easy to guess, not checking things well enough on the server, or only checking on the user’s computer. Also, more advanced attacks might use computer programs that can read letters and numbers or use real people to solve CAPTCHAs.
Some CAPTCHAs create a code that stays valid for too long or can be used again:
- Reused Token: The CAPTCHA code is only checked once on the server and then not marked as used. This lets attackers use the same solved CAPTCHA over and over.
- Predictable IDs: If the CAPTCHA’s picture names or settings follow a pattern, attackers might guess the solutions.
If the CAPTCHA is only checked on the user’s computer, attackers can easily skip or turn off the check. They can change things in the browser to remove the CAPTCHA or ignore it.
If the CAPTCHA images or audio are easy to understand, computer programs can solve them easily:
- Low Distortion: Simple picture CAPTCHAs with clear letters and numbers are easy for computer programs to read.
- Predictable Background: If the background is plain, it’s easier to find the letters and numbers.
- Simple Audio Challenges: Computer programs can easily understand simple spoken words or numbers. This ease of understanding by machines is partly why data from solved CAPTCHAs has historically been valuable for training image-to-text recognition (OCR) systems.
Attackers often pay real people to solve CAPTCHAs for them:
- Crowdsourced Services: Attackers send CAPTCHAs to services where people solve them quickly for little money.
- Phishing or Proxy Tactics: Attackers trick people into solving CAPTCHAs for them, like on a fake website.
- Server-Side Enforcement and Validation
- Only check CAPTCHA codes on the server and mark them as used after one use.
- Don’t only rely on the user’s computer to check CAPTCHA results or control when forms can be submitted.
- Use Secure and Evolving CAPTCHA Mechanisms
- Use modern CAPTCHAs that have complicated pictures, different types of challenges, or change how hard they are.
- Update CAPTCHA programs regularly to stay ahead of attackers.
- Rate Limiting and Behavior Analysis
- Limit how many times someone can try to solve a CAPTCHA to reduce the impact of attackers.
- Watch how users behave, like how they move the mouse, to find and block computer programs.
- Short Expiration and Non-Predictable Tokens
- Create CAPTCHA codes that are hard to guess and use strong computer security methods.
- Make the codes expire quickly to prevent them from being reused.
- Multi-Factor or Additional Security Layers
- Use CAPTCHAs with other security measures, like email or phone verification.
- Use multi-factor authentication for important actions, so you don’t have to rely on CAPTCHAs alone.